Abnormal attribution method and device, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention provides an exception attribution method and device, electronic equipment, a storage medium and a program product. The method comprises the steps that in response to abnormal attribute parameters existing in a preset object, associated attribute parameters of the abnormal attribute parameters are obtained, and parameter value abnormal changes exist in the abnormal attribute parameters; according to the abnormal attribute parameter and an associated attribute parameter of the abnormal attribute parameter, determining an attribution event of the abnormal attribute parameter, the attribution event being associated with abnormal change of a parameter value of the abnormal attribute parameter; and generating an abnormal attribution result of the abnormal attribute parameter based on the attribution event. According to the technical scheme, the accuracy of the attribution result of the abnormal change of the parameter value can be improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technologies, and in particular, to an abnormal attribution method, apparatus, electronic device, storage medium, and program product. Background Art

[0002] The development of an industry is inseparable from the modeling and observation of relevant attribute parameters in the industry. For example, abnormal changes in certain attribute parameters may be affected by certain event changes. Accurately analyzing the event changes that cause abnormal changes in attribute parameters is of crucial significance for various aspects such as risk prediction and / or optimization of attribute parameters.

[0003] However, in related technologies, the accuracy of attributing abnormal changes in attribute parameters is relatively poor. Summary of the Invention

[0004] Embodiments of the present disclosure provide an abnormal attribution method, apparatus, electronic device, storage medium, and program product to improve the accuracy of attributing abnormal changes in attribute parameters.

[0005] In a first aspect, embodiments of the present disclosure provide an abnormal attribution method, including:

[0006] In response to a preset object having an abnormal attribute parameter, obtaining an associated attribute parameter of the abnormal attribute parameter, where the abnormal attribute parameter has an abnormal change in parameter value;

[0007] Determining an attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, where the attribution event is associated with the abnormal change in the parameter value of the abnormal attribute parameter;

[0008] Generating an abnormal attribution result of the abnormal attribute parameter based on the attribution event.

[0009] In a second aspect, embodiments of the present disclosure further provide an abnormal attribution apparatus, including:

[0010] A parameter acquisition module, configured to obtain an associated attribute parameter of the abnormal attribute parameter in response to a preset object having an abnormal attribute parameter, where the abnormal attribute parameter has an abnormal change in parameter value;

[0011] An event determination module, configured to determine an attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, where the attribution event is associated with the abnormal change in the parameter value of the abnormal attribute parameter;

[0012] A result generation module, configured to generate an abnormal attribution result of the abnormal attribute parameter based on the attribution event.

[0013] In a third aspect, embodiments of the present disclosure further provide an electronic device, including:

[0014] One or more processors;

[0015] A memory for storing one or more programs,

[0016] When the one or more programs are executed by the one or more processors, the one or more processors implement the anomaly attribution method as described in the embodiments of the present disclosure.

[0017] In a fourth aspect, embodiments of the present disclosure further provide a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, it implements the anomaly attribution method as described in the embodiments of the present disclosure.

[0018] In a fifth aspect, embodiments of the present disclosure further provide a computer program product, when the computer program product is executed by a computer, the computer implements the anomaly attribution method as described in the embodiments of the present disclosure.

[0019] The anomaly attribution method, device, electronic device, storage medium, and program product provided by the embodiments of the present disclosure determine an attribution event that causes an abnormal change in the parameter value of an anomaly attribute parameter based on the anomaly attribute parameter and the associated attribute parameter of the anomaly attribute parameter. Compared with the technical solution of manually performing attribution analysis on the abnormal change in the parameter value of the anomaly attribute parameter, it can reduce the time spent on performing attribution analysis on the abnormal change in the parameter value, improve the comprehensiveness of the determined attribution event, and the accuracy of the attribution result of the abnormal change in the parameter value. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Combined with the drawings and referring to the following specific embodiments, the above and other features, advantages, and aspects of the embodiments of the present disclosure will become more obvious. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the original elements and elements are not necessarily drawn to scale.

[0021] Figure 1 It is a flowchart of an anomaly attribution method provided by an embodiment of the present disclosure;

[0022] Figure 2 It is a schematic diagram of the update process of an event parameter set provided by an embodiment of the present disclosure;

[0023] Figure 3 It is a flowchart of another anomaly attribution method provided by an embodiment of the present disclosure;

[0024] Figure 4 It is a structural block diagram of an anomaly attribution device provided by an embodiment of the present disclosure;

[0025] Figure 5 Schematic structural diagram of an electronic device provided by an embodiment of the present disclosure. Detailed implementation manners

[0026] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although some embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. On the contrary, these embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not used to limit the protection scope of the present disclosure.

[0027] It should be understood that the various steps recited in the method embodiments of the present disclosure can be executed in a different order and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this regard.

[0028] The term "including" and its variations used herein are open-ended, that is, "including but not limited to". The term "based on" is "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0029] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependent relationships.

[0030] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive. Those skilled in the art should understand that unless clearly indicated otherwise in the context, it should be understood as "one or more".

[0031] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only for illustrative purposes and are not used to limit the scope of these messages or information.

[0032] It can be understood that the data involved in the technical solution (including but not limited to the data itself, the acquisition or use of the data) should comply with the requirements of the corresponding laws, regulations and related provisions.

[0033] Figure 1Schematic flowchart of an abnormal attribution method provided by an embodiment of the present disclosure. This method can be executed by an abnormal attribution device, where the device can be implemented by software and / or hardware and can be configured in an electronic device. Typically, it can be configured in a computer, a mobile phone, or a tablet computer. The abnormal attribution method provided by the embodiment of the present disclosure is applicable to scenarios where the parameter value of an attribute parameter changes abnormally. As Figure 1 shown, the abnormal attribution method provided by this embodiment may include:

[0034] S101. In response to an abnormal attribute parameter existing in a preset object, obtain the associated attribute parameter of the abnormal attribute parameter, where the parameter value of the abnormal attribute parameter changes abnormally.

[0035] The preset object can be understood as an object with an abnormal attribute parameter. The type of the preset object is not limited. For example, the preset object can be a certain application program, a certain function, a certain transaction in an industry, a certain product, and / or a certain production line, etc. This embodiment does not make a limitation on this.

[0036] The abnormal attribute parameter can be understood as an attribute parameter whose parameter value changes abnormally. The abnormal change of the parameter value can include, for example, but not limited to, an abnormal change in the change amplitude of the parameter value, an abnormal change in the change rate of the parameter value, and / or the parameter value changes to be outside the preset parameter value range. The associated attribute parameter of an attribute parameter (such as an abnormal attribute parameter, etc.) can be understood as an attribute parameter associated with this attribute parameter. Exemplarily, the associated attribute parameter of an attribute parameter can be an attribute parameter that affects the parameter value of this attribute parameter. For example, if the change in the parameter value of attribute parameter A causes the change in the parameter value of attribute parameter B, then attribute parameter A can be used as an associated attribute parameter of attribute parameter B.

