Fault prediction method and device, equipment, storage medium and program product

Abstract

The invention provides a fault prediction method and device, equipment, a storage medium and a program product, and the method comprises the steps: obtaining a plurality of pieces of initial performance information corresponding to a plurality of performance indexes of target equipment, and the initial performance information comprises a plurality of pieces of performance data of the target equipment under the performance indexes in a historical time period; obtaining event information of a plurality of abnormal events of the target equipment, wherein occurrence moments of the plurality of abnormal events are within a historical time period; and determining a fault prediction result of the target equipment according to the multiple pieces of initial performance information and the event information. And the accuracy of fault prediction on the target equipment is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the computer field, and in particular, to a fault prediction method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] A device may fail during operation, thereby affecting the business running in the device, and therefore, in order to avoid affecting the business, the device can be subjected to fault prediction.

[0003] During operation, each occurrence of an abnormal event of a target device can correspond to the generation of an abnormal log. In related technologies, a plurality of abnormal logs of the target device can be acquired, and the plurality of abnormal logs can be subjected to analysis processing and feature extraction processing to obtain a feature sequence, and then the target device can be subjected to fault prediction according to the feature sequence. However, in the above manner, the feature sequence obtained based on the abnormal log does not comprehensively express information, thereby resulting in low accuracy of fault prediction of the target device. SUMMARY

[0004] Aspects of the present application provide a fault prediction method, device, equipment, storage medium and program product to solve the problem of low accuracy of fault prediction of a target device.

[0005] In a first aspect, an embodiment of the present application provides a fault prediction method, comprising:

[0006] Acquiring a plurality of initial performance information corresponding to a plurality of performance indicators of a target device, the initial performance information comprising a plurality of performance data of the target device under the performance indicators within a historical period;

[0007] Acquiring event information of a plurality of abnormal events of the target device, the occurrence time of the plurality of abnormal events being located within the historical period;

[0008] Determining a fault prediction result of the target device according to the plurality of initial performance information and the event information.

[0009] In a possible implementation, determining the fault prediction result of the target device according to the plurality of initial performance information and the event information comprises:

[0010] Determining the number of events of the plurality of abnormal events;

[0011] According to the number of events, performing feature mapping processing on the plurality of initial performance information to obtain a plurality of target performance information, the number of performance features included in the target performance information being the same as the number of events;

[0012] Determining the fault prediction result according to the plurality of target performance information and the event information.

[0013] In a possible implementation, for any one initial performance information, the initial performance information is subjected to feature mapping processing according to the number of events, to obtain target performance information corresponding to the initial performance information, including:

[0014] determining a preset dimension;

[0015] performing feature extraction processing and mapping processing on the initial performance information according to the number of events and the preset dimension, to obtain the target performance information.

[0016] In a possible implementation, the fault prediction result is determined according to the plurality of target performance information and the event information, including:

[0017] performing splicing processing on the plurality of target performance information, to obtain spliced performance information;

[0018] processing the spliced performance information and the event information, to obtain the fault prediction result.

[0019] In a possible implementation, the processing of the spliced performance information and the event information to obtain the fault prediction result includes:

[0020] performing N times of fusion processing on the spliced performance information and the event information, to obtain target performance features and target event features, where N is an integer greater than or equal to 1;

[0021] determining the fault prediction result according to the target performance features and the target event features.

[0022] In a possible implementation, the determination of the fault prediction result according to the target performance features and the target event features includes:

[0023] performing splicing processing on the target performance features and the target event features, to obtain target features;

[0024] performing enhancement processing on the target features, to obtain target enhanced features;

[0025] determining the fault prediction result according to the target enhanced features.

[0026] In a possible implementation, the performing of N times of fusion processing on the spliced performance information and the event information to obtain target performance features and target event features includes:

[0027] performing fusion processing on the spliced performance information and the event information, to obtain first performance features and first event features;

[0028] Fusing the i-1th performance feature and the i-1th event feature to obtain an i th performance feature and an i th event feature; wherein i is 2, 3, …, N in turn, the N th performance feature is determined as the target performance feature, and the N th event feature is determined as the target event feature.

