Service system operation condition prediction method and system based on AI technology

Abstract

The invention provides a business system operation condition prediction method and system based on an AI technology, and the method comprises the steps: firstly obtaining monitoring index collection data of a target business system; then, according to a preset alarm rule, initial index alarm data is determined, and data preprocessing is carried out; secondly, based on the preprocessed initial index alarm data, alarm convergence and alarm root cause analysis positioning are carried out, and alarm historical data are determined; next, determining an alarm quantity prediction model through a time sequence algorithm according to alarm historical data, and training an index alarm prediction model through a sample feature vector training method; and finally, according to the alarm number prediction model and the trained index alarm prediction model, predicting an operation prediction result of the to-be-analyzed service system in a preset time window. According to the method, through combination of the alarm quantity prediction model and the index alarm prediction model, the accuracy of alarm prediction of the service system can be improved, and the accuracy of the operation condition of the service system can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of computer operation and maintenance technology, and specifically to a method and system for predicting the operation status of a business system based on AI technology. Background Art

[0002] With the rapid development of computer technology, business systems used to implement various business scenarios are increasingly widely used. Business systems will face various complex situations in the actual operation process. In order to ensure the normal operation of business systems, it is necessary to predict the operation of business systems. In order to find out the hidden faults in the operation of business systems as early as possible, and to troubleshoot and repair the hidden faults early, so as to ensure the stable operation of business systems and effectively reduce or avoid the impact of business processing and economic losses caused by business system failures.

[0003] At present, alarm prediction can usually be performed based on the operation data of the business system. Then, the operation status of the business system is determined based on the alarm prediction results. Specifically, in the relevant technology, cluster analysis can be performed on the operation and maintenance data, and the regular information of equipment or service alarms can be extracted based on rule reasoning methods, artificial intelligence methods, causal graph methods, etc., and the alarm information can be predicted using a similarity measurement method.

[0004] However, the stability and accuracy of alarm prediction in related technologies are low. Moreover, usually only a single type of alarm indicator can be predicted, and the overall operation of the business system cannot be predicted, resulting in an inability to accurately predict the operation of the business system. Summary of the invention

[0005] The technical problem to be solved by this application is the problem that the operation status of the business system cannot be accurately predicted.

[0006] In order to solve the above technical problems, this application provides a business system operation status prediction method and system based on AI technology, which specifically adopts the following technical solutions:

[0007] In the first aspect, the present application provides a method for predicting the operation of a business system based on AI technology, including: first, obtaining monitoring indicator collection data of a target business system, the monitoring indicator collection data is used to characterize the performance, status and operation of components in the target business system. Then, according to the monitoring indicator collection data and the preset alarm rules, the initial indicator alarm data is determined. The initial indicator alarm data is preprocessed to obtain the preprocessed initial indicator alarm data. Secondly, based on the preprocessed initial indicator alarm data, alarm convergence and alarm root cause analysis and positioning are performed to determine the alarm history data. Among them, the alarm history data includes: alarm information and alarm root cause information corresponding to the alarm information, and the alarm root cause information is used to characterize the root cause of the alarm information. Next, according to the alarm history data, the alarm quantity prediction model is determined by the time series algorithm, and the alarm quantity prediction model is used to predict the number of alarms within the first preset time window. Further, according to the alarm history data, the trained indicator alarm prediction model is determined by the sample feature vector training method, and the indicator alarm prediction model is used to predict the indicator alarm information within the second preset time window. Finally, based on the alarm quantity prediction model and the trained indicator alarm prediction model, the operation prediction result of the business system to be analyzed within the third preset time window is predicted.

[0008] The method first obtains the monitoring indicator collection data of the target business system. Then, the alarm history data is determined based on the monitoring indicator collection data. Next, the alarm history data is clustered and analyzed by the time series algorithm and the sample feature vector training method, so as to obtain the alarm quantity prediction model and the indicator alarm prediction model corresponding to various indicators of the business system. Further, according to the alarm quantity prediction model and the indicator alarm prediction model, the predicted alarm quantity and predicted alarm information of various monitoring indicators of the business system to be analyzed under the preset time window can be obtained. Finally, according to the predicted alarm quantity and the predicted alarm information, the operation prediction result of the business system to be analyzed can be determined to predict the overall operation of the business system in the future. In this way, the method can not only predict the indicator alarm situation of the business system, but also predict the overall operation of the business system. By combining the alarm quantity prediction model and the indicator alarm prediction model, the accuracy of the alarm prediction can be improved, and then the accuracy of the predicted business system operation can be effectively improved.

[0009] In combination with the first aspect, in an optional implementation method, the above-mentioned prediction of the operation prediction result of the business system to be analyzed within the third preset time window based on the alarm quantity prediction model and the trained indicator alarm prediction model includes: first, according to the preset business system-key indicator relationship, determine the key indicators corresponding to the business system to be analyzed. Then, obtain the key indicator collection data corresponding to the key indicators in the business system to be analyzed. Next, based on the key indicator collection data, determine the predicted alarm quantity within the third preset time window through the alarm quantity prediction model, and determine the predicted alarm information within the third preset time window through the trained indicator alarm prediction model. Finally, determine the operation prediction result of the business system to be analyzed based on the predicted alarm quantity, the predicted alarm information and the preset alarm threshold.

