A fault prediction method and device, a fault prediction model training method and device, a computing device, a computer storage medium, and a computer program product

Abstract

The embodiment of the present specification provides a fault prediction method and device, a fault prediction model training method and device, a computing device, a computer storage medium, and a computer program product. The fault prediction method is applied to a cloud computing system, the cloud computing system includes a service processing unit, and the fault prediction method includes the following steps. Abnormal log data of the service processing unit and log acquisition time of the abnormal log data are obtained. According to the abnormal log data and the log acquisition time, an abnormal event sequence and an abnormal timestamp sequence are determined. According to a time interval threshold and an abnormal occurrence time corresponding to an abnormal event in the abnormal event sequence, the abnormal event is grouped to obtain an abnormal grouping sequence. According to the abnormal event sequence, the abnormal timestamp sequence and the abnormal grouping sequence, a fault prediction model is used to obtain a fault prediction result of the service processing unit. The abnormal log data is analyzed from multiple dimensions, the accuracy of the fault prediction model is improved, and the stability of the cloud computing system is improved.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of computer technology, and in particular to fault prediction methods and apparatus, fault prediction model training methods and apparatus, computing devices, computer storage media, and computer program products. Background Technology

[0002] Cloud computing systems can centrally manage and use servers, thereby improving the efficiency of computing resource utilization. However, server downtime can reduce the stability of cloud computing systems and, in severe cases, lead to the loss of user information and affect the user experience. Therefore, the key to solving this problem is to predict downtime in advance and perform maintenance based on abnormal server log data.

[0003] Because existing natural language processing (NLP) methods do not use corpora containing real-time information, and anomaly log data contains various types of anomalies with non-fixed time intervals, analyzing anomaly log data using NLP methods can easily lead to the neglect or misjudgment of time-related information in the anomaly log data. Therefore, it is difficult to accurately predict server downtime using NLP methods, which is not conducive to maintaining the stability of cloud computing systems. Summary of the Invention

[0004] In view of this, embodiments of this specification provide a fault prediction method. One or more embodiments of this specification also relate to a fault prediction device, a fault prediction model training method, a fault prediction model training device, a computing device, a computer-readable storage medium, and a computer program product, to address the technical deficiencies existing in the prior art.

[0005] According to a first aspect of the embodiments of this specification, a fault prediction method is provided, applied to a cloud computing system, the cloud computing system including a service processing unit, the method comprising:

[0006] Obtain the exception log data of the service processing unit and the log acquisition time of the exception log data;

[0007] Based on the abnormal log data and the log acquisition time, determine the abnormal event sequence and the abnormal timestamp sequence;

[0008] Based on the time interval threshold and the occurrence time of the abnormal events corresponding to the abnormal events in the abnormal event sequence, the abnormal events are grouped to obtain an abnormal grouping sequence;

[0009] Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, the fault prediction result of the service processing unit is obtained using a fault prediction model.

[0010] According to a second aspect of the embodiments of this specification, a fault prediction apparatus is provided, applied to a cloud computing system, the cloud computing system including a service processing unit, the apparatus comprising:

[0011] The data acquisition module is configured to acquire the exception log data of the service processing unit and the log acquisition time of the exception log data;

[0012] The sequence determination module is configured to determine the sequence of abnormal events and the sequence of abnormal timestamps based on the abnormal log data and the log acquisition time.

[0013] The sequence acquisition module is configured to group the abnormal events according to a time interval threshold and the abnormal occurrence time corresponding to the abnormal events in the abnormal event sequence, and obtain an abnormal grouping sequence.

[0014] The result acquisition module is configured to obtain the fault prediction result of the service processing unit based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, using a fault prediction model.

[0015] According to a third aspect of the embodiments of this specification, a fault prediction model training method is provided, applied to a cloud computing system, the cloud computing system including a service processing unit, the method comprising:

[0016] Obtain the sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data;

[0017] Based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data, determine the sample anomaly event sequence and the sample anomaly timestamp sequence;

[0018] Based on the time interval threshold and the occurrence time of the sample anomaly corresponding to the sample anomaly in the sample anomaly sequence, the sample anomaly events are grouped to obtain a sample anomaly grouping sequence.

[0019] Based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence, positive and negative samples are determined.

[0020] A fault prediction model is trained based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

[0021] According to a fourth aspect of the embodiments of this specification, a fault prediction model training apparatus is provided, applied to a cloud computing system, the cloud computing system including a service processing unit, the apparatus comprising:

[0022] The data acquisition module is configured to acquire sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data;

[0023] The sequence determination module is configured to determine the sample abnormal event sequence and the sample abnormal timestamp sequence based on the sample abnormal log data and the sample log acquisition time of the sample abnormal log data.

[0024] The sequence acquisition module is configured to group the sample abnormal events according to the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormal event in the sample abnormal event sequence, and obtain a sample abnormality grouping sequence.

[0025] The sample determination module is configured to determine positive and negative samples based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence.

[0026] The training module is configured to train a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

[0027] According to a fifth aspect of the embodiments of this specification, a computing device is provided, comprising:

[0028] Memory and processor;

[0029] The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer programs / instructions are executed by the processor, they implement the steps of the above-mentioned fault prediction method or fault prediction model training method.

[0030] According to a sixth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores a computer program / instructions that, when executed by a processor, implement the steps of the above-described fault prediction method or fault prediction model training method.

[0031] According to a seventh aspect of the embodiments of this specification, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described fault prediction method or fault prediction model training method.

[0032] This specification provides a fault prediction method according to one embodiment, applied to a cloud computing system. The cloud computing system includes a service processing unit. The method includes: acquiring abnormal log data of the service processing unit and the log acquisition time of the abnormal log data; determining an abnormal event sequence and an abnormal timestamp sequence based on the abnormal log data and the log acquisition time; grouping the abnormal events according to a time interval threshold and the abnormal occurrence time corresponding to the abnormal events in the abnormal event sequence to obtain an abnormal grouping sequence; and obtaining a fault prediction result of the service processing unit using a fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence.

[0033] Based on this, the fault prediction method determines the sequence of abnormal events and the sequence of abnormal timestamps by acquiring abnormal log data from the service processing unit and the log acquisition time of the abnormal log data; and groups the abnormal events by the time interval of the abnormal events to obtain the abnormal group sequence. When abnormal events occurring at similar times are more correlated, by inputting the abnormal event sequence, the abnormal timestamp sequence, and the abnormal group sequence into the fault prediction model, the fault prediction model can analyze the abnormal log data from multiple dimensions, obtain the event correlation and time correlation between the abnormal log data, thereby improving the accuracy and recall rate of fault prediction, enabling the cloud computing system to predict downtime in advance and perform timely maintenance, reduce the downtime rate, and improve the stability of the cloud computing system. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of a scenario for a fault prediction method provided in one embodiment of this specification;

[0035] Figure 2 This is a flowchart of a fault prediction method provided in one embodiment of this specification;

[0036] Figure 3 This is a flowchart of a fault prediction model training method provided in one embodiment of this specification;

[0037] Figure 4 This is a flowchart illustrating the processing steps of a fault prediction model training method provided in one embodiment of this specification.

[0038] Figure 5 This is a schematic diagram of a data preprocessing procedure provided in one embodiment of this specification;

[0039] Figure 6 This is a schematic diagram of an encoding mapping process provided in one embodiment of this specification;

[0040] Figure 7This is a schematic diagram of the structure of a fault prediction device provided in one embodiment of this specification;

[0041] Figure 8 This is a schematic diagram of the structure of a fault prediction model training device provided in one embodiment of this specification;

[0042] Figure 9 This is a structural block diagram of a computing device provided in one embodiment of this specification. Detailed Implementation

[0043] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0044] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of the one or more embodiments of this specification. The singular forms “a,” “described,” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0045] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0046] Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Moreover, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0047] In one or more embodiments of this specification, a large model refers to a deep learning model with a large number of model parameters, typically containing hundreds of millions, tens of billions, hundreds of billions, trillions, or even tens of trillions of model parameters. A large model can also be called a foundation model. It is pre-trained using large-scale unlabeled corpora to produce a pre-trained model with hundreds of millions of parameters. Such models can adapt to a wide range of downstream tasks and have good generalization ability. Examples include Large Language Models (LLMs) and multi-modal pre-training models.

[0048] In practical applications, large models only require a small number of samples to fine-tune the pre-trained model before they can be applied to different tasks. Large models can be widely used in fields such as Natural Language Processing (NLP) and Computer Vision. Specifically, they can be applied to computer vision tasks such as Visual Question Answering (VQA), Image Captioning (IC), and Image Generation, as well as NLP tasks such as text-based sentiment classification, text summarization, and machine translation. The main application scenarios for large models include digital assistants, intelligent robots, search, online education, office software, e-commerce, and intelligent design.

[0049] First, the terms and concepts used in one or more embodiments of this specification will be explained.

[0050] Attention: An attention mechanism that can be used to devote more attentional resources to the target area of ​​focus in order to obtain more detailed information about the target that needs attention and suppress other useless information. In the embodiments of this specification, it is used to mine the correlation information between elements in the sequence.

[0051] Transformer: An attention-based machine learning model commonly used in natural language processing and image processing tasks.

[0052] NC: Node Controller, refers to a single unit in a cloud computing system used for statistical analysis of failures and downtime. In the embodiments described in this specification, it can be understood as a service processing unit.

[0053] This specification provides a fault prediction method, and also relates to a fault prediction method apparatus, a fault prediction model training method, a fault prediction model training apparatus, a computing device, a computer-readable storage medium, and a computer program product, which will be described in detail in the following embodiments.

[0054] See Figure 1 , Figure 1 A schematic diagram illustrating an application scenario of a fault prediction method provided according to an embodiment of this specification is shown.

[0055] The fault prediction method can be applied to cloud computing systems, involving cloud computing platform 102 and cloud computing server cluster 104.

[0056] Specifically, the cloud computing platform 102 can obtain abnormal log data from each server in the cloud computing server cluster 104 and determine the log acquisition time of the abnormal log data. For example, for a certain server, the abnormal log data is processed according to the server's abnormal log data and the log acquisition time to obtain an abnormal event sequence corresponding to the abnormal information in the abnormal log data, and an abnormal timestamp sequence related to the abnormal occurrence time of the abnormal information. The abnormal events are then grouped using a time interval threshold and the abnormal events in the abnormal event sequence and their corresponding abnormal occurrence times to obtain an abnormal grouping sequence. Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, a fault prediction model is used to obtain the fault prediction result for the server.

