Business system analysis method and device, electronic equipment and storage medium

Abstract

The invention discloses an analysis method and device of a service system, electronic equipment and a storage medium, and belongs to the technical field of fault localization, in the method, a plurality of index value sequences of a plurality of monitoring objects corresponding to the service system are acquired, the plurality of index value sequences are used for representing operation change conditions of the service system from before fault injection to after fault injection, and grouping the plurality of index value sequences according to the correlation, performing Granger causal analysis on the target sequence pairs with the correlation higher than a preset value in the same group, and determining the causal relationship among the index value sequences in the group according to the causal analysis result of each target sequence pair, the causal relationship being used for analyzing the hidden danger of the business system. Therefore, the plurality of index value sequences are firstly grouped, then the target sequence pairs are subjected to Granger causal analysis group by group, and then the causal relationship corresponding to each group is determined, so that the causal relationship among the index value sequences can be effectively and accurately analyzed, and the accuracy of hidden danger analysis of the business system is further improved.

Description

Technical Field

[0001] This application relates to the technical field of fault location, and in particular, to an analysis method, device, electronic device, and storage medium for a service system. Background Art

[0002] In modern service systems such as distributed systems and cloud computing systems, the complexity and scale of the system are increasing day by day, the functions of the system are becoming increasingly rich, and it is becoming more and more difficult to analyze the potential hazards of the service system.

[0003] As a new method for analyzing potential hazards of service systems, chaos engineering tests the robustness and recovery ability of service systems by introducing faults. Although chaos engineering can effectively reveal the potential hazards of service systems, it is still a very complex problem to effectively analyze the causal relationships between various manifestations of service systems after the introduction of faults. Summary of the Invention

[0004] Embodiments of this application provide an analysis method, device, electronic device, and storage medium for a service system, so as to provide a solution for effectively analyzing the causal relationships between various manifestations of a service system after the introduction of faults.

[0005] In a first aspect, embodiments of this application provide an analysis method for a service system, including:

[0006] Obtain multiple index value sequences of multiple monitoring objects corresponding to the service system, where the multiple index value sequences are used to characterize the operation change of the service system from before fault injection to after fault injection;

[0007] Group the multiple index value sequences according to the correlation;

[0008] Perform Granger causality analysis on target sequence pairs in the same group, where the correlation between the two index value sequences included in the target sequence pair is higher than a preset value;

[0009] Determine the causal relationship between the index value sequences in the group according to the causal analysis results of each target sequence pair, where the causal relationship is used to analyze the potential hazards of the service system.

[0010] In some embodiments, grouping the multiple index value sequences according to the correlation includes:

[0011] Group the multiple index value sequences according to the correlation in the time space; or

[0012] Group the multiple index value sequences according to the correlation in the phase space; or

[0013] Perform correlation grouping on the multiple index value sequences in time and space, and perform correlation grouping on the index value sequences in the same group in phase space to obtain subgroups of the group.

[0014] In some embodiments, correlation grouping is performed in phase space according to the following steps:

[0015] Perform correlation grouping on the candidate index value sequences in a preset curve dimension according to the curves of each monitored object corresponding to the candidate index value sequences in phase space, where the candidate index value sequences are the multiple index value sequences or the index value sequences in the same group, the curve of each monitored object in phase space is generated according to multiple index value sequences of the monitored object, the preset curve dimension includes fractal dimension and / or separation degree, the fractal dimension is used to characterize the complexity of the curve, and the separation degree is used to characterize the bifurcation degree of the curve.

[0016] In some embodiments, Granger causality analysis is performed on the target sequence pair according to the following steps:

[0017] Taking each index value sequence in the target sequence pair as the result sequence, obtain the prediction effect information of the first regression model for the subsequence of the result sequence after fault injection, and obtain the prediction effect information of the second regression model for the subsequence. The first regression model is trained according to the subsequence of the result sequence before fault injection, and the first regression model is used to iteratively predict the subsequence of the result sequence after fault injection based on the subsequence of the result sequence before fault injection to obtain the subsequence of the result sequence after fault injection. The second regression model is trained according to the subsequences of the two index value sequences in the target sequence pair before fault injection, and the second regression model is used to iteratively predict the subsequence of the result sequence after fault injection based on the cause sequence and the subsequence of the result sequence before fault injection to obtain the subsequence of the result sequence after fault injection. The cause sequence refers to the sequence other than the result sequence in the target sequence pair;

[0018] Determine the causality analysis result of the target sequence pair according to the prediction effect information corresponding to the first regression model and the prediction effect information corresponding to the second regression model.

[0019] In some embodiments, according to the causality analysis results of each target sequence pair, determine the causal relationship between the index value sequences in the group, including:

[0020] Generate an undirected graph according to the rule that the index value sequences in the group correspond to the vertices of the undirected graph and each target sequence pair corresponds to the edge of the undirected graph;

[0021] If the causal analysis result of any of the target sequence pairs indicates that there is a causal relationship between the index value sequences in the target sequence pair, then add a direction to the corresponding edge in the undirected graph to obtain a directed graph, and the directed graph is used to indicate the causal relationship between the index value sequences in the group.

[0022] In some embodiments, when the causal analysis result of any of the target sequence pairs further includes causal relationship strength information, add attribute information representing the causal relationship strength information to the corresponding edge in the undirected graph.

[0023] In a second aspect, an analysis device for a service system provided by an embodiment of the present application includes:

[0024] An acquisition module, configured to acquire multiple index value sequences of multiple monitoring objects corresponding to the service system, and the multiple index value sequences are used to characterize the operation change situation of the service system from before fault injection to after fault injection;

[0025] A grouping module, configured to group the multiple index value sequences according to relevance;

[0026] A causal analysis module, configured to perform Granger causal analysis on target sequence pairs in the same group, where the correlation between the two index value sequences included in the target sequence pair is higher than a preset value;

[0027] A determination module, configured to determine the causal relationship between the index value sequences in the group according to the causal analysis results of the target sequence pairs, and the causal relationship is used to analyze potential problems of the service system.

[0028] In a third aspect, an electronic device provided by an embodiment of the present application includes: at least one processor, and a memory communicatively connected to the at least one processor, where:

[0029] The memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor can execute any of the above service system analysis methods.