[0029] In a possible implementation, the event information of the plurality of abnormal events of the target device is acquired, including:

[0030] Determining an event type and an occurrence time of each abnormal event;

[0031] For any one abnormal event, determining a multi-dimensional event feature of the abnormal event according to the event type of the abnormal event;

[0032] Generating the event information according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event, the event information including the multi-dimensional event feature of each abnormal event.

[0033] In a possible implementation, determining a multi-dimensional event feature of the abnormal event according to the event type of the abnormal event includes:

[0034] Acquiring preset feature information, the preset feature information including a plurality of event types and event features corresponding to each event type;

[0035] Determining the multi-dimensional event feature of the abnormal event according to the event type of the abnormal event and the preset feature information.

[0036] In a possible implementation, generating the event information according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event includes:

[0037] Combining the multi-dimensional event features of the plurality of abnormal events in the order from late to early occurrence time to obtain a combined event feature;

[0038] Generating a time feature according to the occurrence time of each abnormal event;

[0039] Fusing the combined event feature and the time feature to obtain the event information.

[0040] In a possible implementation, generating a time feature according to the occurrence time of each abnormal event includes:

[0041] Determining a latest occurrence time among the plurality of occurrence times of the plurality of abnormal events;

[0042] Determining a time difference between each occurrence time and the latest occurrence time to obtain a plurality of time differences;

[0043] determine a feature value corresponding to each time difference, and combine the feature values of the plurality of time differences to obtain the time feature.

[0044] In a second aspect, an embodiment of the present application provides a fault prediction method, comprising:

[0045] obtaining a plurality of initial performance information corresponding to a plurality of performance indicators of a target device, the initial performance information including a plurality of performance data of the target device in a historical period under the performance indicators, and the target device being a cloud server;

[0046] obtaining event information of a plurality of abnormal events of the target device, the occurrence time of the plurality of abnormal events being located in the historical period;

[0047] determining a fault prediction result of the target device according to the plurality of initial performance information and the event information.

[0048] In a possible implementation, determining the fault prediction result of the target device according to the plurality of initial performance information and the event information comprises:

[0049] determining the number of events of the plurality of abnormal events;

[0050] performing feature mapping processing on the plurality of initial performance information according to the number of events to obtain a plurality of target performance information, the number of performance features included in the target performance information being the same as the number of events;

[0051] determining the fault prediction result according to the plurality of target performance information and the event information.

[0052] In a possible implementation, obtaining the event information of the plurality of abnormal events of the target device comprises:

[0053] determining the event type and occurrence time of each abnormal event;

[0054] for any one abnormal event, determining a multi-dimensional event feature of the abnormal event according to the event type of the abnormal event;

[0055] generating the event information according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event, the multi-dimensional event feature of each abnormal event being included in the event information.

[0056] In a third aspect, an embodiment of the present application provides a fault prediction device, the device comprising: a first obtaining module, a second obtaining module and a determining module, wherein,

[0057] The first obtaining module is configured to obtain a plurality of initial performance information corresponding to a plurality of performance indexes of a target device, wherein the initial performance information comprises a plurality of performance data of the target device in a historical period and under the performance indexes;

[0058] The second obtaining module is configured to obtain event information of a plurality of abnormal events of the target device, wherein occurrence moments of the plurality of abnormal events are located in the historical period;

[0059] The determining module is configured to determine a fault prediction result of the target device according to the plurality of initial performance information and the event information.

[0060] In a possible implementation, the determining module is specifically configured to:

[0061] determine an event quantity of the plurality of abnormal events;

[0062] perform feature mapping processing on the plurality of initial performance information according to the event quantity, to obtain a plurality of target performance information, wherein a quantity of performance features included in the target performance information is the same as the event quantity;

[0063] determine the fault prediction result according to the plurality of target performance information and the event information.