[0057] In practical applications, when performing fault prediction, the cloud computing platform 102 can acquire real-time abnormal log data. The abnormal log data can be obtained by sampling each server on the real-time link at a preset time interval, such as 5 minutes. Then, based on the fault prediction model, it can predict whether each server will experience a downtime failure. Based on the fault prediction results, it can decide whether to perform maintenance on the server downtime failure in advance to achieve user non-disclosure of downtime and thus optimize the user experience.

[0058] The fault prediction results include downtime results and no downtime results. Downtime results refer to the judgment that the server is at risk of downtime in the future. In this case, maintenance can be carried out in advance to make the downtime inconspicuous to users. No downtime results refer to the judgment that the server is not at risk of downtime in the future. In this case, no operation can be performed temporarily.

[0059] The cloud computing platform 102 can be understood as a service based on hardware and software resources, providing computing, networking, and storage capabilities. In the embodiments of this specification, it is used to provide fault prediction services, predicting whether the server will crash by obtaining abnormal log data of the server.

[0060] The servers in cloud computing server cluster 104 can be understood as servers that provide various services, including physical servers and cloud servers. For example, servers that provide communication services for multiple clients, servers that support the models used on the clients for background training, and servers that process the data sent by the clients, etc.

[0061] The fault prediction method provided in the embodiments of this specification can make full use of the event, time and grouping information in the abnormal log data. By grouping abnormal events that occur consecutively at similar times into a group, the event information can be better integrated using time information, and higher-level sequence features can be extracted. This improves the accuracy and recall of fault prediction, enabling cloud computing systems to perform maintenance on servers that are about to crash more quickly and accurately, thereby reducing the downtime rate or reducing the losses caused by downtime to users, and greatly increasing the stability and reliability of cloud computing systems.

[0062] See Figure 2 , Figure 2 A flowchart of a fault prediction method provided in one embodiment of this specification is shown, which specifically includes the following steps.

[0063] Step 202: Obtain the exception log data of the service processing unit and the log acquisition time of the exception log data.

[0064] The service processing unit can be understood as NC, which is the server in the above embodiment; the exception log data includes exception information and the exception occurrence time corresponding to the exception information; the exception information can be understood as the raw record information in the service processing unit that has not been processed, formatted or compressed. This exception information usually contains detailed error, warning and debugging information, and records all activity details in the process of the service processing unit running; the exception occurrence time corresponding to the exception information can be understood as the timestamp of the exception information, which records the occurrence time corresponding to each exception information.

[0065] Log retrieval time can be understood as the time it takes to retrieve exception log data from the service processing unit.

[0066] Specifically, the detector can be used to continuously monitor the operation of the service processing unit, and when the service processing unit has an anomaly or error, it can record and capture the relevant anomaly log data.

[0067] In one or more embodiments of this specification, to obtain an initial exception log, the initial log data can be sorted according to the exception occurrence time corresponding to the initial exception information, thereby obtaining exception log data arranged in order according to the exception occurrence time corresponding to the initial exception information. The specific implementation method is as follows:

[0068] The step of obtaining the exception log data of the service processing unit includes:

[0069] Obtain the initial exception log data of the service processing unit, wherein the initial exception log data includes initial exception information and the exception occurrence time corresponding to the initial exception information;

[0070] Based on the time of occurrence of the initial anomaly information, the initial anomaly log data is sorted using the preset sorting rules, and the anomaly log data is obtained based on the sorted initial anomaly log data.

[0071] Initial exception log data can be understood as out-of-order exceptions obtained from the service processing unit; preset sorting rules can be understood as pre-set rules for sorting according to the exception occurrence time corresponding to the initial exception information. This can be sorting from earliest to latest according to the exception occurrence time corresponding to the initial exception information, or sorting from latest to earliest according to the exception occurrence time corresponding to the initial exception information.

[0072] Specifically, the initial exception log data of the service processing unit is obtained, parsed, and the initial exception information and corresponding exception occurrence time are extracted. The initial exception log data is then sorted according to a preset sorting rule (such as sorting the exception occurrence time corresponding to the initial exception information from latest to earliest). This ensures that the initial exception log data is arranged in an orderly manner according to the order of exception occurrence time. After sorting, the resulting ordered initial exception log data is the exception log data, which shows the exception situations encountered by the service processing unit and their specific occurrence times in chronological order.

[0073] The fault prediction method provided in the embodiments of this specification sorts the initial abnormal log data according to the time of occurrence of the initial abnormal information to obtain time-ordered abnormal log data, thereby obtaining the abnormal event sequence, abnormal timestamp sequence and abnormal grouping sequence more quickly based on the time-ordered abnormal log data.

[0074] Step 204: Determine the abnormal event sequence and the abnormal timestamp sequence based on the abnormal log data and the log acquisition time.

[0075] Among them, the abnormal event sequence can be understood as a sequence containing semantic information of abnormal log data; the abnormal timestamp sequence can be understood as a sequence containing temporal information of abnormal log data.

[0076] Specifically, the abnormal log data in the service processing unit is analyzed and processed to obtain abnormal event sequences and abnormal timestamp sequences. Then, when the abnormal event sequences and abnormal timestamp sequences are input into the fault prediction model, the semantic and temporal information contained in the abnormal log data is extracted.

[0077] In one or more embodiments of this specification, to ensure that the abnormal event sequence contains semantic information of the abnormal log data, and the abnormal timestamp sequence contains temporal information of the abnormal log data, the abnormal event sequence is determined based on the abnormal information in the abnormal log data; the abnormal timestamp sequence is determined based on the time of the abnormal occurrence. The specific implementation is as follows:

[0078] The step of determining the abnormal event sequence and the abnormal timestamp sequence based on the abnormal log data and the log acquisition time includes:

[0079] The sequence of abnormal events is determined based on the abnormal information in the abnormal log data;

[0080] Based on the time of occurrence of the anomaly information, determine the time of occurrence of the anomaly corresponding to the anomaly event in the anomaly event sequence;

[0081] The abnormal timestamp sequence is determined based on the time of the abnormality occurrence and the time of log acquisition.

[0082] Among them, an abnormal event can be understood as data after abstracting abnormal information, which is used to simplify complex abnormal information; an abnormal event sequence can be understood as a sequence obtained by abstracting and encoding abnormal information; and an abnormal timestamp sequence can be understood as a sequence obtained by abstracting and encoding the time of occurrence of the abnormal information.

[0083] Specifically, based on the abnormal information in the abnormal log data, an abnormal event sequence is determined, which contains the semantic information of the abnormal log data. Since the abnormal events are obtained by abstracting the abnormal information, the abnormal occurrence time of the abnormal information is the abnormal event in the abnormal event sequence and the corresponding abnormal occurrence time. Based on the abnormal occurrence time corresponding to the abnormal event and the log acquisition time of the abnormal log data, an abnormal timestamp sequence is determined, which contains the time information of the abnormal log data.

[0084] The fault prediction method provided in the embodiments of this specification, by determining the abnormal event sequence and the abnormal timestamp sequence, organizes the abnormal log data of the service processing unit into a structured sequence, which facilitates the subsequent input of the structured sequence into the fault prediction model and improves the processing efficiency of the fault prediction model.

[0085] In one or more embodiments of this specification, anomaly information is processed to obtain anomaly event sequences, which are then input into a fault prediction model, thus avoiding the process of encoding text information in the fault prediction model. The specific implementation is as follows:

[0086] Determining the sequence of abnormal events based on the abnormal information in the abnormal log data includes:

[0087] The abnormal information is processed to determine the abnormal event corresponding to the abnormal information;

[0088] The event identifier corresponding to the abnormal event is determined based on the matching relationship between the reference abnormal events and the reference event identifiers in the abnormal event database;

[0089] The event identifiers are sorted according to the occurrence time of the abnormal events to generate the abnormal event sequence.

[0090] The event identifier can be understood as the event identifier corresponding to the abnormal event, determined based on the matching relationship between the reference abnormal event and the reference event identifier. It can be represented by numerical values, symbols, etc., without any limitation here.

[0091] The exception event database contains various types of exception events, each with a corresponding reference event identifier, thus establishing a matching relationship between reference exception events and reference event identifiers. Specifically, the matching relationship between reference exception events and reference event identifiers can be obtained through historical exception log data. By abstracting and processing the historical exception log data, corresponding reference exception events are constructed. The constructed reference exception events are then subjected to corresponding identification and encoding operations to obtain the reference event identifiers corresponding to the reference exception events, thereby achieving the pre-construction of the matching relationship between each reference exception event and reference event identifier.

[0092] Specifically, the abnormal information can be abstracted to determine the corresponding abnormal event. For example, using regular expressions, the abnormal information "mce:[Hardware Error]:Mach ine check events logged" can be abstracted into the abnormal event "dmesg_unrecover_mce". Based on the matching relationship between reference abnormal events and reference event identifiers in the abnormal event database, the event identifier corresponding to the abnormal event can be determined. For example, the event identifier corresponding to the abnormal event "dmesg_unrecover_mce" is 2. Based on the determined event identifiers, the event identifiers need to be sorted according to the time of occurrence of the abnormal event to generate an abnormal event sequence.

[0093] In practical applications, regular expressions can be used to map reported exception information to exception events. Specifically, for each exception message, common keywords shared with other exception messages can be identified, such as "Error" and "hardware." Then, based on the types of keywords, it can be categorized into different exception names, resulting in phrases for naming exception events. For example, the exception message "mce:[Hardware Error]:Machinecheckevents logged" can be abstracted into the exception event "dmesg_unrecover_mce". Since exception messages describe the computer's state and contain a lot of redundant information, abstracting the exception message text allows for the extraction of key information. It also allows for selective filtering of reported exception messages, such as choosing those with the "Error" field for parsing. It should be noted that the abstracted exception events are often a unified description of a class of exception messages.

[0094] The fault prediction method provided in the embodiments of this specification simplifies abnormal information into a sequence of abnormal events. When the abnormal event sequence is input into the fault prediction model, it simplifies the complex process of encoding the text of abnormal information by the fault prediction model, reduces the size of the fault prediction model, and reduces the storage space required by the computer system.

