A method and device for monitoring abnormal data of an APP and a medium

Abstract

The present application relates to the technical field of data processing, and more particularly to an APP abnormal data monitoring method, device and medium, wherein the first and second attenuation weights are determined by analyzing historical behavior and environment data, and the historical data is weighted, so as to realize dynamic value distribution of the historical data in the time dimension and the environment dimension, balance the inheritance of the model to the stable behavior rule and the learning of the new behavior mode and the new environment; the historical data after the weighting processing is used to fine-tune the time series prediction model, so that the model can quickly adapt to the current behavior and operation rule, retain the basic ability, efficiently learn the new correlation mode, and output the prediction result more suitable for the actual operation scene; the target behavior data is input into the updated time series prediction model to obtain the predicted operation data, which is used to reflect the reasonable operation state under the current behavior mode, and then compared with the target operation data to obtain the abnormal data monitoring result, thereby improving the monitoring accuracy of the APP abnormal data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to an APP abnormal data monitoring method, device and medium. BACKGROUND

[0002] With the development of mobile Internet, the complexity of APP functions and the diversity of user behaviors are significantly improved, and the abnormal monitoring of APP running state becomes a key link to ensure user experience. In the prior art, the monitoring of APP abnormal data mainly relies on fixed threshold to judge the abnormality, but the normal range of APP running parameters will dynamically change with user behaviors and environment, the fixed threshold cannot consider the time effectiveness difference and the importance attenuation change of data, resulting in misjudgment when analyzing abnormal data, and it is difficult to meet the monitoring demand of APP abnormal data.

[0003] Therefore, how to comprehensively consider the influence of dynamic changes of user behaviors and environment on the normal range of APP running parameters, so as to improve the monitoring accuracy of APP abnormal data has become a problem to be solved. SUMMARY

[0004] In view of the above technical problems, the technical scheme adopted by the present application is an APP abnormal data monitoring method, which comprises the following steps:

[0005] S1, according to the historical behavior data of the target APP, the first attenuation weight corresponding to each preset time period is obtained, wherein the historical behavior data is the data corresponding to the behavior parameters of the target APP in the preset time period, the first attenuation weight is the behavior transition adaptability of the historical behavior data and the historical running data in the time dimension, and the historical running data is the data corresponding to the running parameters of the target APP in the preset time period.

[0006] S2, according to the historical environment data of the target APP in each preset time period, the second attenuation weight corresponding to each preset time period is obtained, wherein the historical environment data is the data corresponding to the environment parameters of the target APP in each preset time period, and the second attenuation weight is the importance weight of the historical behavior data and the historical running data in the environment dimension.

[0007] S3, the historical behavior data and the historical running data are weighted processed according to the first attenuation weight and the second attenuation weight.

[0008] S4, the preset time sequence prediction model is updated according to the weighted processed historical behavior data and historical running data.

[0009] S5, input the target behavior data of the target APP in the current monitoring time period into the updated time sequence prediction model to obtain predicted running data corresponding to the target behavior data.

[0010] S6, compare the predicted running data with the target running data of the target APP to obtain an abnormal data monitoring result of the target APP in the current monitoring time period.

[0011] The application further provides a non-transitory computer-readable storage medium, which stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by a processor to implement the APP abnormal data monitoring method.

[0012] The application further provides an electronic device, which comprises a processor and the non-transitory computer-readable storage medium.

[0013] The application has at least the following beneficial effects: the first decay weight is determined by analyzing the historical behavior data, the second decay weight is determined by analyzing the historical environment data, the historical behavior data and the running data are weighted by combining the first decay weight and the second decay weight, the dynamic value distribution of the historical data in the time dimension and the environment dimension is realized, the inheritance of the time sequence prediction model to the stable behavior rule and the learning of the new behavior mode and the new environment are balanced, the model training can focus on more valuable historical data, and the interference of low-value data is reduced; the time sequence prediction model is fine-tuned by using the weighted historical data, the model can quickly adapt to the behavior and running rule of the current APP, the basic ability of the model is retained, and new correlation patterns can be efficiently learned, so that the prediction result output by the model is more suitable for the actual running scene; the target behavior data in the current monitoring time period is input into the updated time sequence prediction model to obtain the predicted running data, the reasonable running state under the current behavior mode is reflected, and an explicit contrast benchmark is provided for the abnormality judgment, and then the abnormal data monitoring result is obtained by comparing the predicted running data with the target running data, and the APP abnormal data monitoring accuracy is improved. BRIEF DESCRIPTION OF DRAWINGS

[0014] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0015] Figure 1 A flowchart of an APP abnormal data monitoring method provided by the first embodiment of the application. DETAILED DESCRIPTION

[0016] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0017] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It can be understood that the above-described terms for distinguishing similar objects can be interchanged under appropriate circumstances, so that the present application can also be implemented in other embodiments in addition to the above-described illustrated embodiments or described embodiments. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0018] Embodiment one

[0019] The embodiment one provides an APP abnormal data monitoring method, which comprises the following steps, as shown in Figure 1

[0020] S1, according to the historical behavior data of the target APP, the first decay weight corresponding to each preset time period is obtained, wherein the historical behavior data is the data corresponding to the historical behavior data of the target APP in the preset time period, the first decay weight is the behavior transition adaptability of the historical behavior data and the historical running data in the time dimension, and the historical running data is the data corresponding to the historical running data of the target APP in the preset time period.

[0021] Among them, the target APP is the application program that needs to be monitored for abnormal data at present, for example, social APP, e-commerce APP and other specific applications.

[0022] The preset time period is a time granularity set in advance for analyzing historical data, for example, 1 hour / time period, 1 day / time period, which is used to divide continuous historical data into standardized time units, so as to facilitate the unified calculation of behavior characteristics and weight of each time period and ensure the standardization of data processing.