[0064] In a possible implementation, for any one initial performance information, the determining module is specifically configured to:

[0065] determine a preset dimension;

[0066] perform feature extraction processing and mapping processing on the initial performance information according to the event quantity and the preset dimension, to obtain the target performance information.

[0067] In a possible implementation, the determining module is specifically configured to:

[0068] perform splicing processing on the plurality of target performance information, to obtain spliced performance information;

[0069] perform processing on the spliced performance information and the event information, to obtain the fault prediction result.

[0070] In a possible implementation, the determining module is specifically configured to:

[0071] perform N times of fusion processing on the spliced performance information and the event information, to obtain target performance features and target event features, wherein N is an integer greater than or equal to 1;

[0072] determine the fault prediction result according to the target performance features and the target event features.

[0073] In a possible implementation, the determining module is specifically configured to:

[0074] perform splicing processing on the target performance feature and the target event feature to obtain a target feature;

[0075] perform enhancement processing on the target feature to obtain a target enhanced feature;

[0076] determine the fault prediction result according to the target enhanced feature.

[0077] In a possible implementation, the determining module is specifically configured to:

[0078] perform fusion processing on the spliced performance information and the event information to obtain an i-th performance feature and an i-th event feature; wherein i is 2, 3, …, N in turn, the N-th performance feature is determined as the target performance feature, and the N-th event feature is determined as the target event feature.

[0079] perform fusion processing on the i-1-th performance feature and the i-1-th event feature to obtain an i-th performance feature and an i-th event feature; wherein i is 2, 3, …, N in turn, the N-th performance feature is determined as the target performance feature, and the N-th event feature is determined as the target event feature.

[0080] In a possible implementation, the second obtaining module is specifically configured to:

[0081] determine an event type and an occurrence time of each abnormal event;

[0082] for any one abnormal event, determine a multi-dimensional event feature of the abnormal event according to the event type of the abnormal event;

[0083] generate the event information according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event, wherein the multi-dimensional event feature of each abnormal event is included in the event information.

[0084] In a possible implementation, the second obtaining module is specifically configured to:

[0085] obtain preset feature information, wherein the preset feature information includes a plurality of event types and event features corresponding to the event types;

[0086] determine the multi-dimensional event feature of the abnormal event according to the event type of the abnormal event and the preset feature information.

[0087] In a possible implementation, the second obtaining module is specifically configured to:

[0088] perform combination processing on the multi-dimensional event features of the plurality of abnormal events in the order from late to early occurrence time to obtain a combined event feature;

[0089] generate a time feature according to a time of occurrence of each abnormal event;

[0090] fuse the combined event feature and the time feature to obtain the event information.

[0091] In a possible implementation, the second acquisition module is specifically configured to:

[0092] determine a latest time of occurrence among the multiple times of occurrence of the multiple abnormal events;

[0093] determine a time difference between each time of occurrence and the latest time of occurrence to obtain multiple time differences;

[0094] determine a feature value corresponding to each time difference, and combine the feature values of the multiple time differences to obtain the time feature.

[0095] In a fourth aspect, an embodiment of the present application provides a fault prediction device, the device comprising: a first acquisition module, a second acquisition module, and a determination module, wherein,

[0096] the first acquisition module is configured to acquire multiple initial performance information corresponding to multiple performance indicators of a target device, the initial performance information comprising multiple performance data of the target device in a historical period under the performance indicators, and the target device being a cloud server;

[0097] the second acquisition module is configured to acquire event information of multiple abnormal events of the target device, the times of occurrence of the multiple abnormal events being located in the historical period;

[0098] the determination module is configured to determine a fault prediction result of the target device according to the multiple initial performance information and the event information.