[0030] In a fourth aspect, an embodiment of the present application provides a storage medium, and when the computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute any of the above service system analysis methods.

[0031] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements any of the above service system analysis methods.

[0032] In an embodiment of the present application, multiple metric value sequences of multiple monitoring objects corresponding to a service system are obtained. The multiple metric value sequences are used to characterize the operation change of the service system from before fault injection to after fault injection. The multiple metric value sequences are grouped according to the correlation, and Granger causality analysis is performed on target sequence pairs in the same group. The correlation between the two metric value sequences included in the target sequence pair is higher than a preset value. According to the causality analysis results of each target sequence pair, the causality between the metric value sequences in the group is determined. The causality is used to analyze the potential hazards of the service system. In this way, the multiple metric value sequences are grouped first, and then Granger causality analysis is performed on the target sequence pairs in each group one by one, and then the corresponding causality for each group is determined, which can effectively and accurately analyze the causality between the metric value sequences, and further improve the accuracy of the potential hazard analysis of the service system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments and descriptions thereof of the present application are used to explain the present application and do not constitute an improper limitation to the present application. In the drawings:

[0034] Figure 1 is a flowchart of an analysis method for a service system provided by an embodiment of the present application;

[0035] Figure 2 is a schematic diagram of grouping of metric value sequences provided by an embodiment of the present application;

[0036] Figure 3 is an undirected graph provided by an embodiment of the present application;

[0037] Figure 4 is a directed graph provided by an embodiment of the present application;

[0038] Figure 5 is a flowchart of another analysis method for a service system provided by an embodiment of the present application;

[0039] Figure 6 is a schematic diagram of multiple subgroups of Group 1 provided by an embodiment of the present application;

[0040] Figure 7 is another directed graph provided by an embodiment of the present application;

[0041] Figure 8 is a schematic diagram of a metric value sequence of a monitoring object provided by an embodiment of the present application;

[0042] Figure 9 is a schematic diagram of a curve of a monitoring object in a phase space provided by an embodiment of the present application;

[0043] Figure 10aSchematic diagram of the prediction effect of a first regression model provided by an embodiment of the present application;

[0044] Figure 10b Schematic diagram of the prediction effect of a second regression model provided by an embodiment of the present application;

[0045] Figure 11 Schematic diagram of the process of generating a directed graph provided by an embodiment of the present application;

[0046] Figure 12 Schematic diagram of the comparison of the index value sequences of multiple monitoring objects provided by an embodiment of the present application;

[0047] Figure 13 Schematic diagram of the structure of an analysis device for a business system provided by an embodiment of the present application;

[0048] Figure 14 Schematic diagram of the hardware structure of an electronic device for implementing an analysis method of a business system provided by an embodiment of the present application. Detailed implementation manners

[0049] In order to provide a solution for effectively analyzing the causal relationship between various manifestations of a business system after a fault is introduced, an embodiment of the present application provides an analysis method, device, electronic device and storage medium for a business system.

[0050] In the embodiments of the present application, "multiple" may refer to two or more. In view of this, in the embodiments of the present application, "multiple" may also be understood as "at least two". "At least one" can be understood as one or more, for example, understood as one, two or more. For example, "including at least one" means including one, two or more. For example, including at least one of A, B, and C, then what can be included is A, B, C, A and B, A and C, B and C, or A, B, and C. "And / or" describes the association relationship between associated objects. Specifically, there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / ", unless otherwise specified, generally represents an "or" relationship between the front and back associated objects.

[0051] The ordinal numbers such as "first" and "second" mentioned in the embodiments of the present application are usually used to distinguish different objects, and are not used to limit the order, time sequence, priority or importance degree of multiple objects, etc. For example, the first node and the second node involved in the embodiments of the present application are used to distinguish different nodes, and are not used to limit the order, time sequence, priority or importance degree of these two nodes, etc.

[0052] The preferred embodiments of the present application will be described below in conjunction with the accompanying drawings of the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. And without conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0053] See Figure 1 , Figure 1 which is a flowchart of an analysis method for a service system provided by an embodiment of the present application, including the following steps.

[0054] In step 101, multiple metric value sequences of multiple monitoring objects corresponding to the service system are obtained, and the multiple metric value sequences are used to characterize the running change situation of the service system from before fault injection to after fault injection.

[0055] Among them, the service system is such as a distributed service system, a cloud computing service system, etc. The multiple monitoring objects may include multiple service monitoring objects and multiple system monitoring objects. The multiple service monitoring objects are used to characterize the service processing situation of the service system and can be determined according to the service of the service system, while the multiple system monitoring objects are used to characterize the software and hardware running situation of the service system such as network delay, memory occupancy rate, etc. The multiple metric value sequences are such as the number of transactions per second (TPS) sequence, the delay value sequence, the memory occupancy rate sequence, etc. One metric value sequence of each monitoring object is used to describe the change of the metric of the monitoring object over time.

[0056] It should be noted that the fault injection time is within the acquisition time period of these metric value sequences, so each metric value sequence of each monitoring object obtained contains data before and after fault injection. Therefore, the multiple metric value sequences can characterize the running change situation of the service system from before fault injection to after fault injection.

[0057] In step 102, the multiple metric value sequences are grouped according to the correlation.

[0058] In specific implementation, a certain type of metric value sequences of all monitoring objects can be grouped, and after grouping, each group contains this type of metric value sequences; it is also possible to group different types of metric value sequences of all monitoring objects. In this case, different types of metric value sequences of one monitoring object may be divided into different groups, so after grouping, one group may contain different types of metric value sequences.

[0059] In some embodiments, the multiple metric value sequences can be grouped according to the correlation in the time space. For example, a linear correlation algorithm is used to group the multiple metric value sequences in the time space, where the linear correlation algorithm is such as the algorithm for calculating the Pearson correlation coefficient.

[0060] See Figure 2 , Figure 2 which is a schematic diagram of grouping an index value sequence provided by an embodiment of the present application. Among them, index value sequences 1, 2, 3, 7, 8, 9, and 10 are divided into group 1, and index value sequences 4 and 5 are divided into group 2. And index value sequences 6 and 11 are not divided into any group, so they do not participate in subsequent calculations.