[0023] ​Behavior parameters are quantitative indicators describing user interaction behavior with the APP, including but not limited to: click frequency (times / time period), page switching times (times / time period), function module call duration (seconds / time period), network request frequency (times / time period), etc. Behavior parameters reflect user behavior patterns and can be used as a basis for judging behavior changes, for example, a sudden change in click frequency may indicate a change in behavior patterns.

[0024] Running parameters are quantitative indicators reflecting system resource occupation, performance, and stability of the target APP during running, and are the core basis for measuring whether the APP is running normally, including but not limited to: CPU usage, memory usage, disk read / write speed, page response time, network request time, frame rate, crash frequency, unresponsive duration, etc. Running parameters fluctuate dynamically with user behavior and environmental changes, and their value ranges are directly related to behavior parameters and environmental parameters.

[0025] The first decay weight is used to measure the adaptability of historical behavior data and historical running data in the time dimension, and by distinguishing whether behavior has changed significantly, it assigns differentiated weights to data in different time periods, ensuring that the time series prediction model can dynamically respond to behavior changes: when the behavior pattern is stable, rely on stable period data to consolidate the basic law; when behavior changes, use higher-weight transition period data to accelerate learning of new laws, avoiding the time series prediction model being bound by outdated behavior patterns, and ensuring that new behavior and new running state associations are captured more timely and accurately.

[0026] APP user behavior patterns will change dynamically over time, such as version updates introducing new functions, user operation habits evolving, etc. If a significant behavior change occurs in a preset time period, the data in that period contains new associations between behavior and running, and needs to be given a higher weight to accelerate the data adaptability of the time series prediction model.

[0027] Therefore, the present embodiment quantifies the behavior change of historical behavior data in the time dimension, assigns differentiated weights to historical data corresponding to different behavior patterns, and makes subsequent time series prediction model training more focused on new laws during behavior changes.

[0028] As described above, the first decay weight is calculated based on the change of historical behavior data, achieving dynamic value distribution of historical data in the time dimension, balancing the inheritance of stable behavior patterns and the learning of new behavior patterns by the time series prediction model; and by simultaneously acting on historical behavior data and historical running data through the first decay weight, the association between behavior and running in a certain period is strengthened or weakened as a whole, avoiding distortion of the association relationship due to the split of the two weights, and providing a consistent time reference for subsequent model learning.

[0029] In an embodiment, S1 comprises the following steps:

[0030] S11, according to historical behavior data, calculating the coefficient of variation corresponding to each behavior parameter in each preset time period, wherein the coefficient of variation is the ratio of the standard deviation to the mean of the corresponding behavior parameter.

[0031] S12, for any preset time period, the coefficient of variation corresponding to each behavior parameter in the current preset time period is aggregated by weighting, and the comprehensive coefficient of variation corresponding to the current preset time period is obtained, wherein the weight of the weighted aggregation is set according to the influence degree of each behavior parameter on the running of the target APP.

[0032] S13, according to the comprehensive coefficient of variation corresponding to each preset time period, the first judgment result corresponding to each preset time period is obtained, wherein the first judgment result is whether the behavior transition occurs or not.

[0033] S14, according to the first judgment result corresponding to each preset time period, the first decay weight corresponding to each preset time period is obtained.

[0034] The standard deviation is used to describe the dispersion degree of the behavior parameter in the preset time period, the mean is used to describe the average level of the behavior parameter in the preset time period, and the central tendency of the behavior is reflected. The coefficient of variation is a standardized index for measuring the dispersion degree of data, which realizes the horizontal comparison of the fluctuation degree of different behavior parameters by eliminating the dimension influence. When the coefficient of variation of the behavior parameter suddenly increases, it reflects that the user behavior mode corresponding to the behavior parameter changes.

[0035] The influence degree of different behavior parameters on the running of the APP is different, such as the influence of network request frequency on CPU occupation is much greater than the influence of font switching times on CPU occupation, therefore, the influence weight of each behavior parameter on the running parameter is obtained, and the coefficients of variation corresponding to all behavior parameters in the current preset time period are weighted and summed, so as to highlight the fluctuation contribution of key parameters through weighted aggregation, and avoid the interference of secondary parameters on the judgment of behavior transition. The specific value of the weight of each behavior parameter in the weighted aggregation can be set by the implementer according to the actual situation.

[0036] The above, through the coefficient of variation value, the stability of the behavior mode is objectively reflected, and the judgment whether the behavior transition occurs is avoided to depend on artificial experience; through the weighted aggregation of the comprehensive multi-parameter influence, the transition signal of the key behavior is more prominent, and the judgment is avoided to be disturbed by the random fluctuation of the secondary parameter, so as to improve the scientific nature and accuracy of the behavior transition judgment.

[0037] In an embodiment, S13 comprises the following steps:

[0038] S131, determining the first judgment result of the preset time period corresponding to the comprehensive variation coefficient less than or equal to the first preset threshold as no behavior transition.

[0039] S132, determining the preset time period corresponding to the comprehensive variation coefficient greater than the first preset threshold as a reference time period.

[0040] S133, determining a plurality of reference time periods that are continuous in time as intermediate time periods.

[0041] S134, for any intermediate time period, if the number of reference time periods contained in the current intermediate time period is greater than the first number threshold, it is determined that the current intermediate time period has a behavior transition, and it is determined that the first judgment result of each preset time period contained in the current intermediate time period is a behavior transition.

[0042] S135, if the number of reference time periods contained in the current intermediate time period is less than or equal to the first number threshold, it is determined that the current intermediate time period has no behavior transition, and it is determined that the first judgment result of each preset time period contained in the current intermediate time period is no behavior transition.