[0099] In a possible implementation, the determination module is specifically configured to:

[0100] determine an event quantity of the multiple abnormal events;

[0101] perform feature mapping processing on the multiple initial performance information according to the event quantity to obtain multiple target performance information, the number of performance features included in the target performance information being the same as the event quantity;

[0102] determine the fault prediction result according to the multiple target performance information and the event information.

[0103] In a possible implementation, the second acquisition module is specifically configured to:

[0104] determine an event type and a time of occurrence of each abnormal event;

[0105] For any one of the abnormal events, a multi-dimensional event feature of the abnormal event is determined according to an event type of the abnormal event;

[0106] According to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event, the event information is generated, and the multi-dimensional event feature of each abnormal event is included in the event information.

[0107] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a memory and a processor.

[0108] The memory stores computer execution instructions.

[0109] The processor executes the computer execution instructions stored in the memory, so that the processor executes the method in any one of the first aspect or the second aspect.

[0110] In a sixth aspect, an embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores computer execution instructions, when the computer execution instructions are executed by a processor, the computer execution instructions are used to implement the method in any one of the first aspect or the second aspect.

[0111] In a seventh aspect, an embodiment of the present application provides a computer program product, comprising a computer program, when the computer program is executed by a processor, the computer program implements the method in any one of the first aspect or the second aspect.

[0112] The embodiments of the present application provide a fault prediction method, device, equipment, storage medium and program product. An electronic device can acquire a plurality of initial performance information corresponding to a plurality of performance indexes of a target device, and acquire event information of a plurality of abnormal events of the target device, and then can determine a fault prediction result of the target device according to the plurality of initial performance information and the event information. Since the electronic device can perform fault prediction based on the event information of the plurality of abnormal events and the plurality of initial performance information, compared with the prior art which only performs fault prediction according to a feature sequence obtained based on an abnormal log, more comprehensive information is expressed, and therefore the accuracy of fault prediction of the target device is improved. BRIEF DESCRIPTION OF DRAWINGS

[0113] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application, and the illustrative embodiments of the present application and their description serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0114] Figure 1 A scene schematic diagram is provided for the exemplary embodiments of the present application;

[0115] Figure 2A flowchart of a fault prediction method provided for an exemplary embodiment of the present application is shown in FIG. 1.

[0116] Figure 3 A flowchart of another fault prediction method provided for an exemplary embodiment of the present application is shown in FIG. 2.

[0117] Figure 4 A process diagram of generating event information provided for an exemplary embodiment of the present application is shown in FIG. 3.

[0118] Figure 5 A structure diagram of a target model provided for an exemplary embodiment of the present application is shown in FIG. 4.

[0119] Figure 6 A flowchart of yet another fault prediction method provided for an exemplary embodiment of the present application is shown in FIG. 5.

[0120] Figure 7 A process diagram of a fault prediction method provided for an exemplary embodiment of the present application is shown in FIG. 6.

[0121] Figure 8 A structure diagram of a fault prediction device provided for an exemplary embodiment of the present application is shown in FIG. 7.

[0122] Figure 9 A structure diagram of a computing device provided for an exemplary embodiment of the present application is shown in FIG. 8. DETAILED DESCRIPTION

[0123] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards, and provide corresponding operation portal for user to choose authorization or refusal.

[0124] To make the objectives, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in conjunction with the embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0125] Figure 1 A scenario diagram provided for an exemplary embodiment of the present application is shown in FIG. 9. Figure 1 , including a target device and an electronic device.

[0126] The target device can have multiple performance indicators, and each performance indicator has corresponding initial performance information. For example, the performance indicator 1 of the target device can be the CPU utilization rate, and the initial performance information 1 corresponding to the CPU utilization rate can include multiple CPU utilization rates in a historical period.

[0127] In different cases, the initial performance information of the target device can be different, and thus the initial performance information of the target device can reflect the running state of the target device.

[0128] The target device can have multiple abnormal events in a historical period. The abnormal events can cause the target device to malfunction.