[0095] In one or more embodiments of this specification, when sorting event identifiers, they are sorted according to a preset sorting rule, thereby generating an abnormal event sequence based on the sorted event identifiers. The specific implementation is as follows:

[0096] The step of sorting the event identifiers corresponding to the abnormal events according to the time of occurrence of the abnormal events to generate an abnormal event sequence includes:

[0097] Based on the occurrence time of the abnormal event, the event identifiers corresponding to the abnormal event are sorted using a preset sorting rule, and an abnormal event sequence is generated based on the sorted event identifiers.

[0098] The preset sorting rule can be understood as the rule for sorting event identifiers according to the time of occurrence of the exception.

[0099] Specifically, event identifiers can be sorted in reverse order based on the time of occurrence of the abnormal event. When predicting faults, abnormal events with occurrence times closer to the current time are usually more relevant. Therefore, by using the time of occurrence of the abnormal event, the event identifiers corresponding to the abnormal event can be sorted in reverse order, thereby generating an abnormal event sequence based on the reverse order of occurrence time.

[0100] Moreover, there are often interrelationships between abnormal information, that is, abnormal information in the previous moment can cause another abnormal information in the next moment. When the event identifiers (which can also be understood as abnormal information) are sorted according to the time of occurrence of the abnormality, the fault prediction model can be used to better predict the faults of the service processing unit through the contextual semantic information of the abnormal information.

[0101] The fault prediction method provided in the embodiments of this specification sorts the event identifiers corresponding to abnormal events according to a preset sorting rule, strengthens the correlation between abnormal events in the abnormal event sequence, and enables the fault prediction model to better utilize the contextual semantic information of abnormal events.

[0102] In one or more embodiments of this specification, similar to obtaining an anomaly event sequence, the anomaly occurrence time is processed. Different representations of anomaly occurrence time are subjected to a unified structural processing, facilitating the fault prediction model's handling of the unified representation. The specific implementation is as follows:

[0103] Determining the anomaly timestamp sequence based on the anomaly occurrence time and the log acquisition time includes:

[0104] Calculate the time difference between the time the anomaly occurred and the time the log was retrieved;

[0105] Based on the time difference and a preset time coding rule, the times of the anomaly occurrence are grouped, and the group number of each group is determined. The preset time coding rule is used to determine the group corresponding to the time of the anomaly occurrence based on the time difference.

[0106] The anomaly occurrence time is encoded according to the group number to obtain the anomaly timestamp sequence.

[0107] The group number can be understood as a sequence number set after grouping the time of the anomaly; the encoding can be understood as the process of converting the time of the anomaly into a group number.

[0108] For example, the acquired anomaly log data includes anomaly occurrence time 1, anomaly occurrence time 2, anomaly occurrence time 3, anomaly occurrence time 4, and anomaly occurrence time 5. The log acquisition time for acquiring the anomaly log data is time A (actually, time A is later than the anomaly occurrence time in the anomaly log data). The time difference between each anomaly occurrence time and the log acquisition time is calculated. According to the preset time encoding rules, anomaly occurrence times with a time difference within 1000 seconds are grouped into the first group; anomaly occurrence times with a time difference between 1000 and 2000 seconds are grouped into the second group; and anomaly occurrence times with a time difference between 2000 and 3000 seconds are grouped into the third group. The abnormal occurrence times within 000 seconds are divided into the third group, and so on. When grouping, if the time difference between abnormal occurrence time 1 and time A is 156 seconds, the time difference between abnormal occurrence time 2 and time A is 865 seconds, the time difference between abnormal occurrence time 3 and time A is 1426 seconds, the time difference between abnormal occurrence time 4 and time A is 2159 seconds, and the time difference between abnormal occurrence time 5 and time A is 2596 seconds; then abnormal occurrence time 1 and abnormal occurrence time 2 are divided into the first group, abnormal occurrence time 3 is divided into the second group, and abnormal occurrence time 3 and abnormal occurrence time 4 are divided into the third group.

[0109] Therefore, when encoding the time of anomaly occurrence according to the group number, the time of anomaly occurrence 1 and time of anomaly occurrence 2 are encoded as 1, the time of anomaly occurrence 3 is encoded as 2, and the time of anomaly occurrence 3 and time of anomaly occurrence 4 are encoded as 3, thus obtaining the anomaly timestamp sequence [1,1,2,3,3].

[0110] Furthermore, since time can be represented in different forms in practical applications, such as using text or delimiters, and different servers use different representations of the time of occurrence of an anomaly depending on their settings, the above method can be used to process the time of occurrence of an anomaly. Although the representations of the time of occurrence of an anomaly are different, they can all be encoded into a unified sequence of anomaly timestamps.

[0111] Of course, in practical applications, after calculating the time difference between the occurrence time of each anomaly and the log acquisition time, the occurrence time of the anomaly can also be encoded based on the time difference to obtain an anomaly timestamp sequence. However, this method may not be able to effectively utilize time information to analyze the pattern of anomaly occurrence.

[0112] The fault prediction method provided in the embodiments of this specification processes a uniformly formatted sequence of abnormal timestamps in the fault prediction model. The abnormal timestamp sequence is a sequence after encoding the time of the abnormal occurrence, which simplifies the processing flow of the fault prediction model. The fault prediction model can also extract time information from the abnormal log data based on the abnormal timestamp sequence, thereby obtaining more accurate fault prediction results.

[0113] Step 206: Based on the time interval threshold and the occurrence time of the abnormal events corresponding to the abnormal events in the abnormal event sequence, the abnormal events are grouped to obtain an abnormal group sequence.

[0114] The time interval threshold can be understood as a limit value used to determine whether two adjacent abnormal events meet the requirement of being close at time, and can be set according to actual needs.

[0115] Specifically, prior knowledge is added to the data processing layer, namely that abnormal events occurring at similar times are more correlated. Given that the abnormal event sequence has been sorted according to the occurrence time of the corresponding abnormal events, abnormal events occurring at similar times can be merged into abnormal event groups. Therefore, a time interval threshold can be set to determine whether adjacent abnormal events meet the standard of similar occurrence time. Based on the time interval between adjacent abnormal events, abnormal events less than or equal to the time interval threshold are grouped together. For example, if the time interval threshold is 30 minutes, if the time difference between the occurrence times of adjacent abnormal events is less than or equal to 30 minutes, then these two adjacent abnormal events can be merged into an abnormal event group.

[0116] For example, in an abnormal event sequence, abnormal events A, B, C, and D are all adjacent abnormal events. If the time difference between the occurrence times of abnormal events A, B, and C is less than 30 minutes, then abnormal events A, B, and C can be divided into abnormal event group 1. However, if the time difference between the occurrence times of abnormal events D and C is greater than 30 minutes, and the time difference between the occurrence times of abnormal events D and its other adjacent abnormal event is also greater than 30 minutes, then abnormal event D can be divided into abnormal event group 2, thus obtaining an abnormal group sequence.

[0117] In one or more embodiments of this specification, when an abnormal event group is obtained, the abnormal events in the abnormal event group are encoded to obtain an abnormal group sequence, and abnormal events in the same abnormal event group are encoded with the same numerical identifier. The specific implementation method is as follows:

[0118] The step of grouping the abnormal events according to a time interval threshold and the occurrence time of the abnormal events in the abnormal event sequence to obtain an abnormal group sequence includes:

[0119] Based on the time interval threshold and the occurrence time of the abnormal event corresponding to the abnormal event in the abnormal event sequence, the abnormal events are grouped to obtain multiple abnormal event groups.

[0120] Based on the position of the target abnormal event in each abnormal event group within the abnormal event sequence, the abnormal event is encoded to obtain an abnormal group sequence.

[0121] The target abnormal event can be understood as the first abnormal event in the abnormal event group.

[0122] Specifically, the encoding is based on the position of the first abnormal event in the abnormal event group within the abnormal event sequence; for example, the first two abnormal events in an abnormal event sequence are grouped together, and the next three abnormal events are grouped together, so the abnormal grouping sequence can be [1, 1, 3, 3, 3].

[0123] Following the previous example, if abnormal events A, B, and C are divided into abnormal event group 1, and abnormal event D is divided into abnormal event group 2, then the first abnormal event in abnormal event group 1 is abnormal event A, which is the first position in the abnormal event sequence. Therefore, abnormal events A, B, and C in abnormal event group 1 are encoded as 1. The first abnormal event in abnormal event group 2 is abnormal event D, which is the fourth position in the abnormal event sequence. Therefore, abnormal event D in abnormal event group 2 is encoded as 4, resulting in the abnormal group sequence [1, 1, 1, 4].

[0124] In practical applications, abnormal event sequences, abnormal timestamp sequences, and abnormal grouping sequences all use "[start]" as the start character, which has no specific meaning and is used to identify the starting position of the entire sequence.

[0125] The fault prediction method provided in the embodiments of this specification groups consecutive abnormal events that occur at similar times according to the time of the abnormal event. Then, it uses a fault prediction model to extract higher-level sequence features from the abnormal group sequence and accurately predicts the probability of another abnormal event caused by the occurrence of a certain abnormal event.

[0126] Step 208: Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, use the fault prediction model to obtain the fault prediction result of the service processing unit.

[0127] The fault prediction model can be understood as a model used to predict whether a service processing unit will crash, and it has a Transform structure; the fault prediction results include crash results and non-crash results.

[0128] Specifically, the abnormal event sequence, abnormal timestamp sequence, and abnormal grouping sequence are input into the fault prediction model to extract the semantic information, time information, and grouping information of the abnormal log data. This allows the fault prediction model to extract the information contained in the abnormal log data from more dimensions and obtain a more accurate prediction of whether the service processing unit will crash.

[0129] In one or more embodiments of this specification, to make the fault prediction model pay more attention to abnormal events that have a significant impact on the fault prediction results and to capture the changes in the impact of abnormal events over time, a self-attention mechanism is used to process the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence. The specific implementation is as follows:

[0130] The step of obtaining the fault prediction result of the service processing unit based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence using a fault prediction model includes:

[0131] Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, the event correlation matrix and the time correlation matrix are obtained using the self-attention layer of the fault prediction model.