[0037] Among them, the attribute parameter of the preset object can be understood as a parameter used to describe the nature and / or characteristics of the attribute associated with the preset object. The type of this attribute parameter is not limited. Taking the preset object as an application program as an example, the attribute parameters of the preset object can include, for example, the startup time consumption of the preset object, the number of daily active users (DAU), the average residence time of users, etc. The abnormal change in the change amplitude of the parameter value can include, for example, that the change amplitude of the parameter value is too large (such as greater than the first change amplitude threshold) or too small (such as less than the second change amplitude threshold), etc. The abnormal change in the change rate of the parameter value can include, for example, that the change rate of the parameter value is too large (such as greater than the first change rate threshold) or too small (such as less than the second change rate threshold), etc.

[0038] Specifically, when it is detected that an abnormal attribute parameter in which a parameter value of a preset object undergoes an abnormal change exists, the associated attribute parameter of the abnormal attribute parameter can be obtained. For example, the associated attribute parameter of the abnormal attribute parameter can be queried from a preset associated attribute file; and / or, a correlation detection is performed on the abnormal attribute parameter and one or more other attribute parameters except the abnormal attribute parameter to obtain the attribute parameter associated with the abnormal attribute parameter as the associated attribute parameter of the abnormal attribute parameter, and so on.

[0039] S102: Determine an attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and an attribute parameter associated with the abnormal attribute parameter, wherein the attribution event is associated with an abnormal change in a parameter value of the abnormal attribute parameter.

[0040] Among them, the attribution event of the abnormal attribute parameter may be an event that may cause the abnormal attribute parameter to have the above-mentioned abnormal parameter value change. The attribution event of the abnormal attribute parameter may include, for example, an event that directly causes the parameter value of the abnormal attribute parameter to change, such as an associated event of the abnormal attribute parameter; it may also include an event that indirectly causes the parameter value of the abnormal attribute parameter to change, such as an associated event of the associated attribute parameter of the abnormal attribute parameter. The associated event of a certain attribute parameter can be understood as an event that causes the parameter value of this attribute parameter to change, such as a change event that directly causes the parameter value of this attribute parameter to change, or a change event in which the influence degree information of this attribute parameter meets the set conditions. This change event can be understood as an event of adjustment and / or modification. Taking the preset object as an application as an example, illustratively, the attribution event of the preset object may include, for example, events such as application version change, application configuration file change, operating system version change and / or network environment change.

[0041] Exemplarily, the attribution event information of the abnormal attribute parameter can be determined according to the abnormal attribute parameter of the preset object and the associated attribute parameter of the abnormal attribute parameter. For example, for each attribute parameter in the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, a change event that affects the parameter value of the attribute parameter is determined as the attribution event of the abnormal attribute parameter, and the event information of the change event is obtained as the attribution event information of the abnormal attribute parameter.

[0042] When determining the associated event of a certain attribute parameter, exemplarily, an impact degree analysis can be performed on this attribute parameter and each change event that has occurred to obtain the impact degree information of each change event on this attribute parameter, and based on this impact degree information, determine the associated event of this attribute parameter; and / or, query and determine the associated event of this attribute parameter based on a pre-set event parameter set, and so on. This event parameter set can be used to record the impact relationship between different change events and different attribute parameters. This impact relationship can be manually marked, or determined through event analysis. This embodiment does not make any limitations on this.

[0043] S103. Generate an abnormal attribution result of the abnormal attribute parameter based on the attributed event.

[0044] Among them, the abnormal attribution result can be understood as the attribution result generated by performing attribution analysis on the abnormal change of the parameter value of the abnormal attribute parameter. The content of the abnormal attribution result is not limited. Exemplarily, the abnormal attribution result may include at least part of the attribution event information of the attributed event, and / or, the attribution analysis conclusion generated based on the attribution event information of the attributed event, etc.

[0045] Specifically, after determining the attributed event of the abnormal attribute parameter, the event information of the abnormal attributed event can be obtained, such as obtaining the impact degree information of the abnormal attributed event on the abnormal attribute parameter or the associated attribute parameter of the abnormal attribute parameter, and / or, the event change information of the attributed event, etc., as the event information of the abnormal attributed event. And, based on the event information of the attributed event, perform attribution analysis on the abnormal change of the parameter value of the abnormal attribute parameter. For example, through a pre-trained abnormal attribution model, based on the event information of each attributed event of the abnormal attribute parameter, perform attribution analysis on the abnormal change of the parameter value of the abnormal attribute parameter this time to obtain the abnormal attribution result of the abnormal attribute parameter. This abnormal attribution model can be understood as a model used for abnormal attribution. The type of this abnormal attribution model is not limited. Exemplarily, the abnormal attribution model may include, but is not limited to, large models.

[0046] The abnormal attribution method provided in this embodiment responds to an abnormal attribute parameter with an abnormal change in the parameter value of a preset object, and obtains the associated attribute parameter of this abnormal attribute parameter; based on the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, determine the attribution event of the abnormal attribute parameter, and this attribution event is associated with the abnormal change in the parameter value of the abnormal attribute parameter; generate an abnormal attribution result of the abnormal attribute parameter based on this attribution event. By using the above technical solution, this embodiment determines the attribution event that causes the abnormal change in the parameter value of the abnormal attribute parameter based on the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter. Compared with the technical solution of manually performing attribution analysis on the abnormal change in the parameter value of the abnormal attribute parameter, it can reduce the time spent on performing attribution analysis on the abnormal change in the parameter value, improve the comprehensiveness of the determined attribution event, and the accuracy of the attribution result of the abnormal change in the parameter value.

[0047] In some embodiments, the determining, according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, the attribution event of the abnormal attribute parameter includes: determining a first event and a second event based on an event parameter set as the attribution event information of the abnormal attribute parameter, where the event parameter set is used to record the influence relationship and the second influence degree information between different events and different attribute parameters, the first event corresponds to the abnormal attribute parameter, and the second event corresponds to the associated attribute parameter of the abnormal attribute parameter.

[0048] Among them, the event parameter set can be understood as a set used to record the influence relationship between different events and different attribute parameters. For example, the event parameter set can record the event identification information of multiple events, the parameter identification information of multiple attribute parameters, and the influence relationship between this multiple events and this multiple attribute parameters. For example, if there is an influence relationship between a certain event and a certain attribute parameter, it means that the change made by this event will affect the parameter value of this attribute parameter. In addition, for the situation where there is an influence relationship between a certain event and a certain attribute parameter, the event parameter set can further record the second influence degree information of this event on this attribute parameter. The second influence degree information can be understood as the influence degree information between the event and the attribute parameter, such as the influence degree value of the event on the attribute parameter. The second influence degree information can be used to indicate the magnitude of the influence of the change of the event on the parameter value of the attribute parameter.