[0061] In some embodiments, multiple index value sequences can be grouped according to their correlation in the phase space.

[0062] Generally, curves of a monitored object in the phase space can be generated in advance according to multiple index value sequences of each monitored object. For example, taking time as a reference, multiple index values of the monitored object at the same moment are converted into a point in the phase space, so as to obtain the curve of the monitored object in the phase space, and the curve can be normalized.

[0063] Then, according to the curves of each monitored object after normalization in the phase space, multiple index value sequences can be grouped in a preset curve dimension. The preset curve dimension can include fractal dimension (or called fractal dimension) and / or separation degree. Among them, the fractal dimension is used to characterize the complexity of the curve (or called the degree of complexity), and the fractal dimension can be calculated by methods such as Hausdorff dimension and box-counting dimension. The separation degree is used to characterize the bifurcation degree of the curve.

[0064] In step 103, Granger causality analysis is performed on the target sequence pairs in the same group, where the correlation between the two index value sequences included in the target sequence pair is higher than a preset value.

[0065] Among them, when grouping multiple index value sequences according to their correlation in the time space, the correlation between the two index value sequences included in the target sequence pair in the same group refers to the time correlation. When grouping multiple index value sequences according to their correlation in the phase space, the correlation between the two index value sequences included in the target sequence pair in the same group refers to the phase space correlation.

[0066] In specific implementation, for each target sequence pair, taking each index value sequence in the target sequence pair as the result sequence, obtain the prediction effect information of the first regression model on the subsequence of the result sequence after fault injection, and obtain the prediction effect information of the second regression model on the subsequence of the result sequence after fault injection. Among them, the first regression model is trained according to the subsequence of the result sequence before fault injection, and the first regression model is used to iteratively predict the subsequence of the result sequence after fault injection based on the subsequence of the result sequence before fault injection, so as to predict the subsequence of the result sequence after fault injection; the second regression model is trained according to the subsequences of the two index value sequences in the target sequence pair before fault injection, and the second regression model is used to iteratively predict the subsequence of the result sequence after fault injection based on the subsequences of the cause sequence and the result sequence before fault injection, so as to predict the subsequence of the result sequence after fault injection, where the cause sequence refers to the sequence other than the result sequence in the target sequence pair.

[0067] Then, according to the prediction effect information corresponding to the first regression model and the prediction effect information corresponding to the second regression model, determine the causal analysis result of the target sequence pair, such as whether the cause sequence is the reason for the change of the result sequence, the strength of the causal relationship between the cause sequence and the result sequence, etc.

[0068] The following takes the prediction effect information as the goodness of fit as an example to illustrate various situations of the causal analysis result.

[0069] 1) If the goodness of fit of the second regression model > the goodness of fit of the first regression model, and the goodness of fit of the second regression model > the first threshold, it means that the cause sequence is very helpful for the prediction of the result sequence, and the cause sequence can be used as the reason for the change of the result sequence. In this case, it can be determined that the cause sequence and the result sequence have a strong causal relationship;

[0070] 2) If the goodness of fit of the second regression model > the goodness of fit of the first regression model, and the goodness of fit of the second regression model > the second threshold, it means that the cause sequence is somewhat helpful for the prediction of the result sequence, and the cause sequence can be used as the reason for the change of the result sequence. Among them, the second threshold is less than the second threshold, such as the second threshold is 0.5 and the first threshold is 0.8. In this case, it can be determined that the cause sequence and the result sequence have a weak causal relationship.

[0071] 3) If neither of the above two conditions is satisfied, it means that the cause sequence is not helpful for the prediction of the result sequence, and the cause sequence cannot be used as the reason for the change of the result sequence.

[0072] In step 104, according to the causal analysis results of each target sequence pair, determine the causal relationship between the index value sequences in the group, and the causal relationship is used to analyze the hidden dangers of the business system.

[0073] During specific implementation, the sequence of index values in a group can correspond to the vertices of an undirected graph, and each target sequence pair can correspond to the rule of the edges of the undirected graph to generate an undirected graph. Then, for each target sequence pair in the group, if the causal analysis result of the target sequence pair indicates that there is a causal relationship between the index value sequences in the target sequence pair, a direction can be added to the corresponding edge in the undirected graph, and finally a directed graph for indicating the causal relationship between the index value sequences in the group is obtained.

[0074] See Figure 3 , Figure 3 shows Figure 2 the undirected graph corresponding to Group 1 in Figure 3 . Each edge connects a target sequence pair. If there is a causal relationship between the index value sequences in the target sequence pair, the edge is adjusted to an edge with an arrow. The index value sequence at the tail of the arrow is the cause sequence, and the sequence at the head of the arrow is the effect sequence. Assume that the directed graph after causal relationship annotation for the undirected graph in Figure 4 is as shown in Figure 4 . In the directed graph shown in

[0075] , there is a causal relationship between the two index value sequences connected by the arrow, and there is an association relationship between the two index value sequences connected by non-arrow, but there is no causal relationship.

[0076] In practical applications, technicians will have expected results for the injected faults, such as abnormal sequences of certain index values in the business system, and possible causes (which can be called expected causes) that may cause the abnormality, etc. And the causal relationship can reflect various possible causes that may cause the abnormality of the index value sequence. If the causal relationship reflects more causes, it means that there are potential hazards in the business system on the corresponding causal chain, such as monitoring hazards, business hazards, etc. In this way, the potential hazards of the business system are analyzed.

[0077] See Figure 5 , Figure 5 is a flowchart of another analysis method for a business system provided by an embodiment of the present application, including the following steps.

[0078] In step 501, multiple index value sequences of multiple monitoring objects corresponding to the business system are obtained, and the multiple index value sequences are used to characterize the operation change situation of the business system from before fault injection to after fault injection.

[0079] The implementation of this step can refer to step 101 and will not be elaborated here.

[0080] In step 502, the multiple index value sequences are grouped according to the correlation of the multiple index value sequences in time and space.

[0081] In step 503, according to the correlation of multiple index value sequences of each corresponding monitoring object in the phase space, the index value sequences in the group are grouped again to obtain multiple subgroups.