[0010] In combination with the first aspect, in an optional implementation method, the above-mentioned alarm history data also includes: monitoring indicators corresponding to the alarm information. Then, based on the alarm history data, an alarm quantity prediction model is determined by a time series algorithm, including: first, the alarm history data is classified according to the type of monitoring indicators to obtain the alarm history data after the first classification. Then, based on the alarm history data after the first classification, the number of alarms for each type of monitoring indicators in the first classification within the fourth preset time window is determined. Finally, based on the number of alarms for each type of monitoring indicators in the first classification, an alarm quantity prediction model is constructed by a time series algorithm.

[0011] In combination with the first aspect, in an optional implementation, the above-mentioned alarm quantity prediction model is constructed through a time series algorithm based on the alarm quantity of each type of monitoring indicators in the first category, including: first, verifying the stationarity of the distribution sequence of the alarm quantity of each type of monitoring indicators in the first category over time. Then, when the stationarity of the distribution sequence of the alarm quantity of each type of monitoring indicators in the first category over time meets the stationarity threshold, model training is performed according to the alarm quantity of each type of monitoring indicators in the first category to determine the alarm quantity prediction model.

[0012] In combination with the first aspect, in an optional implementation method, the above-mentioned alarm quantity prediction model is constructed through a time series algorithm based on the alarm quantity of each type of monitoring indicators in the first category, and also includes: when the stationarity of the distribution sequence of the alarm quantity of each type of monitoring indicators in the first category over time does not meet the stationarity threshold, the distribution sequence of the alarm quantity over time that does not meet the stationarity threshold is processed by a differential algorithm, so that the stationarity of the distribution sequence of the alarm quantity of each type of monitoring indicators in the first category over time meets the stationarity threshold.

[0013] In combination with the first aspect, in an optional implementation method, the above-mentioned alarm history data also includes: monitoring indicators and business system identification information corresponding to the alarm information. Then, based on the alarm history data, a trained indicator alarm prediction model is determined by a sample feature vector training method, including: first, classifying the alarm history data according to the type of business system identification information and monitoring indicators to obtain the alarm history data after the second classification. Then, data sampling and time series feature extraction are performed on the alarm history data after the second classification to determine the set of sample feature vectors corresponding to each classification in the second classification. Finally, based on the set of sample feature vectors corresponding to each classification in the second classification, the indicator alarm prediction model is trained by a classification algorithm to obtain a trained indicator alarm prediction model.

[0014] In combination with the first aspect, in an optional implementation, the method for verifying the stationarity of the distribution sequence of the number of alarms of each type of monitoring indicator in the first category over time is: a time series diagram method.

[0015] In combination with the first aspect, in an optional implementation method, the above-mentioned alarm convergence and alarm root cause analysis and positioning are performed based on the preprocessed initial indicator alarm data, and the alarm historical data is determined, including: alarm convergence and alarm root cause analysis and positioning are performed through a root alarm model to determine the alarm historical data.

[0016] In combination with the first aspect, in an optional implementation method, the types of the above-mentioned monitoring indicators include: inspection monitoring class, batch job monitoring class, business processing monitoring class, log monitoring class, database monitoring class, input and output IO monitoring class, file directory class, and component monitoring class.

[0017] In the second aspect, the present application provides a business system operation prediction system based on AI technology, the system includes: a data acquisition module, an alarm module, a time series algorithm alarm prediction module, a sample feature vector alarm prediction module and a system operation prediction module. Among them, the data acquisition module is used to obtain the monitoring indicator collection data of the target business system, and the monitoring indicator collection data is used to characterize the performance, status and operation of the components in the target business system. The alarm module is used to determine the initial indicator alarm data according to the monitoring indicator collection data and the preset alarm rules. The alarm module is also used to perform data preprocessing on the initial indicator alarm data to obtain the preprocessed initial indicator alarm data. The alarm module is also used to perform alarm convergence and alarm root cause analysis and positioning based on the preprocessed initial indicator alarm data, and determine the alarm history data, and the alarm history data includes: alarm information and alarm root cause information corresponding to the alarm information, and the alarm root cause information is used to characterize the root cause of the alarm information. The time series algorithm alarm prediction module is used to determine the alarm quantity prediction model through the time series algorithm according to the alarm history data, and the alarm quantity prediction model is used to predict the number of alarms within the first preset time window. The sample feature vector alarm prediction module is used to determine the trained indicator alarm prediction model through the sample feature vector training method based on the alarm history data. The indicator alarm prediction model is used to predict the indicator alarm information within the second preset time window. The system operation prediction module is used to predict the operation prediction results of the business system to be analyzed within the third preset time window based on the alarm quantity prediction model and the trained indicator alarm prediction model.

[0018] According to a third aspect, an electronic device is provided, comprising: a memory and one or more processors; the memory is coupled to the processor; wherein computer program code is stored in the memory, and the computer program code comprises computer instructions, and when the computer instructions are executed by the processor, the electronic device executes the method according to the first aspect and any one of the optional methods thereof.

[0019] According to a fourth aspect, a computer-readable storage medium is provided, comprising computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the method according to the first aspect and any optional method thereof.