[0049] The first event can be understood as the event corresponding to the abnormal attribute parameter in the event parameter set, such as an event having an influence relationship with the abnormal attribute parameter. The second event can be understood as the event corresponding to the associated attribute parameter of the abnormal attribute parameter in the event parameter set, such as an event having an influence relationship with one or more associated attribute parameters of the abnormal attribute parameter.

[0050] Specifically, after obtaining the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, the first event having an impact relationship with the abnormal attribute parameter and the second event having an impact relationship with the associated attribute parameter of the abnormal attribute parameter can be determined based on the pre-generated event parameter set, and used as the attribution event of the abnormal attribute parameter.

[0051] Exemplarily, for each attribute parameter in the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, an event having an impact relationship with this attribute parameter can be obtained from the event parameter set and used as the attribution event of the abnormal attribute parameter.

[0052] For example, the event parameter set can correspondingly store the event identification information of each event and the parameter identification information of the attribute parameter having an impact relationship with the event. When determining the event having an impact relationship with a certain attribute parameter, the event identification information stored corresponding to the parameter identification information of this attribute parameter can be obtained from the event parameter set, and the event corresponding to this event identification information can be used as the event having an impact relationship with this attribute parameter.

[0053] Another example is that the identification information of the event and the parameter identification information of the attribute parameter having an impact relationship with the event can have a preset mapping relationship in the event parameter set. In this case, when determining the event having an impact relationship with a certain attribute parameter, the event identification information having a preset mapping relationship with the parameter identification information of this attribute parameter can be obtained from the event parameter set, and the event corresponding to this event identification information can be used as the event having an impact relationship with this attribute parameter.

[0054] It can be understood that when the first event and the second event are repeated, the first event and the second event can be de-duplicated, and the event after de-duplication can be used as the attribution event of the abnormal attribute parameter.

[0055] In the above embodiment, the event parameter set can be pre-generated and updated when the update condition is met, so as to improve the accuracy and comprehensiveness of the change events stored in the event parameter set and the attribute parameters affected by them. In this case, optionally, the abnormal attribution method may further include: creating an event parameter set corresponding to the preset object; updating the event parameter set in response to the current condition meeting the update condition of the event parameter set. For example, the event parameter set corresponding to the preset object can be pre-generated by means of manual configuration and / or event analysis, etc., and after the generation of this event parameter set, this event parameter set can be updated based on the preset update condition of this event parameter set. Among them, the update condition of the event parameter set can be set as needed. For example, the update condition of the event parameter set can be, for example, receiving a change event, the number of received change events reaching a set number, and / or reaching the preset update period of the event parameter set, etc.

[0056] In the above embodiments, the update method of the event parameter set is not limited. Optionally, updating the event parameter set includes: determining a third event and a third attribute parameter affected by the third event, where the third event is executed after the last update of the event parameter set; analyzing the degree of influence of the third event based on the event attribute information and the event description document of the third event, and determining second degree of influence information of the third event on the third attribute parameter; and updating the event parameter set based on the third event, the third attribute parameter, and the second degree of influence information of the third event on the third attribute parameter.

[0057] Among them, the third event can be understood as an event executed after the last update of the event parameter set, such as a change event that occurs between the update time of the last update of the event parameter set and the update time of the current update (such as the current moment, etc.). The third attribute parameter can be an attribute parameter affected by the third event. The event attribute information of the third event can be understood as the attribute information of the third event, such as the change attribute information of the third event, etc. In some examples, the event attribute information of the third event can include the event level of the third event, such as the problem severity level of the problem caused by the third event, etc. The event description document of the third event can be understood as the original description document provided by the business party corresponding to the third event.

[0058] Specifically, when the current conditions meet the update conditions of the event parameter set, a change event that occurs after the last update of the event parameter set can be determined as the third event, and the third attribute parameter affected by the third event can be obtained.

[0059] For each third event, obtain the event attribute information of this third event and the event description document corresponding to this third event, and analyze the degree of influence of the third event based on this event description information and the event description document. For example, input the third event, the third attribute parameter, the event attribute information of the third event, and the event description document into a pre-trained anomaly attribution model, and analyze the degree of influence of the third event through the anomaly attribution model, and respectively determine the second degree of influence information of the third event on each third attribute parameter.

[0060] After that, the event parameter set can be updated based on the third attribute parameter and the second degree of influence information of the third event on the third attribute parameter. For example, add the event identification information of the third event and the parameter identification information of the third attribute parameter not included in the event parameter set to the event parameter set, establish an influence relationship between the third event and each third attribute parameter, and associate and store the second degree of influence information between the third event and the corresponding third attribute parameter with this influence relationship, etc.

[0061] In the above embodiments, the manner of obtaining the third event and the third attribute parameter is not limited. Optionally, determining the third event and the third attribute parameter affected by the third event includes: determining the third event and the third attribute parameter affected by the third event based on at least one of a preset event parameter document and a historical anomaly analysis document, where the preset event parameter document is used to record the preset attribute parameters affected by the preset event.

[0062] Among them, the preset event parameter document can be understood as a pre-set event parameter document. The preset event can be understood as the event recorded in the preset event parameter document. The preset attribute parameter can be understood as the attribute parameter recorded in the preset event parameter document and affected by this preset event. The preset events recorded in the preset event parameter document and the preset attribute parameters affected by them can be added and identified by business personnel. The historical anomaly analysis document can be understood as an anomaly analysis document of historical anomalies that have occurred, such as an analysis document of anomalies that occurred on the business side before and / or after the last update of the event parameter set. For example, this anomaly analysis document may record content such as anomaly descriptions, cause analyses, and / or solution methods of corresponding anomalies.

[0063] Specifically, the third event and the third attribute parameter affected by the third event can be determined based on the preset event parameter document and / or the historical anomaly analysis document. For example, obtain the updated content in the preset event parameter document after the last update of the event parameter set, such as obtaining the events updated in the preset event parameter document after the last update of the event parameter set as at least part of the third event, and taking the attribute parameters identified by business personnel in the preset event parameter document and affected by the third event as the third attribute parameter. And / or, obtain the anomaly problems that occurred after the last update of the event parameter set and the anomaly analysis document (i.e., the historical anomaly analysis document) of this anomaly problem by the business side involved in this anomaly problem, and perform event analysis based on this anomaly analysis document. For example, input this anomaly analysis document into a pre-trained anomaly attribution model, and perform event analysis through this anomaly attribution model to obtain at least part of the third event and the third attribute parameter corresponding to this at least part of the third event.