[0132] Based on the event correlation matrix and the time correlation matrix, the fault prediction result of the service processing unit is obtained.

[0133] Among them, the event correlation matrix is ​​used to represent the intrinsic connection and degree of influence between different abnormal events calculated based on semantic information; the time correlation matrix is ​​used to represent the correlation between various abnormal events calculated based on time information; both the event correlation matrix and the time correlation matrix can be represented as square matrices with the sequence length dimension.

[0134] Specifically, the abnormal event sequence, abnormal timestamp sequence, and abnormal grouping sequence are input into the self-attention layer of the fault prediction model. The self-attention mechanism of the self-attention layer is used to calculate the event correlation matrix and the time correlation matrix. The correlation between each abnormality in the abnormal log data is obtained from different dimensions. Based on the correlation between each abnormality in the abnormal log data, the fault prediction result of the service processing unit is predicted.

[0135] The fault prediction method provided in the embodiments of this specification has a self-attention layer that can dynamically allocate weights according to the importance of different abnormal events and their impact on the fault prediction results. This makes the fault prediction model pay more attention to abnormal log data that have a greater impact on the fault prediction results, thereby improving the accuracy of the prediction.

[0136] In one or more embodiments of this specification, an abnormal event sequence is input into a first self-attention layer, and an abnormal timestamp sequence and an abnormal grouping sequence are input into a second self-attention layer. Event correlation matrices and time correlation matrices are obtained based on the different self-attention layers, respectively. The specific implementation is as follows:

[0137] The step of obtaining the event correlation matrix and the time correlation matrix using the self-attention layer of the fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence includes:

[0138] The abnormal event sequence is input into the first self-attention layer of the fault prediction model to obtain the event correlation matrix;

[0139] The abnormal timestamp sequence and the abnormal grouping sequence are input into the second self-attention layer of the fault prediction model to obtain the time correlation matrix.

[0140] The first self-attention layer can be understood as the self-attention layer that processes the sequence of abnormal events; the second self-attention layer can be understood as the self-attention layer that processes the sequence of abnormal timestamps and the sequence of abnormal groups; the first self-attention layer and the second self-attention layer are two self-attention layers in parallel in the fault prediction model; the first self-attention layer is used to process the sequence of abnormal events, and the second self-attention layer is used to process the sequence of abnormal timestamps and the sequence of abnormal groups.

[0141] Specifically, before inputting the abnormal event sequence into the first self-attention layer of the fault prediction model, the abnormal event sequence can first be input into the exception embedding layer of the fault prediction model. The exception embedding layer maps the abnormal event sequence into an event vector. The output of the exception embedding is used as the input of the first self-attention layer, and the event correlation matrix is ​​calculated using the self-attention mechanism.

[0142] Before inputting the abnormal timestamp sequence and abnormal group sequence into the second self-attention layer of the fault prediction model, the abnormal timestamp sequence can first be input into the temporal embedding layer of the fault prediction model, which maps the abnormal timestamp sequence into a timestamp vector. The abnormal group sequence can be input into the group embedding layer of the fault prediction model, which maps the abnormal group sequence into a group vector. The outputs of temporal embedding and group embedding, namely the timestamp vector and the group vector, are superimposed as the input of the second self-attention layer, and the time correlation matrix is ​​formed by using the self-attention mechanism.

[0143] In practical applications, when abnormal log data is input into the fault prediction model, abnormal event sequences can be obtained in the abnormal event embedding layer of the fault prediction model and mapped to event vectors; abnormal timestamp sequences can be obtained in the timestamp kilosecond embedding layer of the fault prediction model and mapped to timestamp vectors; and abnormal group sequences can be obtained in the group embedding layer and mapped to group vectors.

[0144] For example, the element in the i-th row and j-th column of the generated event correlation matrix can be determined based on the correlation between two abnormal events at positions i and j in the abnormal event sequence.

[0145] The fault prediction method provided in the embodiments of this specification processes the abnormal event sequence through a first self-attention layer, which can capture and quantify the dependencies and potential impacts between different abnormal events, forming an event correlation matrix; and processes the abnormal timestamp sequence and abnormal grouping sequence through a second self-attention layer, which can deeply analyze the patterns and periodic characteristics of the evolution of abnormal events over time.

[0146] In one or more embodiments of this specification, the event correlation matrix and the time correlation matrix are fused to obtain an attention matrix, and the fault prediction result of the service processing unit is obtained through subsequent calculations. The specific implementation is as follows:

[0147] The step of obtaining the fault prediction result of the service processing unit based on the event correlation matrix and the time correlation matrix includes:

[0148] Based on the event correlation matrix and the time correlation matrix, the attention matrix is ​​obtained using the attention fusion layer of the fault prediction model;

[0149] Based on the attention matrix, determine the target feature vector;

[0150] The target feature vector is input into the classification layer of the fault prediction model to obtain the fault prediction result of the service processing unit.

[0151] The attention fusion layer is used to fuse the event correlation matrix and the time correlation matrix; the target feature vector can be understood as the feature vector corresponding to the start symbol in the output sequence composed of attention matrices; the classification layer can be understood as a classifier.

[0152] In practical applications, the combination of the time correlation matrix and the event correlation matrix can be achieved through an attention fusion layer. The fault prediction model has multiple attention fusion layers, which can be used to instruct the fault prediction model to make fault predictions based on event, time, and grouping information. At this time, the time correlation matrix and the event correlation matrix can be summed to fuse the extracted event, time, and grouping information. This allows the fault prediction model to extract information from abnormal event sequences, abnormal timestamp sequences, and abnormal grouping sequences simultaneously, and to consider the meaning of the abnormal event itself, the time of occurrence of the abnormality, and the correlation between abnormal events in the abnormal event group while searching for abnormal event correlations.

[0153] The summation of the time correlation matrix and the event correlation matrix can be used as the Attention Score in the fault prediction model. The Attention Score refers to the correlation matrix calculated by the Attention process in the fault prediction model. Specifically, it can be viewed as a dynamic weight matrix calculated by the fault prediction model, which is then multiplied by the Attention Score in subsequent steps to weight the input items. It should be noted that the entire Attention process can be understood as multiplying the input item itself by its transpose to obtain the dynamic weight matrix (i.e., the Attention Score), and then using this weight matrix to weight the input item. After weighting, the dimension of the input remains unchanged before it is fed into the fully connected layer and the classifier module for classification.

[0154] After summing the Attention Score, the output can be calculated using the Transformer's computation method. Specifically, the temporal correlation matrix and the event correlation matrix are used as inputs to the first layer of the attention fusion layer. That is, the first layer of the attention fusion layer takes the temporal correlation matrix and the event correlation matrix as inputs. At this point, the temporal correlation matrix and the event correlation matrix are summed, and the resulting matrix is ​​used as the first layer's input and multiplied by the weight matrix to obtain the first layer's output. Then, starting from the second layer, the sum of the previous layer's input and output can be used as the input of the next layer and multiplied by the weight matrix to obtain the next layer's output, until the sum of the previous layer's input and output is multiplied by the weight matrix to obtain the top layer's output.

[0155] In one embodiment of this specification, the output of the top-level attention fusion layer in the fault prediction model is expressed in matrix form (attention matrix). The matrix form is equivalent to a special vector, that is, it can be converted into feature vectors for representation. At this time, the feature vectors of each row vector in the output can be combined to form an output sequence. Then, the target feature vector located at the first position in the output sequence can be obtained, that is, the feature vector corresponding to the start symbol. The obtained target feature vector is input into the classifier for classification, and the output is the confidence that the service processing unit will crash. At this time, a preset threshold can be set. When the confidence is greater than the preset threshold, it is predicted that the corresponding service processing unit will crash.

[0156] In practical applications, the feature vector (class token) corresponding to the start symbol of the output sequence of the top attention fusion layer is used as a representative of the output sequence and fed into the classifier for classification. The start symbol does not correspond to any abnormal information, but when calculating the correlation matrix, the correlation between each abnormal event and the start symbol is calculated, and the vector of the start symbol is weighted based on this. Thus, the start symbol can be regarded as a symbol that is independent of each abnormal event, but can also represent the combination of all abnormal events. Therefore, the feature vector corresponding to this start symbol is used for classification.

[0157] The fault prediction method provided in the embodiments of this specification can make full use of the event, time and grouping information in the abnormal log data. By grouping abnormal events that occur consecutively at similar times into a group, the event information can be better integrated using time information, and higher-level sequence features can be extracted. This improves the accuracy and recall of fault prediction, enabling cloud computing systems to perform maintenance on servers that are about to crash more quickly and accurately, thereby reducing the downtime rate or reducing the losses caused by downtime to users, and greatly increasing the stability and reliability of cloud computing systems.

[0158] In one or more embodiments of this specification, the fault prediction model is trained through the following steps:

[0159] Obtain the sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data;

[0160] Based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data, determine the sample anomaly event sequence and the sample anomaly timestamp sequence;

[0161] Based on the time interval threshold and the occurrence time of the sample anomaly corresponding to the sample anomaly in the sample anomaly sequence, the sample anomaly events are grouped to obtain a sample anomaly grouping sequence.

[0162] Based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence, positive and negative samples are determined.

[0163] A fault prediction model is trained based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

[0164] Among them, positive samples can be understood as crash samples, that is, when the service processing unit crashes, the sample abnormal event sequence, sample abnormal timestamp sequence, and sample abnormal grouping sequence are determined based on the sample abnormal log data of the service processing unit and the sample log acquisition time of the sample abnormal log data. The sample label corresponding to the positive sample is the crash result of the service processing unit.

[0165] Negative samples can be understood as normal samples, that is, when the service processing unit does not crash, the sample abnormal event sequence, sample abnormal timestamp sequence, and sample abnormal grouping sequence are determined based on the sample abnormal log data of the service processing unit and the sample log acquisition time of the sample abnormal log data. The sample label corresponding to the negative sample is the server's non-crash result.

[0166] For details on obtaining the sample abnormal event sequence, sample abnormal timestamp sequence, and sample abnormal grouping sequence, please refer to the above embodiments, which will not be repeated here.

[0167] When a fault prediction model is trained based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples, the fault prediction model can predict whether the service processing unit will crash or not based on the obtained abnormal log data and the log acquisition time.