[0020] It can be understood that the beneficial effects that can be achieved by the business system operation status prediction system based on AI technology provided by the second aspect, the electronic device of the third aspect, and the computer-readable storage medium of the fourth aspect can refer to the beneficial effects in the first aspect and any possible design method thereof, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of a method for predicting the operation status of a business system based on AI technology provided in an embodiment of the present application;

[0022] Figure 2 A schematic diagram of a method flow chart for determining an alarm quantity prediction model by a time series algorithm provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of a method flow for determining an operation prediction result provided in an embodiment of the present application;

[0024] Figure 4 A schematic diagram of the structure of a business system operation status prediction system based on AI technology provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following embodiments do not represent all implementations consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application as detailed in the claims.

[0026] With the rapid development of computer technology, business systems used to implement various business scenarios are increasingly widely used. Business systems will face various complex situations in the actual operation process. In order to ensure the normal operation of business systems, it is necessary to predict the operation of business systems. In order to find out the hidden faults in the operation of business systems as early as possible, and to troubleshoot and repair the hidden faults early, so as to ensure the stable operation of business systems and effectively reduce or avoid the impact of business processing and economic losses caused by business system failures.

[0027] At present, alarm prediction can usually be performed based on the operation data of the business system. Then, the operation status of the business system is determined based on the alarm prediction results. Specifically, in the relevant technology, cluster analysis can be performed on the operation and maintenance data, and the regular information of equipment or service alarms can be extracted based on rule reasoning methods, artificial intelligence methods, causal graph methods, etc., and the alarm information can be predicted using a similarity measurement method.

[0028] However, the rule-based reasoning methods in related technologies require complex calculations and reasoning to ultimately determine the rules for the appearance of alarm information, which is difficult to implement, and has poor stability and accuracy when affected by external factors. Artificial intelligence methods are difficult to complete the collection of associated alarm information data sets and the determination of the characteristics of alarm information data. Due to data imbalance, the model will be overfitted, and the alarm prediction effect will not be good in the end. Moreover, related technologies can usually only predict a single type of alarm indicator, and cannot predict the overall operation of the business system, which makes it impossible to accurately predict the operation of the business system.

[0029] In order to solve the above problems, the embodiment of the present application provides a method and system for predicting the operation status of a business system based on AI technology. The method can use AI technology in combination with the business system to sort out monitoring alarm indicators, and then obtain the alarm information of various monitoring indicators distributed over time in a preset time window. The historical alarm data is clustered and analyzed by a time series algorithm and a sample feature vector training method, thereby obtaining an alarm quantity prediction model and an indicator alarm prediction model corresponding to various indicators of the business system. Furthermore, according to the alarm quantity prediction model and the indicator alarm prediction model, the alarm prediction data of various monitoring indicators of the business system to be analyzed in a preset time window after the current prediction time can be obtained. Finally, the overall operation of the business system in the future can be predicted based on the alarm prediction data. In this way, the accuracy of predicting the operation of the business system can be effectively improved.

[0030] The solution provided by the embodiment of the present application is introduced below in conjunction with the accompanying drawings.

[0031] For details, see Figure 1 , which is a flow chart of a method for predicting the operation status of a business system based on AI technology provided in an embodiment of the present application, such as Figure 1 As shown, the business system operation status prediction method based on AI technology provided in the embodiment of the present application includes the following steps S101-S107:

[0032] S101. Acquire monitoring indicator collection data of a target business system.

[0033] Specifically, the target business system may include one or more business systems, and the target business system may include at least the same business system as the business system to be analyzed. Exemplarily, the business system may be a recharge billing system, a telecommunication operation management system, and the like.

[0034] The monitoring indicator collection data is used to characterize the performance, status and operation of the components in the target business system. The monitoring indicator collection data corresponds to the monitoring indicators of the target business system, and the monitoring indicators can be preset according to the needs of the target business system and actual applications. Exemplarily, the monitoring indicator collection data may include: host data, database data, component data, call log data, service operation log and other data.

[0035] S102. Determine initial indicator alarm data based on monitoring indicator collection data and preset alarm rules.

[0036] Then, when the monitoring indicator collection data meets the corresponding preset alarm rules, the initial indicator alarm data corresponding to the monitoring indicator can be determined. Among them, the preset alarm rules can be preset according to different monitoring indicators and application requirements. For example, taking the monitoring indicator as the business handling success rate as an example, the preset alarm rule corresponding to the business handling success rate can be: determine an alarm when the business handling success rate is lower than 80%, that is, as the initial indicator alarm data.

[0037] S103: Perform data preprocessing on the initial indicator alarm data to obtain preprocessed initial indicator alarm data.

[0038] Further, data preprocessing is performed based on the initial indicator alarm data determined in S102, and the data preprocessing includes, but is not limited to: data format conversion, data normalization, data deduplication, data silencing, etc., to obtain preprocessed initial indicator alarm data. In this way, the accuracy of constructing the alarm quantity prediction model and training the indicator alarm prediction model can be improved, thereby improving the accuracy of predicting the operation of the business system.

[0039] S104: Based on the pre-processed initial indicator alarm data, perform alarm convergence and alarm root cause analysis and location, and determine alarm historical data.

[0040] In an embodiment of the present application, the alarm history data includes: alarm information and alarm root cause information corresponding to the alarm information. The alarm information may include: monitoring indicators of the alarm, alarm level, alarm generation time, alarm type, fault occurrence time, location information, alarm processing unit and other information. The alarm root cause information can be used to characterize the root cause of the alarm information.