[0064] Figure 2Schematic diagram of the update process of an event parameter set provided by an embodiment of the present disclosure. In some optional implementation manners, the event parameter set can be updated regularly based on a scheduled task. For example, the scheduled task can identify historical events that caused problems regularly in combination with a preset event parameter document, and then evaluate the impact degree of the events in combination with the event description document provided by the relevant business parties, and output the specific impact degree value (i.e., impact degree information) between the specific event and the attribute parameters. For example, the impact degree evaluation of a certain historical marketing activity is 0.8, etc.; and this part of the content is supplemented to the event parameter set to achieve the regular update of the event parameter set.

[0065] Exemplarily, such as Figure 2 shown, the method provided by this embodiment can be described as:

[0066] When the update period of the event parameter set is reached, obtain the events manually marked by business personnel in the preset event parameter document and the attribute parameters affected by them within the current update period, and add them to the event parameter list to be updated; and, obtain the analysis document of the specific problems caused by the attribution of the existing attribute parameters (that is, obtain the historical exception analysis document), analyze the details, addresses, etc. of the change events that caused the exception based on this analysis document, and add the determined events and the attribute parameters affected by them to the event parameter list to be updated. Input this event parameter list and the document provided by the business party (i.e., the event description document) into the exception attribution model, and through this exception attribution model, evaluate the impact degree of the events and attribute parameters in the event parameter list, and determine the impact degree information (i.e., the second impact degree information) between the events and each attribute parameter. Update the event parameter set based on the event parameter list and the determined impact degree information.

[0067] Therefore, by adopting the above technical solution, a deep parsing and matching engine is constructed by using an exception attribution model and a machine learning algorithm. Based on the Natural Language Processing (NLP) technology, the semantic information in the text data is parsed. Through the machine learning algorithm learning a large amount of historical data and labeled samples, the potential patterns and relationships between event changes and attribute parameters are mined. Based on the domain knowledge graph (such as the event description document), the concepts, entities and their mutual relationship frameworks in the business domain are obtained to assist the parsing and matching engine to understand the complex business logic and event associations. Compared with the related technologies that rely on simple rule matching or keyword-based search technologies for parsing and matching to determine the relationship between event changes and attribute parameters, it can improve the accuracy of parsing and matching, and accurately identify the real reasons behind complex event changes and their impacts on each attribute parameter.

[0068] In this embodiment, an event parameter set related to updates can be generated in advance. The influence relationships and influence degree information between different events and different attribute parameters are recorded through this event parameter set. Therefore, when performing attribution analysis on the abnormal change of the parameter value of an abnormal attribute parameter, the attribution event of the abnormal attribute parameter can be directly determined based on this event parameter set, which can further reduce the time spent on performing attribution analysis on the abnormal change of the parameter value of the abnormal attribute parameter.

[0069] Figure 3 FIG. is a schematic flow chart of another abnormal attribution method provided by an embodiment of the present disclosure. The solution in this embodiment can be combined with one or more optional solutions in the above embodiments. Optionally, the abnormal attribution method may further include: constructing an associated attribute parameter set for at least one attribute parameter, where the at least one attribute parameter corresponds to a preset object, and the at least one attribute parameter includes the abnormal attribute parameter; obtaining the associated attribute parameter of the abnormal attribute parameter includes: obtaining the associated attribute parameter of the abnormal attribute parameter from the associated attribute parameter set of the abnormal attribute parameter.

[0070] Correspondingly, as Figure 3 shown, the abnormal attribution method provided in this embodiment may include:

[0071] S201. Construct an associated attribute parameter set for at least one attribute parameter, where the at least one attribute parameter corresponds to a preset object, and the at least one attribute parameter includes the abnormal attribute parameter.

[0072] Among them, the associated attribute parameter set of the attribute parameter can be used to store the associated attribute parameters of this attribute parameter. The storage method of each associated attribute parameter in the associated attribute parameter set is not limited. For example, each associated attribute parameter can be stored in the associated attribute parameter set in the form of an independent attribute parameter (such as the form of an element in a set, etc.) or a non-independent attribute parameter form (such as the form of an associated attribute parameter tree, etc.). This embodiment does not make any limitations in this regard.

[0073] Specifically, an associated attribute parameter set for one or more attribute parameters corresponding to a preset object can be constructed in advance. For example, for each attribute parameter that needs to perform abnormal attribution analysis when the parameter value has an abnormal change for the preset object, the correlation analysis is performed in advance between this attribute parameter and one or more other attribute parameters except this one, the associated attribute parameter of this attribute parameter is determined, and the associated attribute parameter set of this attribute parameter is constructed based on this associated attribute parameter.

[0074] In some embodiments, constructing an associated attribute parameter set for at least one attribute parameter includes: for a first attribute parameter among the at least one attribute parameter, obtaining first influence degree information of at least one second attribute parameter on the first attribute parameter, where the at least one second attribute parameter corresponds to the preset object; determining a first associated attribute parameter of the first attribute parameter from the at least one second attribute parameter according to the first influence degree information; and constructing an associated attribute parameter set of the first attribute parameter based on the first associated attribute parameter.

[0075] Among them, the first attribute parameter can be understood as the attribute parameter for which the associated attribute parameter set is currently constructed among the above at least one attribute parameter, and it can be any one of the above at least one attribute parameter. The second attribute parameter can be an attribute parameter for which the relevance between the first attribute parameter and it needs to be analyzed. The second attribute parameter can be an attribute parameter other than the first attribute parameter among the above at least one attribute parameter, or can be other attribute parameters other than the above at least one attribute parameter, and this embodiment does not limit this. The first influence degree information can be understood as the influence degree information between different attribute parameters, such as the influence degree information of the change in the parameter value of the second attribute parameter on the parameter value of the first attribute parameter, such as the influence degree value. The second influence degree information can be used to indicate the magnitude of the influence caused by the change in the parameter value of the second attribute parameter on the parameter value of the first attribute parameter. The first associated attribute parameter can be understood as the associated attribute parameter of the first attribute parameter determined based on the influence degree information of each second attribute parameter on the first attribute parameter. Exemplarily, the first associated attribute parameter can be the direct associated attribute parameter of the first attribute parameter.

[0076] Exemplarily, for each attribute parameter (such as the first attribute parameter) among the above at least one attribute parameter, first influence degree information of each second attribute parameter on this attribute parameter can be obtained. For example, the influence degree of each second attribute parameter on this attribute parameter is analyzed through a pre-trained anomaly attribution model to obtain the first influence degree information of each second attribute parameter on this attribute parameter. After obtaining the first influence degree information of each second attribute parameter on this attribute parameter, one or more second attribute parameters can be obtained as the first associated attribute parameter of this attribute parameter according to this first influence degree information. And an associated attribute parameter set of the first attribute parameter can be constructed based on the obtained first associated attribute parameter of this attribute parameter, such as constructing an associated attribute parameter set including each determined first associated attribute parameter of this attribute parameter.