[0082] Specifically, during implementation, curves of the monitoring object in the phase space can be generated in advance according to multiple index value sequences of each monitoring object, and the curves are normalized. Then, according to the normalized curves of each monitoring object corresponding to each group in the phase space, the index value sequences in the group are grouped again in a preset curve dimension to obtain multiple subgroups. The preset curve dimension may include fractal dimension (or called fractal dimensionality) and / or separation degree. Among them, the fractal dimension is used to characterize the complexity of the curve and can be calculated by methods such as Hausdorff dimension and box-counting dimension, and the separation degree is used to characterize the forking degree of the curve.

[0083] Take Figure 3 group 1 shown as an example for grouping again. Figure 6 This is a schematic diagram of multiple subgroups of group 1 provided by an embodiment of the present application. Figure 6 It contains 2 subgroups divided in the dimension of fractal dimension. Subgroup A contains index value sequences 1, 2, 8, 9, and subgroup B contains index value sequences 3, 7, 10.

[0084] In step 504, Granger causality analysis is performed on the target sequence pairs in the same subgroup, where the correlation between the two index value sequences included in the target sequence pair is higher than a preset value.

[0085] Among them, the correlation may refer to the time-space correlation calculated in step 502. And the implementation of this step can refer to step 103 and will not be elaborated here.

[0086] Since the index value sequences in a group are grouped again in step 503 to form multiple subgroups, the total number of target sequences in a group can be reduced (such as Figure 5 index value sequences 9 and 10 in

[0087] do not need to perform Granger causality analysis anymore), so the speed of Granger causality analysis on all target sequence pairs in the group in step 504 can be improved, and further the speed of fault cause analysis can be improved.

[0088] Suppose Figure 6In subgroup A, there is a strong causal relationship between indicator value sequences 1 and 2, a weak causal relationship between indicator value sequences 8 and 9, and a weak causal relationship between indicator value sequences 9 and 2; in subgroup B, there is a strong causal relationship between indicator value sequences 3 and 7, a weak causal relationship between indicator value sequences 10 and 3, and no causal relationship between indicator value sequences 10 and 7.

[0089] The vertices corresponding to the indicator value sequence with strong causal relationship in each subgroup are the nodes of the secondary propagation layer, and the other vertices are the nodes of the primary propagation layer. The solid arrows represent strong causal relationship, and the dotted arrows represent weak causal relationship. Figure 6 The resulting directed graph representing the causal relationship between the indicator value sequences in the group is as follows: Figure 7 shown. Figure 7 In the example, the alarms corresponding to the indicator value sequences in the primary propagation layer can be ignored because the alarms are mapped to the secondary propagation layer. There are strong causal relationships between the indicator value sequences in the secondary propagation layer. Based on these strong causal relationships, the faults can be quickly located, thereby eliminating the alarms in the secondary propagation layer.

[0090] In the embodiment of the present application, after the fault is injected into the business system, the root cause is automatically traced, and the monitoring weaknesses of the business system can be discovered, because after the fault is injected, the business system will generate a large number of alarms at different levels. If the root cause traced is the same as the injection point, it can be proved that the monitoring is effective. Otherwise, it means that there is a lack of monitoring or there is a problem with the root cause tracing algorithm. The weaknesses of the business system itself can also be discovered, because after the fault is injected, there may be deviations between the injection point and the risk point and bottleneck point of the business system, so the process of tracing the root cause from monitoring can discover the potential risk points of the business system. In addition, the situation of alarm storms can also be optimized, because the process of root cause tracing includes the process of monitoring alarm merging and sorting, and the monitoring data of the abnormal points will be hierarchically integrated and sorted, so similar alarms can also be merged to reduce alarm storms.

[0091] The solution of the embodiment of the present application is described in detail below with an example.

[0092] Assume that a fault is injected into a distributed business system and monitoring data is obtained. The monitoring data includes TPS value sequences and delay value sequences of 163 monitoring objects corresponding to the distributed business system.

[0093] See also Figure 8 , Figure 8 A schematic diagram of an indicator value sequence of a monitoring object provided in an embodiment of the present application, wherein the grey curve in the figure is a TPS curve, representing the TPS value sequence of the monitoring object, and the black curve is a delay curve, representing the delay value sequence of the monitoring object.

[0094] Next, the hidden danger discovery process based on monitoring data is introduced.

[0095] Step 1: Use the linear correlation algorithm to group the monitoring data according to correlation. For example, group the monitoring data according to the algorithm for calculating the Pearson correlation coefficient.

[0096] In practical applications, the TPS value sequences of all monitored objects can be grouped, and each group after grouping contains TPS value sequences; the latency value sequences of all monitored objects can be grouped, and each group after grouping contains latency value sequences; it is also possible to group the TPS value sequences and latency value sequences of all monitored objects together. In this case, the TPS value sequence and latency value sequence of a monitored object may be divided into different groups. Therefore, the index value sequences in a group after grouping may all be TPS value sequences, may all be latency value sequences, or may be a combination of TPS value sequences and latency value sequences.

[0097] For the convenience of introduction, only the case of grouping the latency value sequences of all monitored objects is introduced. Refer to Table 1, which shows the Pearson correlation coefficients between the latency value sequences of monitored objects 0 to 9. The Pearson correlation coefficients not less than the first set value, such as 0.8, are marked in bold in Table 1.

[0098] Table 1

[0099]

[0100]

[0101] Group the monitored objects with Pearson correlation coefficients not less than the first set value with each other. It can be seen that the latency value sequences of monitored objects 0, 2, 3, 5, and 6 are grouped into one group.

[0102] Step 2: Use the chaotic characteristic parameters to group the index value sequences within the same group according to correlation again.

[0103] During specific implementation, the curve of each monitored object (i.e., the TPS curve and latency curve of the monitored object in the time domain) can be converted into a TPS-latency curve in the phase space, and the TPS-latency curve is normalized. Refer to Figure 9 , Figure 9 which is a schematic diagram of the curve of a monitored object in the phase space provided by an embodiment of the present application. The black curve represents the normalized TPS-latency curve of a monitored object, and the gray curve represents the normalized TPS-latency curve of another monitored object.

[0104] Then, according to the fractal dimension and separation degree of the TPS-latency curve corresponding to each group, the group can be grouped again in these two dimensions of the fractal dimension and separation degree to obtain multiple subgroups.