[0168] The fault prediction method provided in the embodiments of this specification can better learn the pattern of whether or not a system crashes due to abnormal events by distinguishing between positive and negative samples. This allows the fault prediction model to accurately predict the acquired abnormal log data.

[0169] In one or more embodiments of this specification, determining the sample anomaly event sequence and the sample anomaly timestamp sequence based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data includes:

[0170] Based on the sample anomaly log data, determine the positive sample anomaly event sequence and the negative sample anomaly event sequence;

[0171] Based on the positive sample anomaly event sequence, the negative sample anomaly event sequence, and the sample log acquisition time of the sample anomaly log data, the positive sample anomaly timestamp sequence and the negative sample anomaly timestamp sequence are determined.

[0172] Among them, the positive sample abnormal event sequence can be understood as the abnormal event sequence determined from the sample abnormal log data when the service processing unit crashes; the negative sample abnormal event sequence can be understood as the abnormal event sequence determined from the sample abnormal log data when the service processing unit does not crash.

[0173] Specifically, when it is necessary to train the fault prediction model using positive and negative samples, the positive sample abnormal event sequence and the negative sample abnormal event sequence are determined for the acquired sample abnormal log data. Based on the positive sample abnormal event sequence and the sample log acquisition time of the sample abnormal log data, the positive sample abnormal timestamp sequence is determined, and based on the negative sample abnormal event sequence and the sample log acquisition time of the sample abnormal log data, the negative sample abnormal timestamp sequence is determined.

[0174] In one or more embodiments of this specification, determining the positive sample anomaly event sequence and the negative sample anomaly event sequence based on the sample anomaly log data includes:

[0175] Based on the sample anomaly information in the sample anomaly log data, a sequence of sample anomaly events is determined, and based on the sequence of sample anomaly events, a sequence of positive sample anomaly events and a sequence of negative sample anomaly events are determined.

[0176] In one or more embodiments of this specification, determining the sequence of sample anomaly events based on sample anomaly information in the sample anomaly log data includes:

[0177] The sample anomaly information is processed to determine the sample anomaly event corresponding to the sample anomaly information;

[0178] Based on the matching relationship between reference abnormal events and reference event identifiers in the abnormal event database, the sample event identifier corresponding to the sample abnormal event is determined;

[0179] Based on the occurrence time of the sample anomaly corresponding to the sample anomaly event, the sample event identifiers are sorted to generate the sample anomaly event sequence.

[0180] The specific implementation of generating the sample abnormal event sequence is similar to the above embodiments, and will not be repeated here.

[0181] In one or more embodiments of this specification, positive sample anomaly event sequences are acquired using a preset sampling time and a preset sampling length, while negative sample anomaly event sequences are determined using a preset negative sample sampling rule. The specific implementation is as follows:

[0182] Determining the positive sample anomaly sequence and the negative sample anomaly sequence based on the sample anomaly event sequence includes:

[0183] The positive sample abnormal event sequence is determined from the sample abnormal event sequence based on the preset sampling time and preset sampling length;

[0184] According to a preset negative sample sampling rule, the negative sample abnormal event sequence is determined from the sample abnormal event sequence, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio.

[0185] Among them, the preset sampling time can be understood as the preset sampling time interval; the preset sampling length can be understood as the preset sampling window length; and the preset negative sample sampling rule can be understood as the rule of randomly obtaining samples from the abnormal event sequence according to a preset ratio.

[0186] Specifically, when obtaining positive samples, sampling can be performed in the abnormal event sequence at 5-minute intervals with a 3-day sampling window, with overlapping sampling in the abnormal event sequence, thus obtaining the positive sample abnormal event sequence; while when obtaining negative samples, abnormal events can be randomly selected from the abnormal event sequence at a preset ratio (e.g., 60%), thus determining the negative sample abnormal event sequence.

[0187] In practical applications, a sliding window approach is used. At each 5-minute time point, a subsequence containing all anomalous events within the previous 72 hours (i.e., 3 days) is calculated. For example, the first sampling window starts from time A and ends at time B (72 hours before time A); then the window moves forward 5 minutes, and the second sampling window starts from time C (5 minutes before time A), also covering the previous 72 hours, and so on.

[0188] In one or more embodiments of this specification, the step of grouping the sample anomaly events according to the time interval threshold and the sample anomaly occurrence time corresponding to the sample anomaly event in the sample anomaly event sequence to obtain a sample anomaly grouping sequence includes:

[0189] Based on the time interval threshold and the occurrence time of the positive sample anomaly corresponding to the positive sample anomaly in the positive sample anomaly sequence, the positive sample anomaly events are grouped to obtain a positive sample anomaly grouping sequence.

[0190] Based on the time interval threshold and the occurrence time of the negative sample anomaly corresponding to the negative sample anomaly in the negative sample anomaly sequence, the negative sample anomaly events are grouped to obtain a negative sample anomaly grouping sequence.

[0191] The specific implementation of grouping positive sample abnormal events and negative sample abnormal events is similar to the grouping method in the above embodiment, and will not be repeated here.

[0192] In one or more embodiments of this specification, determining positive and negative samples based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence includes:

[0193] The positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence are used as positive samples, and the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence are used as negative samples.

[0194] The fault prediction method provided in the embodiments of this specification, through the constructed positive and negative samples, can help the fault prediction model fully learn and distinguish between the downtime and non-downtime states of the service processing unit, thereby improving the prediction accuracy and generalization ability of the fault prediction model in practical applications.

[0195] The fault prediction method provided in this specification determines the sequence of abnormal events and the sequence of abnormal timestamps by acquiring abnormal log data from the service processing unit and the log acquisition time of the abnormal log data; and groups the abnormal events by the time interval of the abnormal events to obtain an abnormal group sequence. When abnormal events occurring at similar times are more correlated, the abnormal log data is analyzed from multiple dimensions. Thus, the fault prediction model can improve the accuracy and recall rate of fault prediction, enabling the cloud computing system to predict downtime in advance and perform timely maintenance, reduce downtime rate, and improve the stability of the cloud computing system.

[0196] See Figure 3 , Figure 3 A flowchart of a fault prediction model training method provided in one embodiment of this specification is shown, which specifically includes the following steps.

[0197] Step 302: Obtain the sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data;

[0198] The step of determining the positive sample anomaly event sequence and the negative sample anomaly event sequence based on the sample anomaly log data includes:

[0199] Based on the sample anomaly information in the sample anomaly log data, a sequence of sample anomaly events is determined, and based on the sequence of sample anomaly events, a sequence of positive sample anomaly events and a sequence of negative sample anomaly events are determined.

[0200] The step of determining the sequence of sample anomaly events based on the sample anomaly information in the sample anomaly log data includes:

[0201] The sample anomaly information is processed to determine the sample anomaly event corresponding to the sample anomaly information;

[0202] Based on the matching relationship between reference abnormal events and reference event identifiers in the abnormal event database, the sample event identifier corresponding to the sample abnormal event is determined;

[0203] Based on the occurrence time of the sample anomaly corresponding to the sample anomaly event, the sample event identifiers are sorted to generate the sample anomaly event sequence.

[0204] Determining the positive sample anomaly sequence and the negative sample anomaly sequence based on the sample anomaly event sequence includes:

[0205] The positive sample abnormal event sequence is determined from the sample abnormal event sequence based on the preset sampling time and preset sampling length;

[0206] According to a preset negative sample sampling rule, the negative sample abnormal event sequence is determined from the sample abnormal event sequence, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio.

[0207] Step 304: Determine the sample anomaly event sequence and the sample anomaly timestamp sequence based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data;

[0208] The step of determining the sample anomaly event sequence and the sample anomaly timestamp sequence based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data includes:

[0209] Based on the sample anomaly log data, determine the positive sample anomaly event sequence and the negative sample anomaly event sequence;

[0210] Based on the positive sample anomaly event sequence, the negative sample anomaly event sequence, and the sample log acquisition time of the sample anomaly log data, the positive sample anomaly timestamp sequence and the negative sample anomaly timestamp sequence are determined.

[0211] Step 306: Based on the time interval threshold and the occurrence time of the sample anomaly corresponding to the sample anomaly in the sample anomaly sequence, group the sample anomaly events to obtain a sample anomaly grouping sequence;

[0212] The step of grouping the sample anomalies according to the time interval threshold and the occurrence time of the sample anomalies corresponding to the sample anomalies in the sample anomaly event sequence to obtain a sample anomaly grouping sequence includes:

[0213] Based on the time interval threshold and the occurrence time of the positive sample anomaly corresponding to the positive sample anomaly in the positive sample anomaly sequence, the positive sample anomaly events are grouped to obtain a positive sample anomaly grouping sequence.

[0214] Based on the time interval threshold and the occurrence time of the negative sample anomaly corresponding to the negative sample anomaly in the negative sample anomaly sequence, the negative sample anomaly events are grouped to obtain a negative sample anomaly grouping sequence.

[0215] Step 308: Determine positive samples and negative samples based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence;

[0216] The step of determining positive and negative samples based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence includes:

[0217] The positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence are used as positive samples, and the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence are used as negative samples.

[0218] Step 310: Train a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

[0219] For specific implementation details, please refer to the above embodiments, which will not be repeated here.

[0220] The fault prediction model training method provided in this specification determines the abnormal event sequence and the abnormal timestamp sequence; and groups the abnormal events by the time interval of the abnormal events to obtain the abnormal group sequence. When the abnormal events that occur at similar times are more correlated, the abnormal log data is analyzed from multiple dimensions, so that the trained fault prediction model can achieve more accurate prediction.

[0221] The above is an illustrative scheme of a fault prediction model training method according to this embodiment. It should be noted that the technical solution of this fault prediction model training method belongs to the same concept as the technical solution of the fault prediction method described above. For details not described in detail in the technical solution of the fault prediction model training method, please refer to the description of the technical solution of the fault prediction method described above.

[0222] See Figure 4 , Figure 4 The flowchart of a fault prediction model training method provided in one embodiment of this specification is shown, which specifically includes the following steps.

[0223] Step 402: Preprocess the training sample data.