[0077] In some embodiments, the first influence degree information of the second attribute parameter on the first attribute parameter can be determined according to the change trend information of the first attribute parameter and the change trend information of the second attribute parameter to further enrich the determination method of the first influence degree information.

[0078] Optionally, obtaining the first influence degree information of the at least one second attribute parameter on the first attribute parameter includes: obtaining the first historical change trend information of the first attribute parameter and the second historical change trend information of the second attribute parameter; and determining the first influence degree information of the second attribute parameter on the first attribute parameter according to the first historical change trend information and the second historical change trend information.

[0079] Among them, the first historical change trend information can be understood as the historical change trend information of the parameter value of the first attribute parameter. The second historical change trend information can be understood as the historical change trend information of the parameter value of the second attribute parameter. The first historical change trend information and / or the second historical change trend information can be presented in the form of a change trend graph and / or historical parameter values at multiple moments, and this embodiment does not limit this.

[0080] Exemplarily, the first historical change trend information of the first attribute parameter and the second historical change trend information of the second attribute parameter can be obtained, and based on this first historical change trend information and second historical change trend information, the first influence degree information of the second attribute parameter on the first attribute parameter can be determined. For example, the first historical change trend information and the second historical change trend information can be input into a pre-trained anomaly attribution model, and through this anomaly attribution model, the influence degree of the second attribute parameter on the first attribute parameter is analyzed based on the first historical change trend information and the second historical change trend information, and the first influence degree analysis of the second attribute parameter on the first attribute parameter is obtained.

[0081] In the above implementation manner, the manner of determining the first associated attribute parameter of the first attribute parameter according to the first influence degree information is not limited. Taking the first influence degree information as an influence degree value as an example, exemplarily, the second attribute parameter with an influence degree value greater than or equal to a preset influence degree threshold and / or the n (n is a positive integer) second attribute parameters with the largest influence degree values can be obtained as the first associated attribute parameter of the first attribute parameter. In some examples, the second attribute parameter with an influence degree value greater than or equal to the preset influence degree threshold can be obtained as a candidate attribute parameter. If the number of candidate attribute parameters is less than or equal to the preset number, each candidate attribute parameter is determined as the first associated attribute parameter of the first attribute parameter; if the number of candidate attribute parameters is greater than the preset number, the preset number of candidate attribute parameters can be obtained in the order of the influence degree value from large to small as the first associated attribute parameter of the first attribute parameter. Among them, n, the preset influence degree threshold, and the preset number can all be set as needed, and this embodiment does not limit this.

[0082] In the above embodiments, the associated attribute parameter set of the first attribute parameter may or may not include other associated attribute parameters other than the first associated attribute parameter of the first attribute parameter. Optionally, the associated attribute parameter set of the first attribute parameter may further include a second associated attribute parameter and / or a preset associated attribute parameter of the first attribute parameter to further improve the comprehensiveness of the associated attribute parameters of the first attribute parameter, thereby improving the accuracy of the generated anomaly attribution result. Among them, the second associated attribute parameter can be understood as the associated attribute parameter of the first associated attribute parameter, such as the indirect associated attribute parameter of the first attribute parameter. The preset associated attribute parameter can be understood as the associated attribute parameter of the first attribute parameter set in advance. The preset associated attribute parameter can be the direct associated attribute parameter and / or the indirect associated attribute parameter of the first attribute parameter, and can be specifically set by relevant personnel according to needs.

[0083] In some embodiments, constructing the associated attribute parameter set of the first attribute parameter based on the first associated attribute parameter includes: constructing an attribute parameter set including the first associated attribute parameter, at least one second associated attribute parameter, and a third associated attribute parameter as the associated attribute parameter set of the first attribute parameter, where the second associated attribute parameter is associated with the first associated attribute parameter, and the second associated attribute parameter is the preset associated attribute parameter of the first attribute parameter.

[0084] Exemplarily, the preset associated attribute parameter of the first attribute parameter can be obtained; and after determining the first associated attribute parameter of the first attribute parameter, at least some of the associated attribute parameters of the first associated attribute parameter can be obtained, such as obtaining the associated attribute parameters of the first associated attribute parameter within the preset associated hierarchy number as the second associated attribute parameter of the first attribute parameter. After that, the associated attribute parameter set of the first attribute parameter can be constructed according to the first associated attribute parameter, the second associated attribute parameter, and the preset associated attribute parameter of the first attribute parameter. For example, a tree-shaped associated attribute parameter set of the first attribute parameter can be constructed according to the above-mentioned association relationship between the attribute parameters, and so on.

[0085] In some alternative embodiments, the construction process of the associated attribute parameter set can be described as: based on the existing attribute parameter data and the inter-business association relationship, the association relationship between the attribute parameters is statistically analyzed to preliminarily determine the attribute parameters (i.e., the preset associated attribute parameters) having an association relationship with the first attribute parameter. For example, it is statistically determined that the associated attribute parameters of the attribute parameter "smoothness" include the attribute parameters "memory" and "lag", etc.

[0086] Analyze the historical change trend information of different second attribute parameters and the historical change trend information of the first attribute parameter based on the pre-trained anomaly attribution model to obtain the influence degree value (i.e., the first influence degree information) between different second attribute parameters and the first attribute parameter; eliminate the second attribute parameters with influence degree values less than the preset influence degree threshold; recursively determine the associated attribute parameters whose influence relationship level with the first attribute parameter is within the preset number of levels (such as 4 levels or 5 levels, etc.), such as by analyzing the influence links and transmission mechanisms of the first attribute parameter on the business process, and finding the direct associated attribute parameters (i.e., the first associated attribute parameters) and indirect associated attribute parameters (i.e., the second associated attribute parameters) of the first attribute parameter.

[0087] Thus, based on the mapping system corresponding model (such as the anomaly attribution model) in the business domain, construct an associated attribute parameter mapping system. This system determines the direct associated attribute parameters and indirect associated attribute parameters by analyzing the influence paths of attribute parameters on different business processes and links, and can use a quantitative model (i.e., the anomaly attribution model, such as the regression analysis model, Bayesian network model, etc.) to calculate the influence weight and quantitative value (i.e., the first influence degree information) of the change of the associated attribute parameter on this attribute parameter, so as to achieve accurate mapping between different attribute parameters, which can facilitate the analysis of the effect of the associated attribute parameters of the attribute parameter in the system and better perform attribute parameter detection and modeling.

[0088] S202. In response to the existence of an abnormal attribute parameter in the preset object, obtain the associated attribute parameter of the abnormal attribute parameter from the set of associated attribute parameters of the abnormal attribute parameter, and the parameter value of the abnormal attribute parameter changes abnormally.