[0043] Wherein, the comprehensive variation coefficient reflects the overall fluctuation degree of the behavior parameter, when the comprehensive variation coefficient ≤ the first preset threshold, it reflects that the corresponding behavior mode is in the stable range, and no special attention is needed. Wherein, the first preset threshold is the upper limit value of the comprehensive variation coefficient based on historical stable period data statistics, as the boundary of normal fluctuation and abnormal fluctuation, which can be set by the implementer combined with the APP type, for example, the threshold of tool class APP is 0.6, and the threshold of payment class APP is 0.4.

[0044] When the comprehensive variation coefficient is greater than the first preset threshold, the fluctuation of the behavior parameter exceeds the normal range, and this period of time may contain the change signal of the behavior mode. Considering that the high comprehensive variation coefficient of a single time period may be random fluctuation, and the high variation coefficient of continuous multiple time periods can better represent the real behavior transition, therefore, the number condition of continuous time period is further set to judge the behavior transition, by aggregating the continuous reference time period, the fluctuation with time continuity can be focused on, the false positive probability is reduced, and the transition node of the behavior mode is accurately positioned.

[0045] Correspondingly, the intermediate time period is a set composed of a plurality of reference time periods that are continuous in time, for converting isolated fluctuation period into analysis unit with time and space correlation, such as 10:00-11:00, 11:00-12:00, 12:00-13:00, three continuous reference time periods make up a 3-hour intermediate time period.

[0046] The more the number of reference time periods contained in the intermediate time period, the stronger the persistence of the behavior fluctuation, and the more likely it is a real behavior change. The first number threshold, as the minimum number of continuous reference time periods required to determine a behavior change, can be statistically derived from historical change cases. For example, set the first number threshold to 3 as the boundary between quantifying persistent fluctuations and temporary fluctuations.

[0047] As described above, by filtering normal behavior fluctuations through the first preset threshold, only suspicious time periods exceeding the threshold are retained, reducing the amount of data for subsequent analysis and improving the efficiency of behavior change determination. By aggregating consecutive time periods, isolated fluctuations are avoided, ensuring that the behavior change determination result reflects a persistent change in behavior rather than random operations, making the behavior change determination more consistent with the persistence of behavior patterns. By quantifying the change standard through the first number threshold, the behavior change determination logic is shifted from experience-driven to rule-driven, avoiding misjudgment due to subjective experience differences and improving the reproducibility and rationality of the behavior change determination method.

[0048] In a specific embodiment, S14 includes the following steps:

[0049] S141, for any preset time period, if the first determination result of the current preset time period is that no behavior change has occurred, the first preset weight is determined as the first decay weight corresponding to the historical behavior data and historical running data in the current preset time period.

[0050] S142, if the first determination result of the current preset time period is that a behavior change has occurred, the second weight is obtained according to the first preset weight and the number of reference time periods contained in the intermediate time period corresponding to the current preset time period, wherein the second weight is positively related to the number of reference time periods contained in the intermediate time period corresponding to the current preset time period, and the second weight is greater than the first preset weight.

[0051] S143, the second weight is determined as the first decay weight corresponding to the historical behavior data and historical running data in the current preset time period.

[0052] Wherein, the first preset weight is the basic decay weight for the period when no behavior change occurs, used to quantify the time correlation of non-change period data. The specific value of the first preset weight can be set by the implementer according to the actual situation, for example, the first preset weight is set to 0.5.

[0053] The period of behavior change includes a new behavior pattern, and the corresponding historical data is more helpful for the time series prediction model to learn new rules. Therefore, weight enhancement is performed on the basis of the first preset weight, and the longer the duration of the transition, that is, the more the number of reference time periods, the greater the enhancement range, so as to highlight the influence of the continuous transition on the time series prediction model. For example, the second weight Q2=Q1*(1+L0), wherein Q1 is the first preset weight, and L0 is a normalized value of the number of reference time periods contained in the intermediate time period corresponding to the preset time period, and the maximum value normalization method can be used, so that the value range of L0 is (0, 1).

[0054] The above, by the first preset weight quantifying the time value of the non-transition period, the time series prediction model learns the stable behavior pattern, by the second weight strengthening the importance of the transition period, the time series prediction model focuses on capturing new behavior rules, and by the positive correlation between the weight and the transition persistence, the weight distribution is more suitable for the transition intensity, and a scientific quantitative basis is provided for subsequent weighted training.

[0055] S2, according to the historical environment data of the target APP in each preset time period, obtains the second decay weight corresponding to each preset time period, wherein the historical environment data is the data corresponding to each preset time period of the target APP in the past several preset time periods, and the second decay weight is the importance weight of the historical behavior data and the historical running data in the environment dimension.

[0056] The historical environment data is related data of the environment in which the target APP runs in the past several preset time periods, which is composed of the values of several environment parameters in the corresponding time period, and can provide original data for analyzing the environment characteristics of different time periods.

[0057] The environment parameter is a quantitative index for describing the external environment in which the APP runs, and is used to describe the running environment of the APP from multiple dimensions. In combination with the influencing factors of the running parameter, the environment parameter includes but is not limited to device model, CPU core number, memory capacity and other device hardware that affects the resource carrying capacity of the APP, and operating system version, system patch level and other operating systems that affect the running compatibility of the APP, and various types of parameters.

[0058] The second decay weight is used to measure the quantitative value of the importance of the historical behavior data and the historical running data in the environment dimension, so as to guide the time series prediction model to preferentially learn new rules after the environment changes, while taking into account the reference value of the data in the stable environment period.

[0059] In a specific embodiment, S2 includes the following steps:

[0060] S21, convert the historical environment data corresponding to each preset time period into an environment feature vector.