[0041] In one implementation, the alarm information and alarm root cause information in the alarm history data are arranged in chronological order, so as to facilitate the processing of the alarm history data in subsequent steps.

[0042] In some embodiments, based on the preprocessed initial indicator alarm data, alarm convergence and alarm root cause analysis and positioning are performed to determine alarm historical data, including: alarm convergence and alarm root cause analysis and positioning are performed through a root cause alarm model to determine alarm historical data.

[0043] In one implementation, based on the pre-processed initial indicator alarm data, a corresponding processing solution can be generated after the alarm root cause analysis and location, and saved in the alarm knowledge base of the business system to facilitate rapid processing of the alarm information according to the processing solution.

[0044] S105. Determine an alarm quantity prediction model based on alarm history data using a time series algorithm.

[0045] In an embodiment of the present application, an alarm quantity prediction model can be constructed by a time series algorithm based on the alarm history data determined in S104. Among them, the alarm quantity prediction model can be used to predict the number of alarms within a first preset time window. The first preset time window can be preset according to actual application requirements. For example, the first preset time window can be 12 hours, one day, or one week. The present application does not specifically limit the specific time period of the first preset time window.

[0046] Specifically, the time series algorithm can predict the number of alarms in a certain period of time in the future based on the number of alarms in the continuous alarm history data over a period of time. The advantage of the time series algorithm is that it can predict the future data change trend based only on the original data set used to create the alarm quantity prediction model. New data can also be added to the alarm quantity prediction model during the prediction process, and then the new data will be automatically included in the trend analysis range. Therefore, the alarm quantity prediction model can be established when the business system is just included in the monitoring alarm system, and the alarm quantity prediction model can be continuously revised and improved as the subsequent alarm history data accumulates, thereby improving the accuracy of the alarm quantity prediction.

[0047] In some embodiments, the above-mentioned alarm history data also includes: monitoring indicators corresponding to the alarm information. Figure 2 A flow chart of a method for determining an alarm quantity prediction model by a time series algorithm provided in an embodiment of the present application, such as Figure 2 As shown, S105, according to the alarm history data, determining the alarm quantity prediction model through the time series algorithm, can specifically include the following steps S1051-S1053:

[0048] S1051. Classify the alarm history data according to the type of monitoring indicators to obtain the alarm history data after the first classification.

[0049] Specifically, the type of monitoring indicator can be determined according to the operating architecture of the target business system and the main business characteristics carried, and the alarm history data can be classified according to the type of monitoring indicator. In this way, it is convenient to more accurately build an alarm quantity prediction model based on the alarm history data after the first classification, so that the alarm quantity prediction model learns the characteristics of each type of alarm history data, thereby improving the accuracy of predicting the number of alarms.

[0050] In some embodiments, the types of monitoring indicators may include: inspection monitoring, batch job monitoring, business processing monitoring, log monitoring, database monitoring, input and output IO monitoring, file directory, and component monitoring.

[0051] For example, the specific monitoring indicators of business processing monitoring can include: order in-transit rate, business processing success rate, capability call success rate, service response time and other alarm information. The specific monitoring indicators of batch job monitoring can include: job execution time, execution throughput, execution efficiency and other alarm information. In this way, the classification of the above monitoring indicators can more accurately and efficiently analyze and monitor the operation of each node and component of the target business system.

[0052] S1052: Based on the alarm history data after the first classification, determine the number of alarms for each type of monitoring indicator in the first classification within a fourth preset time window.

[0053] Then, based on the alarm history data after the first classification and the fourth preset time window, the number of alarms for each type of monitoring indicator in the first classification within the fourth preset time window is counted and determined. In this way, the accuracy of the prediction result of the distribution characteristics of the number of alarms over time can be improved.

[0054] Among them, the fourth preset time window can be preset according to actual application requirements. For example, the fourth preset time window can be one day, three days or seven days, etc. This application does not specifically limit the specific time period of the first preset time window.

[0055] S1053. Based on the alarm quantity of each type of monitoring indicator in the first category, an alarm quantity prediction model is constructed through a time series algorithm.

[0056] Finally, by processing the number of alarms based on each type of monitoring indicators in the first category and the distribution data of the number of alarms over time through a time series algorithm, a prediction model for the number of alarms corresponding to different types of monitoring indicators of the target business system can be obtained.

[0057] In some embodiments, in order to further improve the accuracy of building the alarm quantity prediction model, the stability of the data can also be verified. Then S1053, based on the alarm quantity of each type of monitoring indicator in the first category, building the alarm quantity prediction model through the time series algorithm can specifically include the following steps S10531-S10532:

[0058] S10531. Verify the stability of the distribution sequence of the number of alarms for each type of monitoring indicator in the first category over time.

[0059] Specifically, the distribution sequence of the number of alarms of each type of monitoring indicator in the first category over time is in a stable state, which can effectively improve the stability and accuracy of the prediction model of the number of alarms. Therefore, the stability of the distribution sequence of the number of alarms of each type of monitoring indicator in the first category over time can be verified by the stability test method.

[0060] In some embodiments, a time series diagram method may be used to verify the stationarity of the distribution sequence of the number of alarms of each type of monitoring indicator in the first category over time.