[0129] The electronic device can obtain multiple initial performance information and multiple abnormal events of the target device, and perform fault prediction on the target device according to the multiple initial performance information and the multiple abnormal events to determine a fault prediction result of the target device.

[0130] During the running process, the target device can generate an abnormal log corresponding to each abnormal event. In the related art, multiple abnormal logs of the target device can be obtained, and the multiple abnormal logs can be parsed and processed to obtain a feature sequence, and then the target device can be predicted according to the feature sequence. However, in the above manner, the feature sequence obtained based on the abnormal log does not express comprehensive information, which leads to low accuracy of fault prediction of the target device.

[0131] In the embodiments of the present application, the electronic device can not only obtain event information of multiple abnormal events of the target device, but also obtain multiple initial performance information corresponding to multiple performance indicators of the target device, and then can determine a fault prediction result of the target device according to the multiple initial performance information and the event information. Compared with the prior art of only performing fault prediction according to the feature sequence obtained based on the abnormal log, the information expressed is more comprehensive, and thus the accuracy of fault prediction of the target device is improved.

[0132] In the following, the technical solutions shown in the present application are described in detail through specific embodiments. It should be noted that the following embodiments can exist independently, or can be combined with each other. For the same or similar content, it will not be repeated in different embodiments.

[0133] Figure 2 A flowchart of a fault prediction method provided by an exemplary embodiment of the present application is shown. Please refer to Figure 2 , the method can include:

[0134] S201, obtaining multiple initial performance information corresponding to multiple performance indicators of the target device.

[0135] The execution subject of the embodiment of the present application can be an electronic device, or a fault prediction apparatus arranged in the electronic device. The fault prediction apparatus can be implemented by software, or by a combination of software and hardware. The fault prediction apparatus can be a processor in the electronic device. For ease of understanding, the execution subject is taken as an example of the electronic device in the following description.

[0136] The target device can be a device that needs to be subjected to fault prediction. The target device can have multiple performance indicators. Each performance indicator has corresponding initial performance information.

[0137] For any one performance indicator, the initial performance information can include multiple performance data of the target device in a historical period under the performance indicator.

[0138] The historical period can be a period corresponding to a preset time length before the current time. The preset time length can be artificially preset.

[0139] For example, if the current time is 2024 / 4 / 25 14:00, and the preset time length is 3 days, the historical period can be from 2024 / 4 / 22 14:00 to 2024 / 4 / 25 14:00. If the performance indicator is CPU utilization, the corresponding initial performance information can include multiple CPU utilizations of the target device between 2024 / 4 / 22 14:00 and 2024 / 4 / 25 14:00.

[0140] Optionally, for any one performance indicator, the performance indicator can have a corresponding collection period. For example, the collection period 1 of the performance indicator 1 can be 1 hour (h); and the collection period of the performance indicator 2 can be 2 hours.

[0141] Optionally, the electronic device or the data collection device can determine multiple performance indicators of the target device. For any one performance indicator, the electronic device or the data collection device can collect multiple performance data of the target device under the performance indicator according to the collection period corresponding to the performance indicator, and store the multiple performance data in a preset storage space. The preset storage space can be in the electronic device, or in the data collection device, or in other storage devices.

[0142] The electronic device can determine multiple performance indicators of the target device, and then can obtain multiple initial performance information corresponding to the multiple performance indicators of the target device in a historical period in the preset storage space.

[0143] For example, if there are 2 performance indicators, CPU utilization and memory utilization, and the current time is 2024 / 4 / 25 14:00, and the historical period is 2024 / 4 / 22 14:00 to 2024 / 4 / 25 14:00, the electronic device can obtain initial performance information 1 corresponding to the CPU utilization of the target device in the preset storage space. The initial performance information 1 can include multiple CPU utilizations of the target device in the historical period. Assuming that the initial performance information 1 can be as shown in Table 1:

[0144] Table 1

[0145]

[0146] As shown in Table 1, the initial performance information 1 can include 72 CPU utilizations. Similarly, the electronic device can obtain initial performance information 2 corresponding to the memory utilization of the target device in the preset storage space. The initial performance information 2 can include multiple memory utilizations of the target device in the historical period. Assuming that the initial performance information 2 can be as shown in Table 2:

[0147] Table 2

[0148]

[0149] As shown in Table 2, the initial performance information 2 can include 36 memory utilizations.