[0105] Suppose the original sequence of index values in a group includes the latency value sequences of monitoring objects 143, 1, 13, 135, 6, 21, 41, 36, 63, 117, 162. Referring to Table 2, Table 2 shows an example of regrouping this group. To more clearly display the subgroups, the data belonging to different subgroups in Table 2 are shown in italics or bold.

[0106] In Table 2, this group is divided into 3 subgroups according to the fractal dimension: Fractal Subgroup 1, Fractal Subgroup 2, and Fractal Subgroup 3. Fractal Subgroup 1 includes the latency value sequences of monitoring objects 143, 1, 13. Fractal Subgroup 2 includes the latency value sequences of monitoring objects 135, 6, 21, 41, 36. Fractal Subgroup 3 includes the latency value sequences of monitoring objects 63, 117, 162. This group is divided into 2 subgroups according to the separation degree: Separation Subgroup 1 and Separation Subgroup 2. Separation Subgroup 1 includes the latency value sequences of monitoring objects 143, 135, 41, 63, 162. Separation Subgroup 2 includes the latency value sequences of monitoring objects 1, 13, 6, 21, 36, 117.

[0107] Table 2

[0108]

[0109]

[0110] Step 3: Perform Granger causality analysis on the target sequence pairs in the same subgroup, where the correlation between the two index value sequences included in the target sequence pair (referring to the correlation calculated in the first step) is higher than the preset value.

[0111] Take the Granger causality analysis of multiple linear regression for the target sequence pairs as an example.

[0112] For each target sequence pair, each index value sequence in the target sequence pair can be used as the result sequence.

[0113] Then, the first regression model can be trained using the subsequence of the fruit sequence before fault injection. For example, for the subsequence of the fruit sequence before fault injection, a moment T is selected, and the data of the subsequence from time T1 to time T is used as the input, and the data of the subsequence from time T to time T2 is used as the output for model training. By modifying T multiple times and training multiple times, the first regression model can be obtained. Further, the first regression model is used to predict the subsequence of the fruit sequence after fault injection. Specifically, for the subsequence of the fruit sequence before fault injection, with the end time of the subsequence as T, the data of the subsequence from time T1 to time T is input into the first regression model to obtain the data of the fruit sequence from time T to time T2, and these data are concatenated to the subsequence. Then, with the end time of the subsequence still as T, the data of the subsequence from time T1 to time T is input into the first regression model to predict the data of the subsequence from time T to time T2, and so on in a loop to predict the subsequence of the fruit sequence after fault injection. Finally, based on the predicted subsequence of the fruit sequence after fault injection and the actual subsequence of the fruit sequence after fault injection, the prediction effect information of the first regression model, such as the goodness of fit, can be determined.

[0114] Moreover, the second regression model can be trained using the respective subsequences of the two metric value sequences in the target sequence pair before fault injection. For example, for the subsequence A1 of the fruit sequence before fault injection and the subsequence B1 of the cause sequence (the sequence other than the fruit sequence in the target sequence pair) before fault injection, a moment T is selected, and the data of the subsequences A1 and B1 from time T1 to time T are used as the input, and the data of the subsequence A1 from time T to time T2 are used as the output for model training. By modifying T multiple times and training multiple times, the second regression model can be obtained.

[0115] Further, the second regression model and the cause sequence are used to predict the subsequence of the fruit sequence after fault injection. Specifically, for the subsequence A1 of the fruit sequence before fault injection, with the end time of the subsequence A1 as T, the data of the subsequences A1 and B1 from time T1 to time T are input into the second regression model to obtain the data of the subsequence A1 from time T to time T2, and the data from time T to time T2 are concatenated to the subsequence A1 to extend the subsequence A1. Then, with the end time of the subsequence A1 still as T, the data of the subsequence A1 from time T1 to time T (including the predicted data) and the data of the subsequence B1 from time T1 to time T (real data) are input into the second regression model to predict the data of the subsequence A1 from time T to time T2, and then the data from time T to time T2 are concatenated to the subsequence A1 to extend the subsequence A1, and so on in a loop to predict the subsequence of the fruit sequence after fault injection. Finally, based on the predicted subsequence of the fruit sequence after fault injection and the actual subsequence of the fruit sequence after fault injection, the prediction effect information of the second regression model, such as the goodness of fit, can be determined.

[0116] Finally, based on the prediction effect information of the first regression model and the prediction effect information of the second regression model, the causal analysis result of the target sequence pair can be determined, such as whether the cause sequence is the cause of the change in the effect sequence, the strength of the causal relationship, etc.

[0117] Suppose the index value sequences in the target sequence pair are the delay value sequences of monitoring object 12 and monitoring object 19. Taking the delay value sequence of monitoring object 12 as the effect sequence as an example. And assume that the fault injection time is 11:18:14 on the current day.

[0118] See Figure 10a , Figure 10a FIG.

[0119] See Figure 10b , Figure 10b FIG.

[0120] By comparison, the prediction effect of the first regression model on the delay value subsequence of monitoring object 12 after fault injection is relatively poor, and the prediction effect of the second regression model on the delay value subsequence of monitoring object 12 after fault injection is relatively good. That is to say, the delay value sequence of monitoring object 19 is helpful for the prediction of the delay value sequence of monitoring object 12. Therefore, the delay value sequence of monitoring object 19 can be used as the cause of the change in the delay value sequence of monitoring object 12.

[0121] In addition, the difference degree between the prediction effects of the first regression model and the second regression model can also be used to distinguish the strength degree of the causal relationship between the cause sequence and the effect sequence.

[0122] Taking the prediction effect information as the goodness of fit as an example, if the goodness of fit of the second regression model > the goodness of fit of the first regression model, and the goodness of fit of the second regression model > 0.8, it indicates that there is a strong causal relationship between the result sequence and the cause sequence. If the goodness of fit of the second regression model > the goodness of fit of the first regression model, and the goodness of fit of the second regression model > the second threshold, it indicates that there is a weak causal relationship between the result sequence and the cause sequence. If neither of the above two conditions is satisfied, it means that the cause sequence is not helpful for predicting the result sequence, and the cause sequence cannot be used as the reason for the change of the result sequence.