[0089] In this embodiment, in the case of detecting an abnormal attribute parameter with an abnormal change in the parameter value of the preset object, the set of associated attribute parameters of this abnormal attribute parameter can be obtained, and each associated attribute parameter included in this set of associated attribute parameters is used as the associated attribute parameter of this abnormal attribute parameter.

[0090] S203. Determine the attribution event information of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, and the attribution event corresponding to the attribution event information is associated with the abnormal change in the parameter value of the abnormal attribute parameter.

[0091] S204. Generate an anomaly attribution result for the abnormal attribute parameter based on the attribution event information.

[0092] In some embodiments, the abnormal attribution result of the abnormal attribute parameter may include the importance degree information of each associated attribute parameter to the abnormal attribute parameter. For example, when presenting the abnormal attribution result of the abnormal attribute parameter to relevant personnel, the importance degree information of each associated attribute parameter of the abnormal attribute parameter to this abnormal attribute parameter may be further presented, so as to facilitate the relevant personnel to view.

[0093] Among them, the determination method of this importance degree information is not limited. For example, according to the preset importance degree determination method, the importance degree information of this associated attribute parameter to the abnormal attribute parameter can be determined based on the historical influence degree information of the associated attribute parameter on this abnormal attribute parameter, the influence degree information between the associated attribute parameter and this abnormal attribute parameter, the historical influence parameter information of the associated attribute parameter, and / or the historical attribution contribution times information of the event corresponding to the associated attribute parameter for the abnormal attribute parameter, etc. This embodiment does not limit this.

[0094] The abnormal attribution method provided in this embodiment determines the associated attribute parameter of the abnormal attribute parameter based on the pre-constructed set of associated attribute parameters, which can further improve the determination speed of the associated attribute parameter, and then improve the abnormal attribution speed of the abnormal attribute parameter.

[0095] Figure 4 It is a structural block diagram of an abnormal attribution device provided in an embodiment of the present disclosure. This device can be implemented by software and / or hardware, and can be configured in an electronic device. Typically, it can be configured in a computer, a mobile phone or a tablet computer, and can attribute the abnormal change of the parameter value of the attribute parameter by executing the abnormal attribution method. As Figure 4 shown, the abnormal attribution device provided in this embodiment may include: a parameter acquisition module 401, an event determination module 402, and a result generation module 403, where

[0096] The parameter acquisition module 401 is configured to obtain the associated attribute parameter of the abnormal attribute parameter in response to the existence of an abnormal attribute parameter in a preset object, and the parameter value of the abnormal attribute parameter has an abnormal change;

[0097] The event determination module 402 is configured to determine the attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, and the attribution event is associated with the abnormal change of the parameter value of the abnormal attribute parameter;

[0098] The result generation module 403 is configured to generate an abnormal attribution result of the abnormal attribute parameter based on the attribution event.

[0099] The abnormal attribution device provided in this embodiment obtains the associated attribute parameters of this abnormal attribute parameter through the parameter acquisition module in response to the abnormal attribute parameter with abnormal change in the parameter value of the preset object; the event determination module determines the attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameters of the abnormal attribute parameter, and this attribution event is associated with the abnormal change in the parameter value of the abnormal attribute parameter; the result generation module generates the abnormal attribution result of the abnormal attribute parameter based on this attribution event. By using the above technical solution, this embodiment determines the attribution event that causes the abnormal change in the parameter value of the abnormal attribute parameter based on the abnormal attribute parameter and the associated attribute parameters of the abnormal attribute parameter. Compared with the technical solution of manually performing attribution analysis on the abnormal change in the parameter value of the abnormal attribute parameter, it can reduce the time spent on attribution analysis of the abnormal change in the parameter value, improve the comprehensiveness of the determined attribution event, and the accuracy of the attribution result of the abnormal change in the parameter value.

[0100] Further, the abnormal attribution device may further include: a parameter set construction module, configured to construct an associated attribute parameter set of at least one attribute parameter, where the at least one attribute parameter corresponds to the preset object, and the at least one attribute parameter includes the abnormal attribute parameter; the parameter acquisition module 401 is specifically configured to: obtain the associated attribute parameters of the abnormal attribute parameter from the associated attribute parameter set of the abnormal attribute parameter.

[0101] Optionally, the parameter set construction module includes: a first influence degree determination unit, configured to obtain, for a first attribute parameter among the at least one attribute parameter, first influence degree information of at least one second attribute parameter on the first attribute parameter, where the at least one second attribute parameter corresponds to the preset object; a first attribute parameter determination unit, configured to determine, according to the first influence degree information, a first associated attribute parameter of the first attribute parameter from the at least one second attribute parameter; a parameter set construction unit, configured to construct an associated attribute parameter set of the first attribute parameter based on the first associated attribute parameter.

[0102] Optionally, the first influence degree determination unit is specifically configured to: obtain first historical change trend information of the first attribute parameter and second historical change trend information of the second attribute parameter; determine the first influence degree information of the second attribute parameter on the first attribute parameter according to the first historical change trend information and the second historical change trend information.

[0103] Optionally, the parameter set construction unit may specifically be configured to: construct an attribute parameter set including the first associated attribute parameter, at least one second associated attribute parameter, and a third associated attribute parameter as the associated attribute parameter set of the first attribute parameter, where the second associated attribute parameter is associated with the first associated attribute parameter, and the second associated attribute parameter is a preset associated attribute parameter of the first attribute parameter.

[0104] Optionally, the event determination module 402 may specifically be configured to: determine a first event and a second event based on an event parameter set as the attribution event information of the abnormal attribute parameter, where the event parameter set is used to record the influence relationship and the second influence degree information between different events and different attribute parameters, the first event corresponds to the abnormal attribute parameter, and the second event corresponds to the associated attribute parameter of the abnormal attribute parameter.

[0105] Further, the abnormal attribution device may further include: a parameter set creation module, configured to create an event parameter set corresponding to the preset object; and a parameter set update module, configured to update the event parameter set when the current condition meets the update condition of the event parameter set.

[0106] Optionally, the parameter set update module includes: a second attribute parameter determination unit, configured to determine a third event and a third attribute parameter affected by the third event, where the third event is executed after the last update of the event parameter set; a second influence degree determination unit, configured to perform an influence degree analysis on the third event according to the event attribute information and the event description document of the third event, and determine the second influence degree information of the third event on the third attribute parameter; and a parameter set update unit, configured to update the event parameter set based on the third event, the third attribute parameter, and the second influence degree information of the third event on the third attribute parameter.

[0107] Optionally, the second attribute parameter determination unit may specifically be configured to: determine a third event and a third attribute parameter affected by the third event based on at least one of a preset event parameter document and a historical abnormal analysis document, where the preset event parameter document is used to record preset attribute parameters affected by preset events.