[0061] S22, for any preset time period, calculate the cosine similarity between the environment feature vector of the current preset time period and the environment feature vector of the previous preset time period.

[0062] S23, if the cosine similarity is less than the preset similarity threshold, determine that the second judgment result corresponding to the current preset time period is that the environment changes.

[0063] S24, if the cosine similarity is greater than or equal to the preset similarity threshold, determine that the second judgment result corresponding to the current preset time period is that the environment does not change.

[0064] S25, according to the second judgment result corresponding to each preset time period, obtain the second attenuation weight corresponding to each preset time period.

[0065] Among them, the data corresponding to the environmental parameters are mostly non-numeric or heterogeneous data, which are first converted into a unified vector form, and then the similarity calculation is carried out. The feature vector can compress multi-dimensional environmental information into an ordered numerical sequence, which is convenient for quantitative analysis of environmental differences.

[0066] The skilled person knows that any vector conversion method in the prior art falls within the protection scope of the present application, such as one-hot encoding or embedding vector, which will not be repeated here.

[0067] The cosine similarity is used to measure the direction consistency of two vectors, and the value range is [-1, 1], and the value is closer to 1, indicating that the environment features are more similar. By comparing the environment feature vectors of the current and previous time periods, the continuity change of the environment can be quantified, and the environment change can be avoided due to the single parameter fluctuation.

[0068] The preset similarity threshold is the critical value to distinguish between environmental stability and environmental mutation. If the cosine similarity is lower than the preset similarity threshold, it means that the direction difference of the environment features is significant, and it is determined that the environment changes; otherwise, it is determined that the environment does not change. The specific value of the preset similarity threshold can be determined based on the critical value of the historical environmental mutation cases, so as to ensure that the significant environmental changes affecting the running parameters can be captured, while the small fluctuations can be ignored. For example, the preset similarity threshold is set to 0.7.

[0069] By converting the historical environment data into the environment feature vector, the heterogeneous environment parameters can be uniformly quantified and analyzed. By calculating the cosine similarity of the environment feature vector, combining the preset similarity threshold to distinguish the environment change state, and combining the second judgment result to assign the second attenuation weight, the definition of the environment change is clearer, and the time series prediction model can adjust the degree of dependence on historical data according to whether the environment changes, avoiding the deviation in rule learning caused by the same treatment of data in the stable and changing environment periods, so that the time series prediction model can better capture the correlation between behaviors and operations in different environments, and improve the accuracy of abnormal monitoring in cross-environment scenarios.

[0070] In a specific embodiment, S25 includes the following steps:

[0071] S251, for any preset time period, if the second judgment result of the current preset time period is that no environment change occurs, the third preset weight is determined as the second attenuation weight corresponding to the historical behavior data and the historical operation data in the current preset time period.

[0072] S252, if the second judgment result of the current preset time period is that the environment changes, the fourth preset weight is determined as the second attenuation weight corresponding to the historical behavior data and the historical operation data in the current preset time period, and the fourth preset weight is greater than the third preset weight.

[0073] The period when the environment changes represents that a new environment scenario appears, and the correlation between behaviors and operation parameters in the new environment scenario may be different from the past. By setting the fourth preset weight greater than the third preset weight, the influence of the new environment data on the time series prediction model can be strengthened, and the time series prediction model can quickly learn the rules between behaviors and operations in the new environment, avoiding monitoring lag and result misjudgment caused by environment changes.

[0074] The specific values of the third preset weight and the fourth preset weight can be set by the implementer according to the actual situation, for example, the third preset weight is set to 0.6, and the fourth preset weight is set to 0.8.

[0075] The third preset weight is determined as the second decay weight of the period without environmental change, which can ensure that the time series prediction model sufficiently absorbs effective information in the stable environment during training, provides reliable regular basis for subsequent abnormal monitoring in similar stable environment, and avoids important data in the stable environment being ignored due to improper weight. The fourth preset weight greater than the third preset weight is determined as the second decay weight of the period with environmental change, which can make the time series prediction model focus more on the historical data in the new environment, and learn the association mode of the behavior parameter and the operation parameter in the new environment, so as to quickly adapt to the environmental change, reduce the abnormal monitoring lag or misjudgment problem caused by the environmental change, and improve the adaptation speed and monitoring accuracy of the time series prediction model to the new environment.

[0076] S3, performing weighted processing on the historical behavior data and the historical operation data according to the first decay weight and the second decay weight.

[0077] In a specific embodiment, S3 includes the following steps:

[0078] S31, for any behavior parameter in any preset time period, obtaining weighted data of the current behavior parameter in the current preset time period according to the data of the current behavior parameter in the current preset time period, the first decay weight corresponding to the current preset time period, the second decay weight, and the number of time periods between the current preset time period and the current monitoring time period.

[0079] S32, for any operation parameter in any preset time period, obtaining weighted data of the current operation parameter in the current preset time period according to the data of the current operation parameter in the current preset time period, the first decay weight corresponding to the current preset time period, the second decay weight, and the number of time periods between the current preset time period and the current monitoring time period.

[0080] The combination of the first decay weight and the second decay weight breaks the limitation of single dimension weight, so that the historical data of each preset time period can be matched with the importance according to the dual characteristics of behavior change and environmental change, and more actual scene matching input data is provided for subsequent model training.

[0081] The number of time periods between the current preset time period and the current monitoring time period is used to quantify the time distance between the historical data and the current monitoring scene, and is used as an additional decay factor to adjust the weight. Correspondingly, the more the interval number is, the weaker the relevance between the historical data and the current scene is, and the influence of the historical data needs to be further reduced through decay.