[0123] Taking the delay value sequence of the target sequence pair including monitoring object 0 and monitoring object 49 as an example, the above process will be introduced.

[0124] First, according to the fault injection time, the delay curve of monitoring object 0 can be divided into two intervals: before the delay increase and after the delay increase. Multiple linear regression is performed on the curve before the delay increase to obtain the first regression model. For example, for the subsequence corresponding to the curve of monitoring object 0 before the delay increase, a moment T is selected, and the data within T - 7 seconds of the subsequence is used as the input, and the data within T + 3 seconds of the subsequence is used as the output for model training. By changing the moment T multiple times and training multiple times, the first regression model is obtained.

[0125] Then, the first regression model is used to predict the subsequence corresponding to the curve of monitoring object 0 after the delay increase. For example, for the subsequence corresponding to the curve of monitoring object 0 before the delay increase, with the end moment of the subsequence as T, the data within T - 7 seconds of the subsequence is input into the first regression model to obtain the data of monitoring object 0 within T + 3 seconds. The data within these 3 seconds is spliced onto the subsequence. Continuing with the end moment of the subsequence as T, the data within T - 7 seconds of the subsequence is input into the first regression model to predict the data of monitoring object 0 within T + 3 seconds, and so on in a loop to predict the subsequence of monitoring object 0 after the fault injection (i.e., the subsequence corresponding to the curve of monitoring object 0 after the delay increase).

[0126] Finally, the predicted subsequence of monitoring object 0 after the fault injection is compared with the actual subsequence of monitoring object 0 after the fault injection, and the goodness of fit R1 of the first regression model is calculated.

[0127] Meanwhile, according to the fault injection moment, the delay curves of monitoring object 0 and monitoring object 49 can be divided into two intervals: before the delay increase and after the delay increase. The curves of monitoring object 0 and monitoring object 49 before the delay increase are used together for multiple linear regression to obtain the second regression model. For example, for subsequence A1 corresponding to the curve of monitoring object 0 before fault injection, and subsequence B1 corresponding to the curve of monitoring object 49 before fault injection, a moment T is selected. Using the data of subsequence A1 within T - 7 seconds and the data of subsequence B1 within T - 7 seconds as inputs and the data of subsequence A1 at T + 3 seconds as the output for model training. By changing T multiple times and training multiple times, the second regression model is obtained.

[0128] Then, using the second regression model and the sequence corresponding to the curve of monitoring object 49, the subsequence corresponding to the curve of monitoring object 0 after the delay increase is predicted. For example, for subsequence A1 corresponding to the curve of monitoring object 0 before fault injection, with the end moment of subsequence A1 as T, the data of subsequence A1 within T - 7 seconds and the data of sequence B corresponding to the overall curve of monitoring object 49 within T - 7 seconds are input into the second regression model to obtain the data of monitoring object 0 within T + 3 seconds. The data within these 3 seconds are spliced onto subsequence A1. Continuing with the end moment of subsequence A1 as T, the data of subsequence A1 within T - 7 seconds (already including the predicted data) and the data of sequence B1 within T - 7 seconds (real data) are input into the second regression model to predict the data of monitoring object 0 within T + 3 seconds. Looping in this way, the subsequence of monitoring object 0 after fault injection (i.e., the subsequence corresponding to the curve of monitoring object 0 after the delay increase) is predicted.

[0129] Finally, the predicted subsequence of monitoring object 0 after fault injection is compared with the real subsequence of monitoring object 0 after fault injection, and the goodness of fit R2 of the second regression model is calculated.

[0130] For example, if R2 > R1 and R2 > 0.8, it is determined that the delay value sequence of monitoring object 49 can be the cause of the change in the delay value sequence of monitoring object 0, and there is a strong causal relationship between the two. If R2 > R1 and R2 > 0.5, it is determined that the delay value sequence of monitoring object 49 can be the cause of the change in the delay value sequence of monitoring object 0, and there is a weak causal relationship between the two. If neither of the above is satisfied, it is determined that there is only an association relationship between the two and no causal relationship.

[0131] It should be noted that the above is introduced by taking the delay value sequence of monitoring object 0 as the result sequence. The situation with the delay value sequence of monitoring object 49 as the result sequence is similar and will not be elaborated here.

[0132] Refer to Table 3. Table 3 shows an example of the Granger causality analysis results among the index value sequences in a group. The rows correspond to the cause sequences, the columns correspond to the effect sequences, and the data in the table is R2. In Table 3, the data with R2 > R1 and R2 > 0.8 is bolded.

[0133] Table 3

[0134]

[0135] Step 4: Generate a directed graph based on the Granger causality analysis results of each pair of target sequences in the group.

[0136] Suppose a directed graph is generated based on the Granger causality analysis results in Table 3. The process of generating the directed graph is as Figure 11 shown. Since the R2 values between Monitoring Object 13 and other monitoring objects in Table 3 are all negative, it indicates that Monitoring Object 13 is not suitable as the cause for other monitoring objects in Table 3. Therefore, Monitoring Object 13 is excluded when generating the undirected graph, that is, Figure 11 the monitoring object corresponding to the vertex of the undirected graph on the left does not include Monitoring Object 13. Then, based on the non - negative data in Table 3, arrows are marked in the left undirected graph. Among them, the delay value sequence at the tail of the arrow is the cause sequence, the delay value sequence at the head of the arrow is the effect sequence, and the number next to the arrow represents the R2 corresponding to the cause sequence and the effect sequence. Finally, the edges corresponding to the bolded R2 in Table 3 are retained to obtain the directed graph shown on the right. The directed graph indicates that the delay value sequence of Monitoring Object 19 is the cause of the change in the delay value sequences of Monitoring Objects 0, 12, and 45.

[0137] Refer to Figure 12 , Figure 12 which is a comparison schematic diagram of the index value sequences of multiple monitoring objects provided in the embodiment of the present application. Among them, the gray curve represents the TPS value sequence, and the black curve represents the delay value sequence. By comparison, it can be seen that the curves of Monitoring Object 19 have no obvious correlation with the curves of Monitoring Objects 0, 12, and 45. However, through the above analysis, the causal relationship between them is found.