[0108] The abnormal attribution device provided in the embodiments of the present disclosure may execute the abnormal attribution method provided in any embodiment of the present disclosure, and has corresponding functional modules and beneficial effects for executing the abnormal attribution method. For technical details not described in detail in this embodiment, reference may be made to the abnormal attribution method provided in any embodiment of the present disclosure.

[0109] Next, refer to Figure 5, which shows a schematic structural diagram of an electronic device (such as a server) 500 suitable for implementing the embodiments of the present disclosure. The terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Tablet Computers), PMPs (Portable Multimedia Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is merely an example and should not impose any limitation on the functions and scope of use of the embodiments of the present disclosure.

[0110] As Figure 5 shown, the electronic device 500 may include a processing device (such as a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 502 or the program loaded from the storage device 508 into the random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. The input / output (I / O) interface 505 is also connected to the bus 504.

[0111] Generally, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 509. The communication device 509 can allow the electronic device 500 to communicate with other devices wirelessly or wiredly to exchange data. Although Figure 5 shows the electronic device 500 having various devices, it should be understood that it is not required to implement or include all the shown devices. More or fewer devices may be implemented or included alternatively.

[0112] Particularly, according to the embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments of the present disclosure include a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program codes for executing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 509, or installed from the storage device 508, or installed from the ROM 502. When the computer program is executed by the processing device 501, the above-mentioned functions defined in the methods of the embodiments of the present disclosure are executed.

[0113] It should be noted that the computer-readable medium described above in the present disclosure can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of the computer-readable storage medium can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, the computer-readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present disclosure, the computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0114] In some embodiments, the client and the server can communicate using any currently known or future-developed network protocol such as HTTP (HyperText Transfer Protocol), and can be interconnected with digital data communication in any form or medium (e.g., a communication network). Examples of communication networks include local area networks ("LANs"), wide area networks ("WANs"), the Internet (e.g., the Internet), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any currently known or future-developed networks.

[0115] The above computer-readable medium can be included in the above electronic device; or it can exist separately without being assembled into the electronic device.

[0116] The above computer-readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: in response to a preset object having an abnormal attribute parameter, obtain an associated attribute parameter of the abnormal attribute parameter, where the abnormal attribute parameter has an abnormal change in parameter value; determine, based on the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, an attribution event of the abnormal attribute parameter, where the attribution event is associated with the abnormal change in the parameter value of the abnormal attribute parameter; and generate an abnormal attribution result of the abnormal attribute parameter based on the attribution event.

[0117] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages or combinations thereof. The programming languages include, but are not limited to, object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may execute entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0118] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code that contains one or more executable instructions for implementing a specified logical function. It should also be noted that, in some alternative implementations, the functions denoted by the blocks may occur in a different order than that denoted in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, or they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based system for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0119] The units described in the embodiments of the present disclosure may be implemented in software or in hardware. In some cases, the name of the module does not constitute a limitation on the unit itself.

[0120] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that can be used include: Field Programmable Gate Arrays (FPGAs), Application Specific Integrated Circuits (ASICs), Application Specific Standard Products (ASSPs), Systems on Chip (SOCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0121] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media would include electrical connections based on one or more wires, portable computer disks, hard disks, Random Access Memory (RAM), Read Only Memory (ROM), Erasable Programmable Read Only Memory (EPROM or Flash Memory), optical fibers, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0122] According to one or more embodiments of the present disclosure, Example 1 provides an anomaly attribution method, including:

[0123] In response to a preset object having an abnormal attribute parameter, obtain an associated attribute parameter of the abnormal attribute parameter, where the abnormal attribute parameter has an abnormal change in parameter value;

[0124] According to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, determine an attribution event of the abnormal attribute parameter, where the attribution event is associated with the abnormal change in the parameter value of the abnormal attribute parameter;

[0125] Generate an anomaly attribution result of the abnormal attribute parameter based on the attribution event.

[0126] According to one or more embodiments of the present disclosure, Example 2 according to the method of Example 1, the method further includes:

[0127] Construct an associated attribute parameter set of at least one attribute parameter, where the at least one attribute parameter corresponds to the preset object, and the at least one attribute parameter includes the abnormal attribute parameter;

[0128] The obtaining of the associated attribute parameter of the abnormal attribute parameter includes:

[0129] Obtain the associated attribute parameter of the abnormal attribute parameter from the set of associated attribute parameters of the abnormal attribute parameter.

[0130] According to one or more embodiments of the present disclosure, Example 3 According to the method described in Example 2, the constructing the set of associated attribute parameters of at least one attribute parameter includes:

[0131] For a first attribute parameter among the at least one attribute parameter, obtain information on the first degree of influence of at least one second attribute parameter on the first attribute parameter, where the at least one second attribute parameter corresponds to the preset object;

[0132] According to the first degree of influence information, determine the first associated attribute parameter of the first attribute parameter from the at least one second attribute parameter;

[0133] Construct the set of associated attribute parameters of the first attribute parameter based on the first associated attribute parameter.

[0134] According to one or more embodiments of the present disclosure, Example 4 According to the method described in Example 3, the obtaining information on the first degree of influence of at least one second attribute parameter on the first attribute parameter includes:

[0135] Obtain the first historical change trend information of the first attribute parameter and the second historical change trend information of the second attribute parameter;

[0136] According to the first historical change trend information and the second historical change trend information, determine the first degree of influence information of the second attribute parameter on the first attribute parameter.

[0137] According to one or more embodiments of the present disclosure, Example 5 According to the method described in Example 3, the constructing the set of associated attribute parameters of the first attribute parameter based on the first associated attribute parameter includes:

[0138] Construct a set of attribute parameters including the first associated attribute parameter, at least one second associated attribute parameter, and a third associated attribute parameter as the set of associated attribute parameters of the first attribute parameter, where the second associated attribute parameter is associated with the first associated attribute parameter, and the second associated attribute parameter is a preset associated attribute parameter of the first attribute parameter.

[0139] According to one or more embodiments of the present disclosure, Example 6 According to the method described in any one of Examples 1-5, the determining the attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter includes:

[0140] Determine a first event and a second event based on an event parameter set as attribution event information of the abnormal attribute parameter, where the event parameter set is used to record the influence relationship and second influence degree information between different events and different attribute parameters, the first event corresponds to the abnormal attribute parameter, and the second event corresponds to the associated attribute parameter of the abnormal attribute parameter.

[0141] According to one or more embodiments of the present disclosure, Example 7 According to the method described in Example 6, the method further includes:

[0142] Create an event parameter set corresponding to the preset object;

[0143] When the current condition satisfies the update condition of the event parameter set, update the event parameter set.