[0061] Specifically, the time series method determines whether a sequence is stationary by detecting the trend and volatility of the data time series. For a stationary sequence, its mean and variance are constants, which is reflected in the time series graph as the sequence value always fluctuates randomly around a constant, with a bounded fluctuation range and no obvious trend or periodicity.

[0062] S10532. When the stationarity of the distribution sequence of the number of alarms of each type of monitoring indicator in the first category over time meets the stationarity threshold, model training is performed according to the number of alarms of each type of monitoring indicator in the first category to determine an alarm number prediction model.

[0063] Specifically, the alarm quantity data of each type of monitoring indicators in the stable first classification can be used as the input data of the prediction model. Then, the distribution data of the number of alarm indicators over time is processed using a time series algorithm to construct an alarm quantity prediction model. Furthermore, the model algorithm and model parameters of the alarm quantity prediction model are adjusted to ensure that the error between the prediction result of the alarm quantity prediction model and the actual number of alarms is within the allowable error range. In this way, the number of alarms predicted by the alarm quantity prediction model is closer to reality. Among them, the above-mentioned allowable error range can be set, for example, to a mean absolute error of 1.3, a root mean square error of 1.4, etc.

[0064] Among them, the above-mentioned stability threshold can be preset according to the method of stability detection and the stability evaluation index. Taking the time series diagram method as an example, the stability evaluation index can be the mean and variance. Then the stability threshold may include: a mean threshold and a variance threshold. The specific data of the mean threshold and the variance threshold can be preset based on prior knowledge and historical data, and this application does not make specific limitations on this.

[0065] In some embodiments, when the stability of the distribution sequence of the number of alarms of each type of monitoring indicator in the first category over time does not meet the stability threshold, data processing is still required to meet the stability requirement. Then S1053 also includes:

[0066] S10533. When the stationarity of the distribution sequence of the number of alarms over time for each type of monitoring indicator in the first category does not meet the stationarity threshold, data processing is performed on the distribution sequence of the number of alarms over time that does not meet the stationarity threshold by using a differential algorithm, so that the stationarity of the distribution sequence of the number of alarms over time for each type of monitoring indicator in the first category meets the stationarity threshold.

[0067] In this way, the differential algorithm can be used to perform differential processing on the data in the distribution sequence of the number of alarms over time that does not meet the stationarity threshold, so as to stabilize the data, thereby making the stationarity of the distribution sequence of the number of alarms over time for each type of monitoring indicator in the first category meet the stationarity threshold.

[0068] S106. Determine a trained indicator alarm prediction model through a sample feature vector training method based on the alarm history data.

[0069] In an embodiment of the present application, the indicator alarm prediction model can be trained by a sample feature vector training method according to the alarm history data determined in S104 to obtain a trained indicator alarm prediction model. Among them, the indicator alarm prediction model is used to predict the indicator alarm information within the second preset time window. The second preset time window may be the same as the first preset time window, and the second preset time window may also be different from the first preset time window. Specifically, the second preset time window can be preset according to actual application requirements. For example, the second preset time window can be 12 hours, one day, or one week, etc., and the present application does not specifically limit the specific time period of the second preset time window.

[0070] In some embodiments, first, the alarm history data can be preprocessed and the data set can be divided to obtain a set of sample feature vectors of the monitoring indicators. Then, the sample feature vector set is used to train the integrated learning model to obtain a trained indicator alarm prediction model. The trained prediction model is used to perform real-time predictions to predict alarm information. If the prediction result error is higher than the set threshold, the indicator alarm prediction model can be updated using incremental learning to obtain an updated indicator alarm prediction model. In this way, the accuracy of alarm prediction can be improved, thereby improving the accuracy of predicting the operation of the business system.

[0071] Specifically, in some embodiments, the alarm history data also includes: monitoring indicators and business system identification information corresponding to the alarm information. Then S106, according to the alarm history data, determine the trained indicator alarm prediction model through the sample feature vector training method, which may specifically include the following steps S1061-S1063:

[0072] S1061. Classify the alarm history data according to the business system identification information and the type of monitoring indicators to obtain the alarm history data after the second classification.

[0073] First, the type of monitoring indicator can be determined according to the business system identification information corresponding to different business systems in the target business system, and according to the operating architecture of the target business system and the main business characteristics carried. The alarm history data is classified and processed according to the business system identification information and the type of monitoring indicator. In this way, it is convenient to more accurately train the indicator alarm prediction model according to the alarm history data after the second classification, so that the indicator alarm prediction model learns the characteristics of each type of alarm history data in the second classification, thereby improving the accuracy of the predicted alarm information.

[0074] S1062: Perform data sampling and time series feature extraction on the alarm history data after the second classification, and determine a set of sample feature vectors corresponding to each classification in the second classification.

[0075] Then, the feature vectors of each classification alarm historical data in the second category can be extracted through row data sampling and timing feature extraction methods, and the sample feature vector set corresponding to each classification in the second category can be obtained.

[0076] In one implementation method, the alarm history data can also be processed into multiple segmented alarm history data for a period of time. Then, data sampling and timing feature extraction are performed on each segmented alarm historical data, and a set of segmented sample feature vectors for each segmented alarm historical data are obtained. Finally, the set of each segmented sample feature vector is combined according to a time series to obtain the sample feature vector set.