[0082] For the jth behavior parameter in the rth preset time period, the weighted data of the current behavior parameter in the current preset time period is obtained according to the data U 1 rj, the first decay weight R corresponding to the current preset time period r1 , the second decay weight R r2 , the number E of time periods between the current preset time period and the current monitoring time period r , the weighted data U of the current behavior parameter in the current preset time period is obtained 2 rj =U 1 rj ×((R r1 +R r2 ) / 2)×exp(-E r ), wherein exp() is an exponential function with e as the base, r=1, 2, …, W, W is the total number of preset time periods, j=1, 2, …, M, M is the total number of behavior parameters.

[0083] For the fth running parameter in the rth preset time period, the data V of the current running parameter in the current preset time period is obtained according to the data V of the current running parameter in the current preset time period 1 rf , the first decay weight R corresponding to the current preset time period r1 , the second decay weight R r2 , the number E of time periods between the current preset time period and the current monitoring time period r , the weighted data V of the current running parameter in the current preset time period is obtained 2 rf =V 1 rf ×((R r1 +R r2 ) / 2)×exp(-E r ), wherein f=1, 2, …, K, K is the total number of running parameters.

[0084] The above introduces the number of time intervals to adjust the weighted calculation of behavior parameters and running parameters, so that the behavior data closer to the current monitoring time period has a higher weight, which strengthens the influence of recent behavior patterns on the model and avoids the problem of outdated behavior rules due to too long time distance. The behavior parameters and running parameters in the same preset time period introduce a unified time interval decay mechanism, so that the weighted data of the behavior parameters and the running parameters are decayed synchronously in the time dimension, ensuring that the association between behavior and running is not fragmented in the time decay process, and further ensuring that the association between the two is completely preserved and strengthened in the model training, so that the time series prediction model can more accurately capture the internal rules between behavior triggering and running response, which helps to improve the accuracy of subsequent predicted running data.

[0085] S4, updating the preset time series prediction model according to the weighted historical behavior data and the weighted historical running data.

[0086] S41, filtering out a target time period in which no abnormality occurs from all preset time periods according to abnormal data monitoring results corresponding to each preset time period.

[0087] S42, updating parameters of a full connection layer and an attention layer in a preset time series prediction model by taking weighted historical behavior data in the target time period as input samples and taking corresponding weighted historical running data as training labels, to obtain an updated time series prediction model.

[0088] The abnormal data monitoring result refers to whether there is an abnormal data record in a certain preset time period determined through a historical monitoring process, including two states of "abnormality occurs" and "abnormality does not occur", which serves as a basis for filtering the target time period and can determine which historical data belongs to valid samples in a normal running state, providing high-quality learning materials for the time series prediction model.

[0089] The target time period is a time period in which "no abnormality occurs" filtered from all preset time periods, that is, the running parameters of the APP in this period are within the normal range, and the association between behavior and running conforms to the conventional rules, which is used to limit the data range of model training, to ensure that the input samples and training labels come from the normal state, and to avoid the interference of special data in the abnormal period on the learning of the time series prediction model on normal rules.

[0090] The weighted historical behavior data and historical running data in the target time period have incorporated the importance difference of time and environment dimensions, based on which the time series prediction model is fine-tuned, so that the time series prediction model can focus on learning the rules closely related to the current scene and avoid being biased by outdated or environment-different data. Compared with full retraining, fine-tuning can efficiently update the cognition of new rules while preserving the basic capabilities of the model, balancing the adaptability of the model and the training cost.

[0091] The underlying network of the LSTM (Long Short-Term Memory, Long Short-Term Memory Network) model is responsible for capturing basic time series features, and the full connection layer and the attention layer are responsible for mapping time series features to specific running parameter prediction results and focusing on the features of key time steps. The attention layer can automatically adjust the attention degree to different time steps according to the importance of the weighted data in the target time period, for example, giving higher attention weight to the features of the behavior transition period. Fine-tuning updates the parameters of this layer, which can make the time series prediction model more sensitive to the influence of key behaviors on running parameters when predicting running data, improving the accuracy of prediction.

[0092] The parameters of the bottom network include weight matrices and bias vectors of input gates, forget gates, and output gates, which are used to control the information update and retention of the cell state; the initial values of the cell state and the initial weights of the hidden state, which are used to capture the long-term dependence of the time series data; and the number of neurons of the LSTM layer, the dropout ratio, and the recurrent kernel parameters, which are used to construct the extraction network structure of the time series features.

[0093] In this embodiment, the parameters of the bottom network remain fixed during the model fine-tuning process, and only the parameters of the fully connected layer and the attention layer are adjusted, which can quickly adapt to new rules and avoid damaging the underlying time series capabilities, greatly reducing the training time and meeting the real-time monitoring requirements for model update speed.

[0094] On the basis of known training samples and training labels, those skilled in the art know that the update training method of the time series prediction model in the prior art falls within the protection scope of the present application, and will not be described here.

[0095] The above, by screening the target time period according to the abnormal monitoring result, the model training data only contains the behavior and operation data in the normal operation state, avoiding that the special association in the abnormal period is learned by the model as a normal rule, ensuring that the learning benchmark of the time series prediction model is more consistent with the regular operation state of the APP; taking the weighted data in the target time period as the learning object can more accurately capture the time series dependence between the behavior trigger and the operation response, avoid the rule learning deviation caused by the high proportion of invalid information in the original data, make the learning of the time series prediction model on the normal operation rule more accurate, and the predicted operation parameter range is closer to the actual normal interval; the hierarchical parameter update strategy of the time series prediction model ensures the balance between learning efficiency and core capability; the updated time series prediction model can not only retain the cognition of the historical stable rule, but also quickly respond to the new rule brought by the behavior or environmental change, providing a reliable prediction benchmark for subsequent abnormal monitoring.

[0096] In a specific embodiment, S4 further includes a multi-parameter integration and time series feature construction step.