[0144] According to one or more embodiments of the present disclosure, Example 8 According to the method described in Example 7, the updating of the event parameter set includes:

[0145] Determine a third event and a third attribute parameter affected by the third event, where the third event is executed after the event parameter set was last updated;

[0146] According to the event attribute information and event description document of the third event, perform an impact degree analysis on the third event to determine the second impact degree information of the third event on the third attribute parameter;

[0147] Based on the third event, the third attribute parameter, and the second impact degree information of the third event on the third attribute parameter, update the event parameter set.

[0148] According to one or more embodiments of the present disclosure, Example 9 According to the method described in Example 8, the determining of the third event and the third attribute parameter affected by the third event includes:

[0149] Based on at least one of a preset event parameter document and a historical abnormal analysis document, determine the third event and the third attribute parameter affected by the third event, where the preset event parameter document is used to record the preset attribute parameters affected by the preset event.

[0150] According to one or more embodiments of the present disclosure, Example 10 provides an abnormal attribution device, including:

[0151] A parameter acquisition module, configured to, in response to an abnormal attribute parameter existing for a preset object, acquire an associated attribute parameter of the abnormal attribute parameter, where the abnormal attribute parameter has an abnormal change in parameter value;

[0152] An event determination module, configured to determine an attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and an associated attribute parameter of the abnormal attribute parameter, where the attribution event is associated with an abnormal change in the parameter value of the abnormal attribute parameter;

[0153] A result generation module, configured to generate an abnormal attribution result of the abnormal attribute parameter based on the attribution event.

[0154] According to one or more embodiments of the present disclosure, Example 11 provides an electronic device, including:

[0155] One or more processors;

[0156] A memory, configured to store one or more programs,

[0157] When the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal attribution method according to any one of Examples 1-9.

[0158] According to one or more embodiments of the present disclosure, Example 12 provides a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, it implements the abnormal attribution method according to any one of Examples 1-9.

[0159] According to one or more embodiments of the present disclosure, Example 13 provides a computer program product, and when the computer program product is executed by a computer, the computer implements the abnormal attribution method according to any one of Examples 1-9.

[0160] The above description is only a preferred embodiment of the present disclosure and an explanation of the applied technical principles. Those skilled in the art should understand that the scope of the disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosure concept. For example, the technical solutions formed by mutually replacing the above features with the (but not limited to) technical features having similar functions disclosed in the present disclosure.

[0161] In addition, although the operations are depicted in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, the various features described in the context of a single embodiment may also be implemented separately or in any suitable sub-combination in multiple embodiments.

[0162] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. On the contrary, the specific features and acts described above are merely example forms for implementing the claims.

Claims

1. An abnormal attribution method, characterized in that, Including: In response to an abnormal attribute parameter of a preset object, obtain an associated attribute parameter of the abnormal attribute parameter, where the abnormal attribute parameter has an abnormal change in parameter value; Determine an attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, where the attribution event is associated with the abnormal change in the parameter value of the abnormal attribute parameter; Generate an abnormal attribution result of the abnormal attribute parameter based on the attribution event.

2. The method according to claim 1, characterized in that, The method further includes: Construct an associated attribute parameter set of at least one attribute parameter, where the at least one attribute parameter corresponds to the preset object, and the at least one attribute parameter includes the abnormal attribute parameter; The obtaining the associated attribute parameter of the abnormal attribute parameter includes: Obtain the associated attribute parameter of the abnormal attribute parameter from the associated attribute parameter set of the abnormal attribute parameter.

3. The method according to claim 2, wherein The constructing the associated attribute parameter set of at least one attribute parameter includes: For a first attribute parameter among the at least one attribute parameter, obtain first influence degree information of at least one second attribute parameter on the first attribute parameter, where the at least one second attribute parameter corresponds to the preset object; Determine a first associated attribute parameter of the first attribute parameter from the at least one second attribute parameter according to the first influence degree information; Construct an associated attribute parameter set of the first attribute parameter based on the first associated attribute parameter.

4. The method according to claim 3, wherein The obtaining the first influence degree information of at least one second attribute parameter on the first attribute parameter includes: Obtain first historical change trend information of the first attribute parameter and second historical change trend information of the second attribute parameter; Determine the first influence degree information of the second attribute parameter on the first attribute parameter according to the first historical change trend information and the second historical change trend information.

5. The method according to claim 3, characterized in that, The constructing the associated attribute parameter set of the first attribute parameter based on the first associated attribute parameter includes: Construct an attribute parameter set including the first associated attribute parameter, at least one second associated attribute parameter, and a third associated attribute parameter as the associated attribute parameter set of the first attribute parameter, where the second associated attribute parameter is associated with the first associated attribute parameter, and the second associated attribute parameter is a preset associated attribute parameter of the first attribute parameter.

6. The method according to any one of claims 1-5, characterized in that, The determining the attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter includes: Determine a first event and a second event based on an event parameter set as attribution event information of the abnormal attribute parameter, where the event parameter set is used to record the influence relationship and second influence degree information between different events and different attribute parameters, the first event corresponds to the abnormal attribute parameter, and the second event corresponds to the associated attribute parameter of the abnormal attribute parameter.

7. The method according to claim 6, characterized in that, The method further includes: Create an event parameter set corresponding to the preset object; When the current condition satisfies the update condition of the event parameter set, update the event parameter set.

8. The method according to claim 7, characterized in that The updating the event parameter set includes: Determine a third event and a third attribute parameter affected by the third event, where the third event is executed after the last update of the event parameter set; Based on the event attribute information and the event description document of the third event, analyze the degree of influence of the third event, and determine the second degree of influence information of the third event on the third attribute parameter; Update the event parameter set based on the third event, the third attribute parameter, and the second degree of influence information of the third event on the third attribute parameter.

9. The method according to claim 8, wherein The determination of the third event and the third attribute parameter affected by the third event includes: Based on at least one of a preset event parameter document and a historical anomaly analysis document, determine a third event and a third attribute parameter affected by the third event, where the preset event parameter document is used to record preset attribute parameters affected by preset events.

10. An abnormal attribution device, characterized in that, Including: A parameter acquisition module, configured to, in response to an abnormal attribute parameter existing in a preset object, acquire an associated attribute parameter of the abnormal attribute parameter, where the abnormal attribute parameter has an abnormal change in the parameter value; An event determination module, configured to determine an attribution event of the abnormal attribute parameter according to the abnormal attribute parameter and the associated attribute parameter of the abnormal attribute parameter, where the attribution event is associated with the abnormal change in the parameter value of the abnormal attribute parameter; A result generation module, configured to generate an abnormal attribution result of the abnormal attribute parameter based on the attribution event.

11. An electronic device, characterized in that, Including: At least one processor; And A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor is enabled to execute the abnormal attribution method according to any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the abnormal attribution method according to any one of claims 1-9 is implemented.

13. A computer program product, characterized in that, The computer program product includes a computer program, and when the computer program is executed by a processor, the abnormal attribution method according to any one of claims 1-9 is implemented.

Images