[0138] Step 5: Analyze the potential hazards of the business system according to the directed graph and the business process of the business system.

[0139] According to the analysis of the business process of the business system, Monitoring Objects 0, 12, and 45 are user information query, user card information query, and other system user card information query respectively. There is no direct causal relationship among the three monitoring objects. The reason for the increase in their delays is that the delay of Monitoring Object 19 (overall system delay) increases. This is consistent with the expected result that the delay of Monitoring Object 19 increases, indicating that no potential hazards in the distributed system are found after this fault injection.

[0140] In the embodiments of the present application, through Granger causality analysis, the causal relationship between the index value sequences is accurately identified, which not only improves the accuracy of fault root cause tracing but also significantly shortens the fault location time. In addition, by combining non-linear correlation analysis and chaos theory, the causal path is refined and hierarchically analyzed to construct a propagation path containing multi-dimensional causal relationships, effectively solving the deficiencies of traditional causal relationship analysis in dealing with complex non-linear relationships and improving the depth and accuracy of fault root cause tracing.

[0141] Based on the same technical concept, the embodiments of the present application also provide an analysis device for a service system. The principle of solving problems by the analysis device for the service system is similar to the above-mentioned analysis method for the service system. Therefore, for the implementation of the analysis device for the service system, reference can be made to the implementation of the analysis method for the service system, and the repeated parts will not be elaborated.

[0142] Figure 13 FIG. is a schematic structural diagram of an analysis device for a service system provided by an embodiment of the present application, including:

[0143] An acquisition module 1301, configured to acquire multiple index value sequences of multiple monitoring objects corresponding to the service system, where the multiple index value sequences are used to characterize the operation change of the service system from before fault injection to after fault injection;

[0144] A grouping module 1302, configured to group the multiple index value sequences according to the correlation;

[0145] A causality analysis module 1303, configured to perform Granger causality analysis on target sequence pairs in the same group, where the correlation between the two index value sequences included in the target sequence pair is higher than a preset value;

[0146] A determination module 1304, configured to determine the causal relationship between the index value sequences in the group according to the causal analysis results of each target sequence pair, where the causal relationship is used to analyze the potential hazards of the service system.

[0147] In some embodiments, the grouping module 1302 is specifically configured to:

[0148] Perform correlation grouping on the multiple index value sequences in the time space; or

[0149] Perform correlation grouping on the multiple index value sequences in the phase space; or

[0150] Perform correlation grouping on the multiple index value sequences in the time space, and perform correlation grouping on the index value sequences in the same group in the phase space to obtain subgroups of the group.

[0151] In some embodiments, the grouping module 1302 is specifically configured to perform correlation grouping in the phase space according to the following steps:

[0152] According to the curves of each monitored object corresponding to the candidate index value sequence in the phase space, perform correlation grouping on the candidate index value sequence in a preset curve dimension, where the candidate index value sequence is one of the multiple index value sequences or the index value sequences in the same group, and the curve of each monitored object in the phase space is generated according to multiple index value sequences of the monitored object. The preset curve dimension includes fractal dimension and / or separation degree. The fractal dimension is used to characterize the complexity of the curve, and the separation degree is used to characterize the bifurcation degree of the curve.

[0153] In some embodiments, the causality analysis module 1303 is specifically configured to perform Granger causality analysis on the target sequence pair according to the following steps:

[0154] Taking each index value sequence in the target sequence pair as the result sequence, obtain the prediction effect information of the first regression model for the subsequence of the result sequence after fault injection, and obtain the prediction effect information of the second regression model for the subsequence. The first regression model is trained according to the subsequence of the result sequence before fault injection. The first regression model is used to iteratively predict the subsequence of the result sequence after fault injection based on the subsequence of the result sequence before fault injection to obtain the subsequence of the result sequence after fault injection. The second regression model is trained according to the subsequences of the two index value sequences in the target sequence pair before fault injection. The second regression model is used to iteratively predict the subsequence of the result sequence after fault injection based on the cause sequence and the subsequence of the result sequence before fault injection to obtain the subsequence of the result sequence after fault injection. The cause sequence refers to the sequence in the target sequence pair other than the result sequence.

[0155] Determine the causality analysis result of the target sequence pair according to the prediction effect information corresponding to the first regression model and the prediction effect information corresponding to the second regression model.

[0156] In some embodiments, the determination module 1304 is specifically configured to

[0157] Generate an undirected graph according to the rule that the vertices of the undirected graph correspond to the index value sequences in the group and each target sequence pair corresponds to the edge of the undirected graph.

[0158] If the causality analysis result of any target sequence pair indicates that there is a causal relationship between the index value sequences in the target sequence pair, add a direction to the corresponding edge in the undirected graph to obtain a directed graph, and the directed graph is used to indicate the causal relationship between the index value sequences in the group.

[0159] In some embodiments, when the causal analysis result of any one of the target sequence pairs further includes causal relationship strength information, attribute information representing the causal relationship strength information is added to the corresponding edge in the undirected graph.

[0160] The division of modules in the embodiments of the present application is illustrative. It is only a logical function division. In actual implementation, there may be other division methods. In addition, each functional module in each embodiment of the present application may be integrated in a processor, may exist physically alone, or two or more modules may be integrated in one module. The coupling between each module can be realized through some interfaces, and these interfaces are usually electrical communication interfaces, but it is not excluded that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different positions of the same or different devices. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules.

[0161] After introducing the analysis method and device of the service system in the exemplary embodiments of the present application, next, an electronic device according to another exemplary embodiment of the present application is introduced.

[0162] Next, with reference to Figure 14 to describe the electronic device 130 implemented according to this embodiment of the present application. Figure 14 The displayed electronic device 140 is only an example and should not bring any limitation to the functions and usage scope of the embodiments of the present application.

[0163] As Figure 14 shown, the electronic device 140 is presented in the form of a general electronic device. The components of the electronic device 140 may include, but are not limited to: the above-mentioned at least one processor 141, the above-mentioned at least one memory 142, and a bus 143 connecting different system components (including the memory 142 and the processor 141).

[0164] The bus 143 represents one or more of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, a processor, or a local bus using any bus structure in a variety of bus structures.