[0097] Specifically, S4 further includes the following steps:

[0098] S43, for each preset time period, arranging the weighted data of all behavior parameters corresponding to the current preset time period in a preset order to form a behavior feature vector corresponding to the current preset time period.

[0099] S44, concatenating the behavior feature vectors of the i th to the i+N th preset time periods in chronological order to form a behavior time series feature matrix, where N is the number of time steps, i=1, 2, …, W-N, and W is the total number of preset time periods.

[0100] S45, arrange the weighted data of all running parameters corresponding to the current preset time period in a preset order to form a running feature vector corresponding to the current preset time period.

[0101] S46, concatenate the running feature vectors of the i-th to the i+N-th preset time periods in chronological order to form a running time sequence feature matrix corresponding to the current preset time period.

[0102] S47, standardize the behavior time sequence feature matrix and the running time sequence feature matrix corresponding to the current preset time period.

[0103] S48, use the standardized behavior time sequence feature matrix as the input sample of the time sequence prediction model and use the standardized running time sequence feature matrix as the training label of the time sequence prediction model.

[0104] The preset order can be set by the implementer according to the actual situation to ensure that the feature vectors of different preset time periods have consistent dimension structures and avoid the model from being unable to identify the same type of features due to chaotic parameter order.

[0105] The dimension of the behavior time sequence feature matrix is (N, M) and the dimension of the running time sequence feature matrix is (N, K), where M is the total number of behavior parameters, K is the total number of running parameters, and the number of time steps N is the number of consecutive preset time periods concatenated when constructing the time sequence feature matrix, which determines the time dimension of the time sequence matrix and can be set according to the periodicity of the APP behavior to ensure that the time sequence feature matrix can contain a complete association period between behavior and running.

[0106] The input layer dimension of the time sequence prediction model matches the column number M of the behavior time sequence feature matrix, and the output layer dimension matches the column number K of the running time sequence feature matrix.

[0107] The feature value of each parameter after standardization is in the interval [-1, 1], and the standardization formula is X 1 =(X-X_ min ) / (X _max -X_ min )×2-1, where X 1 is the data after standardization, X is the original weighted data, X min and X max are the minimum and maximum values of the parameter in all time periods, respectively.

[0108] The above, by arranging multiple behavior parameters / operation parameters in the same time period into a vector in a preset order, the dispersed behavior data / operation data forms a structured feature unit, ensuring that the time series prediction model can capture the synergistic effect of multiple behavior parameters / operation parameters; by concatenating N behavior feature vectors / operation feature vectors in time sequence to form a matrix, the time sequence correlation of the behavior data / operation data is completely retained, providing a matching input-output pair for the time series prediction model to learn the mapping relationship between behavior sequence and operation sequence, thereby improving the prediction accuracy of the time series prediction model.

[0109] In a specific embodiment, the determination of the number of time steps N includes:

[0110] Calculate the autocorrelation coefficient of the historical behavior data in all preset time periods to determine the minimum period T of the behavior pattern.

[0111] Set the number of time steps N to be an integer multiple of the minimum period T.

[0112] The autocorrelation coefficient is used to measure the correlation index of the same behavior parameter at different time intervals, and is used to identify the periodicity of the behavior pattern. Correspondingly, when the period is equal to T, the autocorrelation coefficient increases significantly, for example, close to 1, indicating that the behavior pattern will reappear every T preset time period, and T is the minimum period, which is the shortest time interval for the APP behavior parameter to show similar trend, and is used as a reference for setting N, to ensure that the time series feature matrix can contain at least one complete behavior period, and provide sufficient time sequence context information for the model.

[0113] The specific multiple value can be set by the implementer according to the actual situation, for example, 2 times or 3 times.

[0114] Those skilled in the art know that the calculation method of autocorrelation coefficient in the prior art falls within the protection scope of the present application, and will not be repeated here.

[0115] The above, by calculating the autocorrelation coefficient to determine the minimum period T, the periodicity of the behavior pattern is converted from qualitative description to quantitative index, avoiding the deviation caused by empirical setting of the period, and ensuring that the setting of N is based on objective data rules; by setting N as an integer multiple of T, the time series feature matrix can completely cover the behavior period, ensuring that the model captures the correlation rules between periodic behavior and operation, avoiding incomplete learning of periodic features due to insufficient time steps, and improving the identification ability of the time series prediction model for periodic anomalies.

[0116] S5, input the target behavior data of the target APP in the current monitoring time period into the updated time series prediction model, and obtain the predicted operation data corresponding to the target behavior data.

[0117] The current monitoring time period is a preset time period in which the abnormal data monitoring is being performed, is consistent with the preset time period granularity of the historical data, is used to determine the time range of the model inference, ensures that the target behavior data and the historical training data match in time granularity, and avoids prediction deviation caused by time unit difference.

[0118] The target behavior data is real-time data corresponding to a plurality of behavior parameters of the target APP in the current monitoring time period, is used as an input of the time series prediction model, and reflects the interaction state between the current user and the target APP.

[0119] The predicted running data is a normal data range of a running parameter that should theoretically appear in the current monitoring time period, which is output by the time series prediction model based on the target behavior data, is used as a reference benchmark for judging abnormalities, and is compared with the actually collected target running data to determine whether there is an abnormality.

[0120] The above, based on the updated time series prediction model and the real-time target behavior data in the current monitoring time period, ensures that the predicted running data output matches the current behavior intensity and type, avoids the predicted running data from deviating from the actual situation, makes the predicted running data more accurate, and provides a benchmark reference that fits the actual situation for abnormal monitoring.

[0121] In a specific embodiment, S5 includes the following steps:

[0122] S51, forming a target behavior time series matrix according to the target behavior data in the current monitoring time period and N-1 preset time periods before the current monitoring time period.