[0077] S1063. According to the set of sample feature vectors corresponding to each category in the second category, the indicator alarm prediction model is trained by a classification algorithm to obtain a trained indicator alarm prediction model.

[0078] Finally, based on the set of sample feature vectors corresponding to each classification in the second classification determined by S1063, the index alarm prediction model is trained through the classification algorithm. Among them, the indicator alarm prediction model can be an integrated learning model.

[0079] Specifically, the set of sample feature vectors corresponding to each category in the second category can be input as an input parameter into the integrated learning model (i.e., the indicator alarm prediction model) to predict and classify the time series feature vectors in the sample feature vector set according to the classification algorithm to obtain the corresponding prediction classification results. Then, the loss function is calculated based on the business system identification information (e.g., business system code) and the type of monitoring indicator (e.g., indicator code attribute) corresponding to the prediction classification result and the time series feature vector, and the integrated learning model is trained to obtain a trained indicator alarm prediction model.

[0080] S107: Predict the operation result of the business system to be analyzed within a third preset time window according to the alarm quantity prediction model and the trained indicator alarm prediction model.

[0081] Finally, the monitoring metrics of the business system to be analyzed can be obtained. Based on the monitoring metrics of the business system to be analyzed, the predicted alarm quantity and predicted alarm information within a future time period (i.e., within the third preset time window) are predicted through the alarm quantity prediction model and the trained metric alarm prediction model. Further, the operation prediction result of the business system to be analyzed is determined according to the predicted alarm quantity and predicted alarm information. Among them, the operation prediction result may include: predicted alarm quantity, predicted alarm information, components that may have alarms, components for end-point inspection, alarm solutions, and system operation stability, etc.

[0082] In some embodiments, the method can obtain the collected data of the key metrics corresponding to the business system to be analyzed according to the corresponding relationship between the business system and the key metrics. Based on the collected data of the key metrics, the predicted alarm quantity and predicted alarm information are predicted through the alarm quantity prediction model and the trained metric alarm prediction model. Finally, it is determined whether the business system to be analyzed operates stably within the third preset time window and the possible alarm information according to the predicted alarm quantity and predicted alarm information.

[0083] Specifically, Figure 3 is a schematic flowchart of the method for determining the operation prediction result provided by the embodiment of the present application. As Figure 3 shown, S107. According to the alarm quantity prediction model and the trained metric alarm prediction model, predict the operation prediction result of the business system to be analyzed within the third preset time window, which may specifically include the following steps S1071 - S1074:

[0084] S1071. Determine the key metrics corresponding to the business system to be analyzed according to the preset business system - key metric relationship.

[0085] Among them, the preset business system - key metric relationship can be determined according to the influence degree of the monitoring metrics in the business system on the stable operation of the business system. If the monitoring metric in the business system has a great influence on the stable operation of the business system (i.e., meets the influence threshold), then this monitoring metric is a key metric.

[0086] S1072. Obtain the collected data of the key metrics corresponding to the key metrics in the business system to be analyzed.

[0087] S1073. According to the collected data of the key metrics, determine the predicted alarm quantity within the third preset time window through the alarm quantity prediction model, and determine the predicted alarm information within the third preset time window through the trained metric alarm prediction model.

[0088] S1074. Determine the operation prediction result of the business system to be analyzed according to the predicted alarm quantity, predicted alarm information, and preset alarm threshold.

[0089] The preset alarm threshold may include: an alarm quantity threshold and an alarm information threshold. The alarm quantity threshold may be, for example, 10, that is, when the predicted alarm quantity is less than 10, it can be determined that the operation stability of the business system to be analyzed is relatively high. The alarm information threshold may include, for example, a component with an alarm, that is, when the component with an alarm in the predicted alarm information is not included in the alarm information threshold, it can be determined that the operation stability of the business system to be analyzed is relatively high.

[0090] The method for predicting the operation of a business system based on AI technology provided by the above embodiment of the present application is adopted. The method first obtains the monitoring indicator collection data of the target business system. Then, the alarm history data is determined based on the monitoring indicator collection data. Next, the alarm history data is clustered and analyzed by the time series algorithm and the sample feature vector training method to obtain the alarm quantity prediction model and the indicator alarm prediction model corresponding to various indicators of the business system. Further, according to the alarm quantity prediction model and the indicator alarm prediction model, the predicted alarm quantity and predicted alarm information of various monitoring indicators of the business system to be analyzed under the preset time window can be obtained. Finally, according to the predicted alarm quantity and the predicted alarm information, the operation prediction result of the business system to be analyzed can be determined to predict the overall operation of the business system in the future. In this way, the method can not only predict the indicator alarm situation of the business system, but also predict the overall operation of the business system. By combining the alarm quantity prediction model and the indicator alarm prediction model, the accuracy of the alarm prediction can be improved, and then the accuracy of the predicted business system operation can be effectively improved.

[0091] The present application also provides a business system operation status prediction system based on AI technology, specifically, Figure 4 A schematic diagram of the structure of the business system operation status prediction system based on AI technology provided in the embodiment of the present application, such as Figure 4 As shown, the business system operation status prediction system 400 based on AI technology includes: a data acquisition module 410, an alarm module 420, a time series algorithm alarm prediction module 430, a sample feature vector alarm prediction module 440 and a system operation prediction module 450.