[0165] The memory 142 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1421 and / or a cache memory 1422, and may further include a read-only memory (ROM) 1423.

[0166] The memory 142 may also include a program / utilities 1425 having a set (at least one) of program modules 1424. Such program modules 1424 include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment.

[0167] The electronic device 140 may also communicate with one or more external devices 144 (such as a keyboard, a pointing device, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 140, and / or may communicate with any device that enables the electronic device 140 to communicate with one or more other electronic devices (such as a router, a modem, etc.). Such communication may be carried out through an input / output (I / O) interface 145. Moreover, the electronic device 140 may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 146. As shown in the figure, the network adapter 146 communicates with other modules for the electronic device 140 through a bus 143. It should be understood that although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 140, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0168] In an exemplary embodiment, the electronic device of the present application may at least include at least one processor and a memory communicatively connected to the at least one processor. Among them, the memory stores a computer program executable by the at least one processor. When the computer program is executed by the at least one processor, the at least one processor can be caused to execute the steps of the analysis method of any business system provided by the embodiments of the present application.

[0169] In an exemplary embodiment, a storage medium is also provided. When the computer program in the storage medium is executed by the processor of the electronic device, the electronic device can execute the analysis method of any of the above-mentioned business systems. Optionally, the storage medium may be a non-transitory computer-readable storage medium. For example, the non-transitory computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0170] In an exemplary embodiment, a computer program product is also provided. When the computer program product is executed by an electronic device, the electronic device can implement any of the exemplary methods provided by the present application.

[0171] It should be noted that although several modules or sub-modules of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more of the above-described modules can be embodied in one module. Conversely, the features and functions of one module described above can be further divided and embodied by multiple modules.

[0172] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the shown operations must be performed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution.

[0173] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0174] Although the preferred embodiments of the present application have been described, those skilled in the art can make additional changes and modifications once they know the basic creative concept. Therefore, the appended claims are intended to be construed to include the preferred embodiments as well as all changes and modifications falling within the scope of the present application.

[0175] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application also includes these changes and modifications.

Claims

1. A method for analyzing a business system, characterized in that: include: Acquire multiple indicator value sequences of multiple monitoring objects corresponding to the business system, wherein the multiple indicator value sequences are used to characterize the operation change of the business system from before fault injection to after fault injection; Grouping the multiple indicator value sequences according to relevance; Granger causality analysis is performed on target sequence pairs in the same group, where the correlation between two indicator value sequences contained in the target sequence pairs is higher than a preset value; According to the causal analysis results of each of the target sequence pairs, the causal relationship between the indicator value sequences in the group is determined, and the causal relationship is used to analyze the hidden dangers of the business system.

2. The method according to claim 1, characterized in that The multiple indicator value sequences are grouped according to relevance, including: Grouping the multiple indicator value sequences by correlation in time and space; or Grouping the multiple indicator value sequences by correlation in phase space; or The plurality of indicator value sequences are grouped according to their correlation in time space, and the indicator value sequences in the same group are grouped according to their correlation in phase space to obtain subgroups of the group.

3. The method according to claim 2, characterized in that The correlations are grouped in phase space according to the following steps: According to the curves of each monitored object in the phase space corresponding to the candidate indicator value sequence, the candidate indicator value sequence is grouped according to its correlation in a preset curve dimension, wherein the candidate indicator value sequence is the multiple indicator value sequences or the indicator value sequences in the same group, and the curve of each monitored object in the phase space is generated according to the multiple indicator value sequences of the monitored object, and the preset curve dimension includes fractal dimension and / or separation degree, the fractal dimension is used to characterize the complexity of the curve, and the separation degree is used to characterize the degree of bifurcation of the curve.

4. The method according to any one of claims 1 to 3, characterized in that: Granger causality analysis is performed on the target sequence pair according to the following steps: Taking each indicator value sequence in the target sequence pair as a result sequence, obtaining prediction effect information of a first regression model on a subsequence of the result sequence after fault injection, and obtaining prediction effect information of a second regression model on the subsequence, wherein the first regression model is trained based on a subsequence of the result sequence before fault injection, and the first regression model is used to iteratively predict a subsequence of the result sequence after fault injection based on the subsequence of the result sequence before fault injection, so as to obtain a subsequence of the result sequence after fault injection, and the second regression model is trained based on subsequences of two indicator value sequences in the target sequence pair before fault injection, and the second regression model is used to iteratively predict a subsequence of the result sequence after fault injection based on a cause sequence and a subsequence of the result sequence before fault injection, so as to obtain a subsequence of the result sequence after fault injection, and the cause sequence refers to a sequence in the target sequence pair other than the result sequence; The causal analysis result of the target sequence pair is determined according to the prediction effect information corresponding to the first regression model and the prediction effect information corresponding to the second regression model.

5. The method according to any one of claims 1 to 3, characterized in that: Determining the causal relationship between the indicator value sequences in the group according to the causal analysis results of each target sequence pair includes: Generate an undirected graph by using the index value sequence in the group to correspond to the vertices of the undirected graph and the rule that each target sequence corresponds to the edge of the undirected graph; If the causal analysis result of any of the target sequence pairs indicates that there is a causal relationship between the indicator value sequences in the target sequence pair, a direction is added to the corresponding edge in the undirected graph to obtain a directed graph, which is used to indicate the causal relationship between the indicator value sequences in the group.

6. The method according to claim 5, characterized in that When the causal analysis result of any of the target sequence pairs also includes causal relationship strength information, attribute information representing the causal relationship strength information is added to the corresponding edge in the undirected graph.

7. An analysis device for a business system, characterized in that: include: An acquisition module, used to acquire multiple indicator value sequences of multiple monitoring objects corresponding to the business system, wherein the multiple indicator value sequences are used to characterize the operation changes of the business system from before fault injection to after fault injection; A grouping module, used for grouping the plurality of indicator value sequences according to relevance; A causal analysis module, used for performing Granger causal analysis on target sequence pairs in the same group, wherein the correlation between two indicator value sequences contained in the target sequence pairs is higher than a preset value; The determination module is used to determine the causal relationship between the indicator value sequences in the group according to the causal analysis results of each target sequence pair, and the causal relationship is used to analyze the hidden dangers of the business system.

8. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: When the computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images