[0224] The system obtains exception log data corresponding to the NC (i.e., the service processing unit in the above embodiment) through a detector, and abstracts the exception information in the exception log data into an exception event. Specifically, the same type of exception information is abstracted into the same exception event, and the exception event is converted into a corresponding event identifier through an exception event library. Figure 5 A schematic diagram of a data preprocessing procedure provided in one embodiment of this specification is shown.

[0225] like Figure 5 As shown, the data preprocessing process is the process of organizing abnormal log data into structured data. Specifically, the abnormal log data includes log time (i.e., the time of abnormal occurrence in the above embodiment) and original record information (i.e., the abnormal information in the above embodiment). The abnormal information is abstracted, that is, the part of the original record information highlighted in color is abstracted into abnormal events. The abnormal event library contains all types of abnormal events, and each abnormal event corresponds to an integer number (i.e., the event identifier in the above embodiment). Each abnormal event is converted into an integer number according to the abnormal event library. For example, the abnormal event "dmesg_unrecover_mce" is converted into 2. Figure 5 The purpose of using color to distinguish between different types of abnormal events is to indicate that the same type of abnormal event is represented by the same integer number, thus obtaining a preprocessed result that uses integer numbers to represent abnormal information.

[0226] Step 404: Sampling.

[0227] When obtaining abnormal log data through the detector, the abnormal log data includes the time of occurrence of the abnormal information. The abnormal log data is arranged in reverse order of the time of occurrence of the abnormality, and then the obtained abnormal log data is sampled according to the preset sampling time interval and sampling window length to obtain sample abnormal log data.

[0228] In practical applications, the abnormal log data reported by each NC is arranged in reverse order of the time of the abnormality to form a sequence. The sampling is performed at 5-minute intervals with a 3-day sampling window. The samples overlap in the entire sequence (processed according to step 402, the resulting samples are in the form of "[start], 1, 2, ..., 3", where [start] is the start symbol and has no specific meaning). For crash samples (positive samples), only the data within 3 days of the crash time are retained. For normal samples (negative samples), a certain proportion of samples are randomly retained in the entire sequence.

[0229] Step 406: Encoding Mapping.

[0230] Specifically, the obtained sequence "[start], 1, 2, ..., 3" is encoded and mapped into a vector that the fault prediction model can train. For example, the abnormal event sequence is encoded and mapped. For abnormal timestamp sequences, the time difference between the occurrence time of each abnormality and the sampling time is calculated. For example, three days total 259,200 seconds. 0-1000 seconds is mapped to the number 1, 1000-2000 seconds to the number 2, and so on, and then mapped into a vector. For abnormal grouping sequences, abnormal events less than a certain threshold are grouped according to the time interval between adjacent abnormal events, and encoded according to the position of the first abnormal event in the sequence. For example, the first three abnormal events in a sequence are grouped together, and the next five abnormal events are grouped together. Then the abnormal grouping sequence is "[start], 1, 1, 1, 4, 4, 4, 4, 4". This abnormal grouping sequence is encoded and mapped.

[0231] Figure 6 A schematic diagram of an encoding mapping process provided by one embodiment of this specification is shown.

[0232] Encode and map the abnormal event sequence corresponding to the abnormal event. For example, encode and map “2,1,9,……,30” to obtain the encoding vector “E1[2]E1[1]E1[9]……E1

[30] ” corresponding to the abnormal event sequence. Based on the abnormal occurrence time “20230501 16:20:00, 20230501 16:19:10, 20230501 15:56:04, 20230501 13:57:47”, encode to obtain the abnormal timestamp sequence and abnormal group sequence, and map them into vectors. For example, the encoding vector corresponding to the abnormal timestamp sequence is “E2[1]E2[1]E2[1]……E2

[30] ”, and the encoding vector corresponding to the abnormal group sequence is “E3[1]E3[1]E3[3]……E3

[89] ”.

[0233] Step 408: Obtain the event correlation matrix and the time correlation matrix.

[0234] The output of the fault prediction model's embedding layer is used as input to the fault prediction model's self-attention layer. First, the output of Exception Embedding, i.e., the encoded and mapped sequence of abnormal events, is input into the first self-attention layer to obtain the event correlation matrix using the self-attention mechanism. Then, the outputs of Temporal Embedding and Group Embedding, i.e., the encoded and mapped sequence of abnormal timestamps and the sequence of abnormal groupings, are superimposed and input into the second self-attention layer. Based on the time information, the correlation between each event in the sequence is calculated to obtain the time correlation matrix.

[0235] Step 410: Matrix fusion.

[0236] The event correlation matrix and the time correlation matrix are added and fused to obtain the attention matrix. This attention matrix is ​​then input into each attention fusion layer of the fault prediction model to obtain the output sequence of the top attention fusion layer.

[0237] Step 412: Model training.

[0238] The feature vector (class token) corresponding to the start symbol in the output sequence of the top attention fusion layer is used as the representative of this output sequence and fed into the classifier for classification. Fault prediction is a binary classification task, and the fault prediction result (downtime, normal) is obtained. Using the fault prediction result and sample labels, the model parameters of the fault prediction model are updated by calculating the loss function. In practical applications, the loss function used during model training is cross-entropy loss, and the gradient descent algorithm is used to backpropagate the gradient of the loss to update the model parameters.

[0239] The fault prediction model training method provided in the embodiments of this specification fully considers time information, specifically including time information and grouping information. It does not require direct learning from the original record information, but rather learns from the preprocessed results, thus improving model training efficiency. By effectively integrating event information, time information, and grouping information, it can more effectively extract information from the sequence, enhancing the data's expressive power. This allows the subsequent application of the fault prediction model to improve the accuracy and recall of fault prediction, enabling cloud computing systems to predict downtime in advance and perform timely maintenance, reducing downtime and improving the stability of the cloud computing system.

[0240] Corresponding to the above method embodiments, this specification also provides embodiments of a fault prediction device. Figure 7 A schematic diagram of a fault prediction device according to one embodiment of this specification is shown. Figure 7 As shown, the device includes:

[0241] The data acquisition module 702 is configured to acquire the abnormal log data of the service processing unit and the log acquisition time of the abnormal log data;

[0242] The sequence determination module 704 is configured to determine the abnormal event sequence and the abnormal timestamp sequence based on the abnormal log data and the log acquisition time.

[0243] The sequence acquisition module 706 is configured to group the abnormal events according to a time interval threshold and the abnormal occurrence time corresponding to the abnormal events in the abnormal event sequence to obtain an abnormal grouping sequence;

[0244] The result acquisition module 708 is configured to obtain the fault prediction result of the service processing unit based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, using a fault prediction model.

[0245] The device further includes:

[0246] The model training module is configured to acquire sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data;

[0247] Based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data, determine the sample anomaly event sequence and the sample anomaly timestamp sequence;

[0248] Based on the time interval threshold and the occurrence time of the sample anomaly corresponding to the sample anomaly in the sample anomaly sequence, the sample anomaly events are grouped to obtain a sample anomaly grouping sequence.

[0249] Based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence, positive and negative samples are determined.

[0250] A fault prediction model is trained based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

[0251] Optionally, the model training module is further configured as follows:

[0252] Based on the sample anomaly log data, determine the positive sample anomaly event sequence and the negative sample anomaly event sequence;

[0253] Based on the positive sample anomaly event sequence, the negative sample anomaly event sequence, and the sample log acquisition time of the sample anomaly log data, the positive sample anomaly timestamp sequence and the negative sample anomaly timestamp sequence are determined.

[0254] Optionally, the model training module is further configured as follows:

[0255] Based on the time interval threshold and the occurrence time of the positive sample anomaly corresponding to the positive sample anomaly in the positive sample anomaly sequence, the positive sample anomaly events are grouped to obtain a positive sample anomaly grouping sequence.

[0256] Based on the time interval threshold and the occurrence time of the negative sample anomaly corresponding to the negative sample anomaly in the negative sample anomaly sequence, the negative sample anomaly events are grouped to obtain a negative sample anomaly grouping sequence.

[0257] Optionally, the model training module is further configured as follows:

[0258] The positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence are used as positive samples, and the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence are used as negative samples.

[0259] Optionally, the model training module is further configured as follows:

[0260] Based on the sample anomaly information in the sample anomaly log data, a sequence of sample anomaly events is determined, and based on the sequence of sample anomaly events, a sequence of positive sample anomaly events and a sequence of negative sample anomaly events are determined.

[0261] Optionally, the model training module is further configured as follows:

[0262] The sample anomaly information is processed to determine the sample anomaly event corresponding to the sample anomaly information;

[0263] Based on the matching relationship between reference abnormal events and reference event identifiers in the abnormal event database, the sample event identifier corresponding to the sample abnormal event is determined;

[0264] Based on the occurrence time of the sample anomaly corresponding to the sample anomaly event, the sample event identifiers are sorted to generate the sample anomaly event sequence.

[0265] Optionally, the model training module is further configured as follows:

[0266] The positive sample abnormal event sequence is determined from the sample abnormal event sequence based on the preset sampling time and preset sampling length;

[0267] According to a preset negative sample sampling rule, the negative sample abnormal event sequence is determined from the sample abnormal event sequence, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio.

[0268] Optionally, the sequence determination module 704 is further configured to:

[0269] The sequence of abnormal events is determined based on the abnormal information in the abnormal log data;

[0270] Based on the time of occurrence of the anomaly information, determine the time of occurrence of the anomaly corresponding to the anomaly event in the anomaly event sequence;

[0271] The abnormal timestamp sequence is determined based on the time of the abnormality occurrence and the time of log acquisition.

[0272] Optionally, the sequence determination module 704 is further configured to:

[0273] The abnormal information is processed to determine the abnormal event corresponding to the abnormal information;

[0274] The event identifier corresponding to the abnormal event is determined based on the matching relationship between the reference abnormal events and the reference event identifiers in the abnormal event database;

[0275] The event identifiers are sorted according to the occurrence time of the abnormal events to generate the abnormal event sequence.

[0276] Optionally, the sequence determination module 704 is further configured to:

[0277] Calculate the time difference between the time the anomaly occurred and the time the log was retrieved;

[0278] Based on the time difference and a preset time coding rule, the times of the anomaly occurrence are grouped, and the group number of each group is determined. The preset time coding rule is used to determine the group corresponding to the time of the anomaly occurrence based on the time difference.

[0279] The anomaly occurrence time is encoded according to the group number to obtain the anomaly timestamp sequence.