[0092] Among them, the data collection module 410 can collect various monitoring indicator data of the business system, collect the original monitoring indicator data and send it to the alarm module 420. The alarm module 420 can generate alarm information according to the threshold value set by the indicator, and perform the convergence of the corresponding alarm and the analysis and positioning of the alarm root cause, save the alarm information to the historical alarm table, and determine the alarm historical data. In addition, the alarm module 420 can also save the results of the alarm root cause analysis to the alarm knowledge base. The time series algorithm alarm prediction module 430 can generate an alarm quantity prediction model through a time series algorithm based on the accumulated historical alarm data to generate the alarm quantity prediction data of the business system indicator. The sample feature vector alarm prediction module 440 can use the sample feature vector set for training to generate an indicator alarm prediction model to perform indicator alarm prediction. The system operation prediction module 450 can generate the operation prediction results of the business system based on the corresponding relationship between the business system and the indicator and the indicator alarm prediction data.

[0093] Specifically, the data collection module 410 may be used to obtain monitoring indicator collection data of the target business system, and the monitoring indicator collection data is used to characterize the performance, status and operation status of components in the target business system.

[0094] The alarm module 420 can be used to collect data based on monitoring indicators and preset alarm rules to determine initial indicator alarm data. The alarm module 420 can also be used to preprocess the initial indicator alarm data to obtain preprocessed initial indicator alarm data. The alarm module 420 can also be used to perform alarm convergence and alarm root cause analysis and positioning based on the preprocessed initial indicator alarm data to determine alarm history data. Among them, the alarm history data includes: alarm information and alarm root cause information corresponding to the alarm information, and the alarm root cause information is used to characterize the root cause of the alarm information.

[0095] The time series algorithm alarm prediction module 430 can be used to determine an alarm quantity prediction model based on alarm history data through a time series algorithm, wherein the alarm quantity prediction model is used to predict the alarm quantity within a first preset time window.

[0096] The sample feature vector alarm prediction module 440 can be used to determine a trained indicator alarm prediction model through a sample feature vector training method according to the alarm history data. The indicator alarm prediction model is used to predict the indicator alarm information within the second preset time window.

[0097] The system operation prediction module 450 can be used to predict the operation prediction result of the business system to be analyzed within a third preset time window according to the alarm quantity prediction model and the trained indicator alarm prediction model.

[0098] The business system operation prediction system based on AI technology provided by the above-mentioned embodiment of the present application is adopted, and the system can obtain the monitoring index collection data of the target business system through the data collection module. Then, the alarm history data is determined according to the monitoring index collection data through the alarm module. Next, the alarm history data is clustered and analyzed by the time series algorithm alarm prediction module and the sample feature vector alarm prediction module using the time series algorithm and the sample feature vector training method, so as to obtain the alarm quantity prediction model and the indicator alarm prediction model corresponding to various indicators of the business system. Furthermore, the predicted alarm quantity and predicted alarm information of various monitoring indicators of the business system to be analyzed in the preset time window can be obtained through the system operation prediction module according to the alarm quantity prediction model and the indicator alarm prediction model. Finally, the operation prediction result of the business system to be analyzed can be determined according to the predicted alarm quantity and the predicted alarm information through the system operation prediction module to predict the overall operation of the business system in the future. In this way, the system can not only predict the indicator alarm conditions of the business system, but also predict the overall operation of the business system. By combining the alarm quantity prediction model with the indicator alarm prediction model, the accuracy of the alarm prediction can be improved, thereby effectively improving the accuracy of predicting the operation of the business system.

[0099] The embodiment of the present application also provides an electronic device, which may include: a display screen, a memory, and one or more processors. The display screen, the memory, and the processor are coupled. The memory is used to store computer program code, and the computer program code includes computer instructions. When the processor executes the computer instructions, the electronic device may execute the various methods or steps executed in the above-mentioned business system operation status prediction method embodiment based on AI technology. Of course, the electronic device includes but is not limited to the above-mentioned display screen, memory, and one or more processors.

[0100] An embodiment of the present application also provides a computer-readable storage medium for storing computer instructions for executing the above-mentioned business system operation status prediction method based on AI technology.

[0101] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0102] In the description of the present application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of the present application, "plurality" means at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0103] In this application, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0104] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0105] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the general concept of this application and do not constitute a limitation on the protection scope of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without creative work belong to the protection scope of this application.

Claims

1. A method for predicting the operation status of a business system based on AI technology, characterized in that: include: Acquire monitoring indicator collection data of the target business system, wherein the monitoring indicator collection data is used to characterize the performance, status and operation of components in the target business system; Determine initial indicator alarm data based on the monitoring indicator collection data and preset alarm rules; Performing data preprocessing on the initial indicator alarm data to obtain preprocessed initial indicator alarm data; Based on the pre-processed initial indicator alarm data, alarm convergence and alarm root cause analysis and positioning are performed to determine alarm history data, where the alarm history data includes: alarm information and alarm root cause information corresponding to the alarm information, where the alarm root cause information is used to characterize the root cause of the alarm information; Determine an alarm quantity prediction model based on the alarm history data by a time series algorithm, wherein the alarm quantity prediction model is used to predict the number of alarms within a first preset time window; Determining a trained indicator alarm prediction model through a sample feature vector training method according to the alarm history data, wherein the indicator alarm prediction model is used to predict indicator alarm information within a second preset time window; According to the alarm quantity prediction model and the trained indicator alarm prediction model, the operation prediction result of the business system to be analyzed within a third preset time window is predicted.