[0123] S52, performing standardization processing on the target behavior time series matrix.

[0124] S53, inputting the standardized target behavior time series matrix into the updated time series prediction model to output reference running data with a dimension of (N, K).

[0125] S54, determining the data corresponding to the last preset time period in the reference running data as the predicted running data corresponding to the current monitoring time.

[0126] The time series prediction model needs to be inferred based on continuous behavior sequences, therefore, the embodiment integrates the target behavior data in the current monitoring time period and the N-1 preset time periods before the current monitoring time period, constructs a time series matrix consistent with the structure in the training stage, and provides a complete behavior context for the time series prediction model.

[0127] The acquisition manner and standardization processing manner of the target behavior timing matrix can refer to the acquisition manner of the behavior feature vector. Specifically, the weight corresponding to the current monitoring time period is a fifth preset weight. The specific value of the fifth preset weight can be set by the implementer according to the actual situation, for example, the fifth preset weight is 1, to ensure that the influence of the data of the current monitoring time period is maximized, and to avoid being weakened by the time decay mechanism.

[0128] By integrating the target behavior data of N time periods, the timing prediction model can be based on continuous behavior trends for prediction, fully utilizing the advantages of the timing prediction model, and improving the rationality of the prediction results.

[0129] S6, comparing the predicted running data and the target running data of the target APP, obtaining the abnormal data monitoring result of the target APP in the current monitoring time period.

[0130] Among them, for each corresponding parameter in the target running data and the predicted running data, a preset deviation calculation method is used to quantize to obtain a deviation value.

[0131] The preset deviation calculation method can use absolute deviation, relative deviation, and count deviation, etc. Among them, the absolute deviation is |target value-predicted mean value|, which is suitable for numerical parameters, such as memory occupancy; the relative deviation is |target value-predicted mean value| / predicted mean value x 100%, which is suitable for proportional parameters, such as CPU usage; and the count deviation is target value-predicted value, which is suitable for count parameters, such as crash frequency.

[0132] For each running parameter, a corresponding preset abnormal threshold is set, if the deviation value of the running parameter exceeds the corresponding preset abnormal threshold, it is determined that the running parameter "occurs abnormally"; otherwise, it is "not abnormal". The preset abnormal threshold can be set by the implementer according to historical abnormal cases or business requirements, for example, the preset abnormal threshold of CPU usage is set to 50%, and the preset abnormal threshold of crash frequency is set to 1 time.

[0133] Statistical abnormality determination results of all running parameters, if at least one parameter "occurs abnormally", the overall result of the current monitoring time period is "abnormal", and the abnormal parameter name, target value, predicted value and deviation value are recorded to form the abnormal data monitoring result; if all parameters are "not abnormal", the abnormal data monitoring result is "not abnormal".

[0134] By comparing the predicted running data and the target running data of the target APP, the abnormal data monitoring result is obtained, ensuring the objectivity and operability of the abnormality judgment, and providing a clear basis for the running maintenance of the target APP.

[0135] The embodiment determines the first attenuation weight by analyzing historical behavior data, determines the second attenuation weight by analyzing historical environment data, and realizes dynamic value distribution of the historical data in the time dimension and the environment dimension by weighting the historical behavior data and the running data by combining the first attenuation weight and the second attenuation weight, balances inheritance of the time sequence prediction model to the stable behavior rule and learning of the time sequence prediction model to the new behavior mode and the new environment, so that the model training can focus on more valuable historical data and reduce the interference of low-value data; the time sequence prediction model is fine-tuned by using the weighted historical data, so that the model can quickly adapt to the behavior and running rule of the current APP, retains the basic ability of the model, efficiently learns new correlation modes, and makes the prediction result output by the model more suitable for the actual running scene; the target behavior data of the current monitoring time period is input into the updated time sequence prediction model to obtain the predicted running data, which reflects the reasonable running state under the current behavior mode, provides an explicit contrast benchmark for abnormality judgment, and then the abnormal data monitoring result is obtained by comparing the predicted running data with the target running data, and the monitoring accuracy of the APP abnormal data is improved.

[0136] Embodiment two

[0137] The embodiment two of the application provides a non-transitory computer readable storage medium, which can be arranged in an electronic device to save at least one instruction or at least one program related to a method in the method embodiment, and the at least one instruction or the at least one program is loaded and executed by the processor to realize the APP abnormal data monitoring method provided in the above embodiment.

[0138] Embodiment three

[0139] The embodiment three of the application provides an electronic device, which comprises a processor and the non-transitory computer readable storage medium in the embodiment two of the application.

[0140] The above is only a preferred embodiment of the application, and does not limit the application in any form. Although the application has been disclosed as above, it is not intended to limit the application. Any person skilled in the art can make some changes or modifications to the above disclosed technical content without departing from the technical solution of the application, and the equivalent embodiments with equivalent changes are equivalent to the above embodiments. Any simple modification, equivalent change and modification of the above embodiments according to the technical essence of the application are still within the scope of the technical solution of the application.