[0280] Optionally, the sequence determination module 704 is further configured to:

[0281] Based on the occurrence time of the abnormal event, the event identifiers corresponding to the abnormal event are sorted using a preset sorting rule, and an abnormal event sequence is generated based on the sorted event identifiers.

[0282] Optionally, the sequence acquisition module 706 is further configured to:

[0283] Based on the time interval threshold and the occurrence time of the abnormal event corresponding to the abnormal event in the abnormal event sequence, the abnormal events are grouped to obtain multiple abnormal event groups.

[0284] Based on the position of the target abnormal event in each abnormal event group within the abnormal event sequence, the abnormal event is encoded to obtain an abnormal group sequence.

[0285] Optionally, the result obtaining module 708 is further configured to:

[0286] Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, the event correlation matrix and the time correlation matrix are obtained using the self-attention layer of the fault prediction model.

[0287] Based on the event correlation matrix and the time correlation matrix, the fault prediction result of the service processing unit is obtained.

[0288] Optionally, the result obtaining module 708 is further configured to:

[0289] The abnormal event sequence is input into the first self-attention layer of the fault prediction model to obtain the event correlation matrix;

[0290] The abnormal timestamp sequence and the abnormal grouping sequence are input into the second self-attention layer of the fault prediction model to obtain the time correlation matrix.

[0291] Optionally, the result obtaining module 708 is further configured to:

[0292] Based on the event correlation matrix and the time correlation matrix, the attention matrix is ​​obtained using the attention fusion layer of the fault prediction model;

[0293] Based on the attention matrix, determine the target feature vector;

[0294] The target feature vector is input into the classification layer of the fault prediction model to obtain the fault prediction result of the service processing unit.

[0295] The above is a schematic scheme of a fault prediction device according to this embodiment. It should be noted that the technical solution of this fault prediction device belongs to the same concept as the technical solution of the fault prediction device described above. For details not described in detail in the technical solution of the fault prediction device, please refer to the description of the technical solution of the fault prediction method described above.

[0296] Corresponding to the above method embodiments, this specification also provides embodiments of a fault prediction model training device. Figure 8A schematic diagram of a fault prediction model training device according to one embodiment of this specification is shown. Figure 8 As shown, the device includes:

[0297] The data acquisition module 802 is configured to acquire the sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data;

[0298] The sequence determination module 804 is configured to determine the sample abnormal event sequence and the sample abnormal timestamp sequence based on the sample abnormal log data and the sample log acquisition time of the sample abnormal log data.

[0299] The sequence acquisition module 806 is configured to group the sample abnormal events according to the time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events in the sample abnormality event sequence, and obtain a sample abnormality grouping sequence.

[0300] The sample determination module 808 is configured to determine positive samples and negative samples based on the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence.

[0301] The training module 810 is configured to train a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

[0302] Optionally, the sequence determination module 804 is further configured to:

[0303] Based on the sample anomaly log data, determine the positive sample anomaly event sequence and the negative sample anomaly event sequence;

[0304] Based on the positive sample anomaly event sequence, the negative sample anomaly event sequence, and the sample log acquisition time of the sample anomaly log data, the positive sample anomaly timestamp sequence and the negative sample anomaly timestamp sequence are determined.

[0305] Optionally, the sequence acquisition module 806 is further configured to:

[0306] Based on the time interval threshold and the occurrence time of the positive sample anomaly corresponding to the positive sample anomaly in the positive sample anomaly sequence, the positive sample anomaly events are grouped to obtain a positive sample anomaly grouping sequence.

[0307] Based on the time interval threshold and the occurrence time of the negative sample anomaly corresponding to the negative sample anomaly in the negative sample anomaly sequence, the negative sample anomaly events are grouped to obtain a negative sample anomaly grouping sequence.

[0308] Optionally, the sample determination module 808 is further configured to:

[0309] The positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence are used as positive samples, and the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence are used as negative samples.

[0310] Optionally, the sequence determination module 804 is further configured to:

[0311] Based on the sample anomaly information in the sample anomaly log data, a sequence of sample anomaly events is determined, and based on the sequence of sample anomaly events, a sequence of positive sample anomaly events and a sequence of negative sample anomaly events are determined.

[0312] Optionally, the sequence determination module 804 is further configured to:

[0313] The sample anomaly information is processed to determine the sample anomaly event corresponding to the sample anomaly information;

[0314] Based on the matching relationship between reference abnormal events and reference event identifiers in the abnormal event database, the sample event identifier corresponding to the sample abnormal event is determined;

[0315] Based on the occurrence time of the sample anomaly corresponding to the sample anomaly event, the sample event identifiers are sorted to generate the sample anomaly event sequence.

[0316] Optionally, the sequence determination module 804 is further configured to:

[0317] The positive sample abnormal event sequence is determined from the sample abnormal event sequence based on the preset sampling time and preset sampling length;

[0318] According to a preset negative sample sampling rule, the negative sample abnormal event sequence is determined from the sample abnormal event sequence, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio.

[0319] The above is a schematic scheme of a fault prediction model training device according to this embodiment. It should be noted that the technical solution of this fault prediction model training device and the technical solution of the fault prediction method described above belong to the same concept. For details not described in detail in the technical solution of the fault prediction model training device, please refer to the description of the technical solution of the fault prediction method described above.

[0320] Figure 9A structural block diagram of a computing device 900 according to one embodiment of this specification is shown. The components of the computing device 900 include, but are not limited to, a memory 910 and a processor 920. The processor 920 is connected to the memory 910 via a bus 930, and a database 950 is used to store data.

[0321] The computing device 900 also includes an access device 940, which enables the computing device 900 to communicate via one or more networks 960. Examples of these networks include Public Switched Telephone Network (PSTN), Local Area Network (LAN), Wide Area Network (WAN), Personal Area Network (PAN), or combinations of communication networks such as the Internet. The access device 940 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 802.11 Wireless Local Area Network (WLAN) wireless interface, a Wi-MAX (Worldwide Interoperability for Microwave Access) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, or a Near Field Communication (NFC) interface.

[0322] In one embodiment of this specification, the aforementioned components of the computing device 900 and Figure 9 Other components, not shown, can also be connected to each other, for example, via a bus. It should be understood that... Figure 9 The block diagram of the computing device shown is for illustrative purposes only and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0323] The computing device 900 can be any type of stationary or mobile computing device, including mobile computers or mobile computing devices (e.g., tablet computers, personal digital assistants, laptop computers, notebook computers, netbooks, etc.), mobile phones (e.g., smartphones), wearable computing devices (e.g., smartwatches, smart glasses, etc.) or other types of mobile devices, or stationary computing devices such as desktop computers or personal computers (PCs). The computing device 900 can also be a mobile or stationary server.

[0324] The processor 920 is used to execute the following computer program / instructions, which, when executed by the processor, implement the steps of the above-mentioned fault prediction method.

[0325] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on its differences from other embodiments. In particular, the computing device embodiments are basically similar to the fault prediction method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the fault prediction method embodiments.

[0326] An embodiment of this specification also provides a computer-readable storage medium storing a computer program / instructions that, when executed by a processor, perform the steps of the above-described fault prediction method or fault prediction model training method.

[0327] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the computer-readable storage medium embodiments are basically similar to the fault prediction method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the fault prediction method embodiments.

[0328] An embodiment of this specification also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the above-described fault prediction method or fault prediction model training method.

[0329] The above is an illustrative scheme of a computer program product according to this embodiment. It should be noted that the technical solution of this computer program product and the technical solution of the above-described fault prediction method belong to the same concept. For details not described in detail in the technical solution of the computer program product, please refer to the description of the technical solution of the above-described fault prediction method.

[0330] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0331] The computer instructions include computer program code, which may be in the form of source code, object code, executable file, or certain intermediate forms. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium may be appropriately added or removed according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media may not include electrical carrier signals and telecommunication signals.

[0332] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments in this specification are not limited to the described order of actions, because according to the embodiments in this specification, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to the embodiments in this specification.

[0333] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0334] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the embodiments described herein. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the embodiments, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A fault prediction method applied to a cloud computing system, the cloud computing system including a service processing unit, the method comprising: Obtain the exception log data of the service processing unit and the log acquisition time of the exception log data; Based on the abnormal log data and the log acquisition time, determine the abnormal event sequence and the abnormal timestamp sequence; Based on the time interval threshold and the occurrence time of the abnormal events corresponding to the abnormal events in the abnormal event sequence, the abnormal events are grouped to obtain an abnormal grouping sequence; Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, the fault prediction result of the service processing unit is obtained using a fault prediction model.

2. The fault prediction method according to claim 1, wherein the fault prediction model is obtained through training via the following steps: Obtain the sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data; Based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data, determine the sample anomaly event sequence and the sample anomaly timestamp sequence; Based on the time interval threshold and the occurrence time of the sample anomaly corresponding to the sample anomaly in the sample anomaly sequence, the sample anomaly events are grouped to obtain a sample anomaly grouping sequence. Based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence, positive and negative samples are determined. A fault prediction model is trained based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

3. The fault prediction method according to claim 2, wherein determining the sample anomaly event sequence and the sample anomaly timestamp sequence based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data includes: Based on the sample anomaly log data, determine the positive sample anomaly event sequence and the negative sample anomaly event sequence; Based on the positive sample anomaly event sequence, the negative sample anomaly event sequence, and the sample log acquisition time of the sample anomaly log data, the positive sample anomaly timestamp sequence and the negative sample anomaly timestamp sequence are determined.

4. The fault prediction method according to claim 3, wherein grouping the sample abnormal events according to the time interval threshold and the sample abnormal event occurrence time corresponding to the sample abnormal event in the sample abnormal event sequence to obtain a sample abnormal grouping sequence includes: Based on the time interval threshold and the occurrence time of the positive sample anomaly corresponding to the positive sample anomaly in the positive sample anomaly sequence, the positive sample anomaly events are grouped to obtain a positive sample anomaly grouping sequence. Based on the time interval threshold and the occurrence time of the negative sample anomaly corresponding to the negative sample anomaly in the negative sample anomaly sequence, the negative sample anomaly events are grouped to obtain a negative sample anomaly grouping sequence.