2. The method according to claim 1, characterized in that The predicting the operation prediction result of the business system to be analyzed within a third preset time window according to the alarm quantity prediction model and the trained indicator alarm prediction model includes: Determine the key indicators corresponding to the business system to be analyzed according to the preset business system-key indicator relationship; Acquire key indicator collection data corresponding to the key indicator in the business system to be analyzed; Collecting data according to the key indicators, determining the predicted alarm quantity within the third preset time window through the alarm quantity prediction model, and determining the predicted alarm information within the third preset time window through the trained indicator alarm prediction model; The operation prediction result of the business system to be analyzed is determined according to the predicted alarm quantity, the predicted alarm information and the preset alarm threshold.

3. The method according to claim 1, characterized in that: The alarm history data also includes: monitoring indicators corresponding to the alarm information; Determining the alarm quantity prediction model by a time series algorithm based on the alarm history data includes: Classifying the alarm history data according to the type of monitoring indicators to obtain the alarm history data after first classification; Based on the alarm history data after the first classification, determine the number of alarms for each type of monitoring indicators in the first classification within a fourth preset time window; Based on the alarm quantity of each type of monitoring indicators in the first category, the alarm quantity prediction model is constructed through a time series algorithm.

4. The method according to claim 3, characterized in that The step of constructing the alarm quantity prediction model based on the alarm quantity of each type of monitoring indicator in the first classification by using a time series algorithm includes: Verify the stability of the distribution sequence of the number of alarms for each type of monitoring indicators in the first category over time; When the stationarity of the distribution sequence of the alarm quantity of each type of monitoring indicator in the first category over time meets the stationarity threshold, model training is performed according to the alarm quantity of each type of monitoring indicator in the first category to determine the alarm quantity prediction model.

5. The method according to claim 4, characterized in that The method of constructing the alarm quantity prediction model based on the alarm quantity of each type of monitoring indicators in the first classification by using a time series algorithm also includes: When the stationarity of the distribution sequence of the number of alarms over time for each type of monitoring indicator in the first category does not meet the stationarity threshold, the distribution sequence of the number of alarms over time that does not meet the stationarity threshold is processed by a differential algorithm to make the stationarity of the distribution sequence of the number of alarms over time for each type of monitoring indicator in the first category meet the stationarity threshold.

6. The method according to claim 1, characterized in that The alarm history data also includes: monitoring indicators and business system identification information corresponding to the alarm information; Determining a trained indicator alarm prediction model by a sample feature vector training method based on the alarm history data includes: Classifying the alarm history data according to the business system identification information and the type of the monitoring indicator to obtain the alarm history data after second classification; Performing data sampling and time series feature extraction on the alarm history data after the second classification, and determining a set of sample feature vectors corresponding to each classification in the second classification; According to the set of sample feature vectors corresponding to each category in the second category, the indicator alarm prediction model is trained through a classification algorithm to obtain the trained indicator alarm prediction model.

7. The method according to claim 4, characterized in that The method for verifying the stationarity of the distribution sequence of the number of alarms of each type of monitoring indicator in the first classification over time is: a time series diagram method.

8. The method according to claim 1, characterized in that The step of performing alarm convergence and alarm root cause analysis and location based on the preprocessed initial indicator alarm data to determine alarm history data includes: The alarm convergence and alarm root cause analysis and location are performed through the root alarm model to determine the alarm history data.

9. The method according to claim 3, characterized in that: The types of monitoring indicators include: inspection monitoring, batch job monitoring, business processing monitoring, log monitoring, database monitoring, input and output IO monitoring, file directory, and component monitoring.

10. A business system operation status prediction system based on AI technology, characterized in that: The system comprises: a data acquisition module, an alarm module, a time series algorithm alarm prediction module, a sample feature vector alarm prediction module and a system operation prediction module; The data acquisition module is used to acquire monitoring indicator acquisition data of the target business system, and the monitoring indicator acquisition data is used to characterize the performance, status and operation of the components in the target business system; The alarm module is used to collect data from the monitoring indicators and preset alarm rules to determine initial indicator alarm data; The alarm module is further used to perform data preprocessing on the initial indicator alarm data to obtain preprocessed initial indicator alarm data; The alarm module is further used to perform alarm convergence and alarm root cause analysis and positioning based on the preprocessed initial indicator alarm data, and determine alarm history data, wherein the alarm history data includes: alarm information and alarm root cause information corresponding to the alarm information, and the alarm root cause information is used to characterize the root cause of the alarm information; The time series algorithm alarm prediction module is used to determine an alarm quantity prediction model through a time series algorithm according to the alarm history data, and the alarm quantity prediction model is used to predict the number of alarms within a first preset time window; The sample feature vector alarm prediction module is used to determine a trained indicator alarm prediction model through a sample feature vector training method according to the alarm history data, and the indicator alarm prediction model is used to predict the indicator alarm information within a second preset time window; The system operation prediction module is used to predict the operation prediction result of the business system to be analyzed within a third preset time window based on the alarm quantity prediction model and the trained indicator alarm prediction model.

Images