Claims

1. A method of monitoring for APP exception data, the method comprising: The method comprises the following steps: S1, according to the historical behavior data of the target APP, obtaining the first attenuation weight corresponding to each preset time period, wherein the historical behavior data is the data corresponding to a plurality of behavior parameters of the target APP in a plurality of preset time periods, the first attenuation weight is the behavior transition adaptability of the historical behavior data and historical running data in the time dimension, and the historical running data is the data corresponding to a plurality of running parameters of the target APP in a plurality of preset time periods; S2, according to the historical environment data of the target APP corresponding to each preset time period, obtaining the second attenuation weight corresponding to each preset time period, wherein the historical environment data is the data corresponding to a plurality of environment parameters of the target APP in each preset time period, and the second attenuation weight is the importance weight of the historical behavior data and the historical running data in the environment dimension; S3, according to the first attenuation weight and the second attenuation weight, performing weighted processing on the historical behavior data and the historical running data, wherein S3 comprises the following steps: S31, for any behavior parameter in any preset time period, according to the data of the current behavior parameter in the current preset time period, the first attenuation weight corresponding to the current preset time period, the second attenuation weight, and the number of time periods between the current preset time period and the current monitoring time period, obtaining the weighted data of the current behavior parameter in the current preset time period; S32, for any running parameter in any preset time period, according to the data of the current running parameter in the current preset time period, the first attenuation weight corresponding to the current preset time period, the second attenuation weight, and the number of time periods between the current preset time period and the current monitoring time period, obtaining the weighted data of the current running parameter in the current preset time period; S4, updating the preset time sequence prediction model according to the weighted historical behavior data and the historical running data; S5, inputting the target behavior data of the target APP in the current monitoring time period into the updated time sequence prediction model to obtain the predicted running data corresponding to the target behavior data; S6, comparing the predicted running data and the target running data of the target APP to obtain the abnormal data monitoring result corresponding to the target APP in the current monitoring time period.

2. The method of claim 1, wherein, S1 comprises the following steps: S11, according to the historical behavior data, calculating the variation coefficient corresponding to each behavior parameter in each preset time period, wherein the variation coefficient is the ratio of the standard deviation to the mean value of the corresponding behavior parameter; S12, for any preset time period, weighting and aggregating the variation coefficients corresponding to each behavior parameter in the current preset time period to obtain the comprehensive variation coefficient corresponding to the current preset time period, wherein the weight of the weighting and aggregation is set according to the influence degree of each behavior parameter on the running of the target APP; S13, according to the comprehensive variation coefficient corresponding to each preset time period, performing behavior transition judgment to obtain the first judgment result corresponding to each preset time period, wherein the first judgment result is whether the behavior transition occurs or not. S14, obtaining, according to the first judgment result corresponding to each preset time period, a first decay weight corresponding to each preset time period.

3. The method of claim 2, wherein the APP exception data is monitored by: S13 comprises the following steps: S131, determining the first judgment result of the preset time period corresponding to the comprehensive variation coefficient less than or equal to the first preset threshold as no behavior transition; S132, determining the preset time period corresponding to the comprehensive variation coefficient greater than the first preset threshold as a reference time period; S133, determining a plurality of reference time periods continuous in time as intermediate time periods; S134, for any intermediate time period, if the number of reference time periods contained in the current intermediate time period is greater than a first number threshold, it is determined that the current intermediate time period has behavior transition, and it is determined that the first judgment result of each preset time period contained in the current intermediate time period is behavior transition; S135, if the number of reference time periods contained in the current intermediate time period is less than or equal to the first number threshold, it is determined that the current intermediate time period has no behavior transition, and it is determined that the first judgment result of each preset time period contained in the current intermediate time period is no behavior transition.

4. The method of claim 3, wherein the APP exception data is monitored by: S14 comprises the following steps: S141, for any preset time period, if the first judgment result of the current preset time period is no behavior transition, it is determined that the first preset weight is the first decay weight corresponding to the historical behavior data and the historical running data in the current preset time period; S142, if the first judgment result of the current preset time period is behavior transition, a second weight is obtained according to the first preset weight and the number of reference time periods contained in the intermediate time period corresponding to the current preset time period, wherein the second weight is in a positive correlation with the number of reference time periods contained in the intermediate time period corresponding to the current preset time period, and the second weight is greater than the first preset weight; S143, determining that the second weight is the first decay weight corresponding to the historical behavior data and the historical running data in the current preset time period.

5. The method of claim 1, wherein the APP exception data is monitored by: S2 comprises the following steps: S21, converting the historical environment data corresponding to each preset time period into an environment feature vector; S22, for any preset time period, calculating the cosine similarity between the environment feature vector of the current preset time period and the environment feature vector of the previous preset time period; S23, if the cosine similarity is less than a preset similarity threshold, it is determined that the second judgment result corresponding to the current preset time period is environment change; S24, if the cosine similarity is greater than or equal to the preset similarity threshold, it is determined that the second judgment result corresponding to the current preset time period is no environment change; S25, obtaining, according to the second judgment result corresponding to each preset time period, a second decay weight corresponding to each preset time period.

6. The method of claim 1, wherein, S25 comprises the following steps: S251, for any preset time period, if the second judgment result of the current preset time period is no environment change, it is determined that the third preset weight is the second decay weight corresponding to the historical behavior data and the historical running data in the current preset time period; S252, if the second determination result of the current preset time period is that the environment changes, determining that a fourth preset weight is a second decay weight corresponding to the historical behavior data and the historical running data in the current preset time period, wherein the fourth preset weight is greater than the third preset weight.

7. The method of claim 1, wherein the APP exception data is monitored by a plurality of monitoring devices. The preset time sequence prediction model is an LSTM model, and S4 includes the following steps: S41, according to the abnormal data monitoring result corresponding to each preset time period, screening a target time period in which no abnormality occurs from all preset time periods; S42, taking the weighted historical behavior data in the target time period as an input sample, taking the corresponding weighted historical running data as a training label, updating parameters of a full connection layer and an attention layer in the preset time sequence prediction model, and obtaining an updated time sequence prediction model. 8.A non-transitory computer-readable storage medium having stored therein at least one instruction or at least one piece of program, characterized in that, The at least one instruction or the at least one program is loaded and executed by the processor to implement the APP abnormal data monitoring method in any one of claims 1-7.

9. An electronic device, comprising: The non-transitory computer readable storage medium includes a processor and the non-transitory computer readable storage medium in claim 8.

Images