5. The fault prediction method according to claim 4, wherein determining positive and negative samples based on the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence comprises: The positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence are used as positive samples, and the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence are used as negative samples.

6. The fault prediction method according to claim 3, wherein determining the positive sample anomaly event sequence and the negative sample anomaly event sequence based on the sample anomaly log data includes: Based on the sample anomaly information in the sample anomaly log data, a sequence of sample anomaly events is determined, and based on the sequence of sample anomaly events, a sequence of positive sample anomaly events and a sequence of negative sample anomaly events are determined.

7. The fault prediction method according to claim 6, wherein determining the sample anomaly event sequence based on the sample anomaly information in the sample anomaly log data includes: The sample anomaly information is processed to determine the sample anomaly event corresponding to the sample anomaly information; Based on the matching relationship between reference abnormal events and reference event identifiers in the abnormal event database, the sample event identifier corresponding to the sample abnormal event is determined; Based on the occurrence time of the sample anomaly corresponding to the sample anomaly event, the sample event identifiers are sorted to generate the sample anomaly event sequence.

8. The fault prediction method according to claim 6, wherein determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal event sequence comprises: The positive sample abnormal event sequence is determined from the sample abnormal event sequence based on the preset sampling time and preset sampling length; According to a preset negative sample sampling rule, the negative sample abnormal event sequence is determined from the sample abnormal event sequence, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio.

9. The fault prediction method according to claim 1, wherein determining the abnormal event sequence and the abnormal timestamp sequence based on the abnormal log data and the log acquisition time includes: The sequence of abnormal events is determined based on the abnormal information in the abnormal log data; Based on the time of occurrence of the anomaly information, determine the time of occurrence of the anomaly corresponding to the anomaly event in the anomaly event sequence; The abnormal timestamp sequence is determined based on the time of the abnormality occurrence and the time of log acquisition.

10. The fault prediction method according to claim 9, wherein determining the abnormal event sequence based on the abnormal information in the abnormal log data includes: The abnormal information is processed to determine the abnormal event corresponding to the abnormal information; The event identifier corresponding to the abnormal event is determined based on the matching relationship between the reference abnormal events and the reference event identifiers in the abnormal event database; The event identifiers are sorted according to the occurrence time of the abnormal events to generate the abnormal event sequence.

11. The fault prediction method according to claim 9, wherein determining the anomaly timestamp sequence based on the anomaly occurrence time and the log acquisition time includes: Calculate the time difference between the time the anomaly occurred and the time the log was retrieved; Based on the time difference and a preset time coding rule, the times of the anomaly occurrence are grouped, and the group number of each group is determined. The preset time coding rule is used to determine the group corresponding to the time of the anomaly occurrence based on the time difference. The anomaly occurrence time is encoded according to the group number to obtain the anomaly timestamp sequence.

12. The fault prediction method according to claim 10, wherein the step of sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence time of the abnormal events to generate an abnormal event sequence includes: Based on the occurrence time of the abnormal event, the event identifiers corresponding to the abnormal event are sorted using a preset sorting rule, and an abnormal event sequence is generated based on the sorted event identifiers.

13. The fault prediction method according to claim 1, wherein grouping the abnormal events according to a time interval threshold and the abnormal occurrence time corresponding to the abnormal events in the abnormal event sequence to obtain an abnormal grouping sequence includes: Based on the time interval threshold and the occurrence time of the abnormal event corresponding to the abnormal event in the abnormal event sequence, the abnormal events are grouped to obtain multiple abnormal event groups. Based on the position of the target abnormal event in each abnormal event group within the abnormal event sequence, the abnormal event is encoded to obtain an abnormal group sequence.

14. The fault prediction method according to claim 1, wherein obtaining the fault prediction result of the service processing unit based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence using a fault prediction model comprises: Based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, the event correlation matrix and the time correlation matrix are obtained using the self-attention layer of the fault prediction model. Based on the event correlation matrix and the time correlation matrix, the fault prediction result of the service processing unit is obtained.

15. The fault prediction method according to claim 14, wherein obtaining the event correlation matrix and the time correlation matrix using the self-attention layer of the fault prediction model based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence comprises: The abnormal event sequence is input into the first self-attention layer of the fault prediction model to obtain the event correlation matrix; The abnormal timestamp sequence and the abnormal grouping sequence are input into the second self-attention layer of the fault prediction model to obtain the time correlation matrix.

16. The fault prediction method according to claim 14, wherein obtaining the fault prediction result of the service processing unit based on the event correlation matrix and the time correlation matrix includes: Based on the event correlation matrix and the time correlation matrix, the attention matrix is ​​obtained using the attention fusion layer of the fault prediction model; Based on the attention matrix, determine the target feature vector; The target feature vector is input into the classification layer of the fault prediction model to obtain the fault prediction result of the service processing unit.

17. A fault prediction model training method, applied to a cloud computing system, the cloud computing system including a service processing unit, the method comprising: Obtain the sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data; Based on the sample anomaly log data and the sample log acquisition time of the sample anomaly log data, determine the sample anomaly event sequence and the sample anomaly timestamp sequence; Based on the time interval threshold and the occurrence time of the sample anomaly corresponding to the sample anomaly in the sample anomaly sequence, the sample anomaly events are grouped to obtain a sample anomaly grouping sequence. Based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence, positive and negative samples are determined. A fault prediction model is trained based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

18. The fault prediction model training method according to claim 17, wherein determining the sample abnormal event sequence and the sample abnormal timestamp sequence based on the sample abnormal log data and the sample log acquisition time of the sample abnormal log data includes: Based on the sample anomaly log data, determine the positive sample anomaly event sequence and the negative sample anomaly event sequence; Based on the positive sample anomaly event sequence, the negative sample anomaly event sequence, and the sample log acquisition time of the sample anomaly log data, the positive sample anomaly timestamp sequence and the negative sample anomaly timestamp sequence are determined.

19. The fault prediction model training method according to claim 18, wherein grouping the sample abnormal events according to the time interval threshold and the sample abnormal event occurrence time corresponding to the sample abnormal event in the sample abnormal event sequence to obtain a sample abnormal grouping sequence includes: Based on the time interval threshold and the occurrence time of the positive sample anomaly corresponding to the positive sample anomaly in the positive sample anomaly sequence, the positive sample anomaly events are grouped to obtain a positive sample anomaly grouping sequence. Based on the time interval threshold and the occurrence time of the negative sample anomaly corresponding to the negative sample anomaly in the negative sample anomaly sequence, the negative sample anomaly events are grouped to obtain a negative sample anomaly grouping sequence.

20. The fault prediction model training method according to claim 19, wherein determining positive samples and negative samples based on the sample abnormal event sequence, the sample abnormal timestamp sequence, and the sample abnormal grouping sequence comprises: The positive sample abnormal event sequence, the positive sample abnormal timestamp sequence, and the positive sample abnormal grouping sequence are used as positive samples, and the negative sample abnormal event sequence, the negative sample abnormal timestamp sequence, and the negative sample abnormal grouping sequence are used as negative samples.

21. The fault prediction model training method according to claim 18, wherein determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal log data includes: Based on the sample anomaly information in the sample anomaly log data, a sequence of sample anomaly events is determined, and based on the sequence of sample anomaly events, a sequence of positive sample anomaly events and a sequence of negative sample anomaly events are determined.

22. The fault prediction model training method according to claim 21, wherein determining the sample anomaly event sequence based on the sample anomaly information in the sample anomaly log data includes: The sample anomaly information is processed to determine the sample anomaly event corresponding to the sample anomaly information; Based on the matching relationship between reference abnormal events and reference event identifiers in the abnormal event database, the sample event identifier corresponding to the sample abnormal event is determined; Based on the occurrence time of the sample anomaly corresponding to the sample anomaly event, the sample event identifiers are sorted to generate the sample anomaly event sequence.

23. The fault prediction model training method according to claim 21, wherein determining the positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal event sequence comprises: The positive sample abnormal event sequence is determined from the sample abnormal event sequence based on the preset sampling time and preset sampling length; According to a preset negative sample sampling rule, the negative sample abnormal event sequence is determined from the sample abnormal event sequence, wherein the preset negative sample sampling rule is a rule for random sampling according to a preset ratio.

24. A fault prediction device applied to a cloud computing system, the cloud computing system including a service processing unit, the device comprising: The data acquisition module is configured to acquire the exception log data of the service processing unit and the log acquisition time of the exception log data; The sequence determination module is configured to determine the sequence of abnormal events and the sequence of abnormal timestamps based on the abnormal log data and the log acquisition time. The sequence acquisition module is configured to group the abnormal events according to a time interval threshold and the abnormal occurrence time corresponding to the abnormal events in the abnormal event sequence, and obtain an abnormal grouping sequence. The result acquisition module is configured to obtain the fault prediction result of the service processing unit based on the abnormal event sequence, the abnormal timestamp sequence, and the abnormal grouping sequence, using a fault prediction model.

25. A fault prediction model training device, applied to a cloud computing system, the cloud computing system including a service processing unit, the device comprising: The data acquisition module is configured to acquire sample anomaly log data of the service processing unit and the sample log acquisition time of the sample anomaly log data; The sequence determination module is configured to determine the sample abnormal event sequence and the sample abnormal timestamp sequence based on the sample abnormal log data and the sample log acquisition time of the sample abnormal log data. The sequence acquisition module is configured to group the sample abnormal events according to a time interval threshold and the sample abnormality occurrence time corresponding to the sample abnormality events in the sample abnormality event sequence, and obtain a sample abnormality grouping sequence. The sample determination module is configured to determine positive and negative samples based on the sample anomaly event sequence, the sample anomaly timestamp sequence, and the sample anomaly grouping sequence. The training module is configured to train a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

26. A computing device, comprising: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer programs / instructions are executed by the processor, they implement the steps of the fault prediction method according to any one of claims 1 to 16, or the fault prediction model training method according to any one of claims 17 to 23.

27. A computer-readable storage medium storing a computer program / instructions that, when executed by a processor, implement the steps of the fault prediction method according to any one of claims 1 to 16, or the fault prediction model training method according to any one of claims 17 to 23.

28. A computer program product comprising a computer program / instructions which, when executed by a processor, implement the fault prediction method of any one of claims 1 to 16, or the fault prediction model training method of any one of claims 17 to 23.

Images