[0150] S202, obtaining event information of multiple abnormal events of the target device.

[0151] The target device can occur multiple abnormal events during operation. For example, the abnormal event 1 can be an event of hardware error.

[0152] Since the target device generates an abnormal log corresponding to the abnormal event corresponding to each abnormal event, the electronic device can obtain multiple abnormal logs of the target device to determine multiple abnormal events according to the multiple abnormal logs.

[0153] For any abnormal event, the abnormal event has a corresponding occurrence time. The occurrence times of the multiple abnormal events can be located in the historical period. For example, if the historical period is 2024 / 4 / 22 14:00 to 2024 / 4 / 25 14:00, the occurrence times of the multiple abnormal events can be located in the historical period.

[0154] The electronic device can obtain event information of multiple abnormal events of the target device. The event information can include features of each abnormal event in d event dimensions.

[0155] Optionally, if there are L abnormal events (L is an integer greater than or equal to 1) and the event information includes the features of the L abnormal events in the d event dimensions, the event information can be represented as a d*L matrix A:

[0156]

[0157] wherein a dL represents the feature value of the Lth abnormal event in the dth event dimension. The first column element represents the feature value of the first abnormal event in the d event dimensions; the second column element represents the feature value of the second abnormal event in the d event dimensions; and the Lth column element represents the feature value of the Lth abnormal event in the d event dimensions.

[0158] For example, if the historical period is 2024 / 4 / 22 14:00 to 2024 / 4 / 25 14:00, if the target device has 100 abnormal events in this historical period, which are abnormal event 1, abnormal event 2, …, abnormal event 100, the event information can include the features of the 100 abnormal events. It is assumed that the event information can be as shown in matrix A1:

[0159]

[0160] S203, determining the fault prediction result of the target device according to the plurality of initial performance information and the event information.

[0161] In an optional embodiment, the fault prediction result of the target device can be determined according to the plurality of initial performance information and the event information by: determining the event quantity of the plurality of abnormal events; performing feature mapping processing on the plurality of initial performance information according to the event quantity to obtain a plurality of target performance information; and determining the fault prediction result according to the plurality of target performance information and the event information.

[0162] Since there are L abnormal events, the electronic device can determine that the event quantity of the plurality of abnormal events is L. Since there are a plurality of initial performance information, the electronic device can perform feature mapping processing on any one initial performance information according to the event quantity L to obtain the corresponding target performance information.

[0163] The target performance information can be represented by a multi-dimensional matrix. The number of performance features included in the target performance information is the same as the event quantity, i.e., the target performance information includes L performance features.

[0164] Optionally, if there are D preset dimensions (D is an integer greater than or equal to 1) and the target performance information includes L performance features, the target performance information can be represented by a D*L feature matrix B:

[0165]

[0166] wherein b DL The performance feature 1 can be represented by the eigenvalues in the first column; the performance feature 2 can be represented by the eigenvalues in the second column; and so on; and the performance feature L can be represented by the eigenvalues in the Lth column.

[0167] For example, if there are 100 abnormal events, the number of events is 100; if there are 2 initial performance information, which are initial performance information 1 and initial performance information 2 respectively, if the initial performance information 1 includes 72 CPU utilization rates as shown in Table 1, and if the initial performance information 2 includes 36 memory utilization rates as shown in Table 2, the electronic device can perform feature mapping processing on the initial performance information 1 according to the number of events 100 to obtain target performance information 1; and can perform feature mapping processing on the initial performance information 2 according to the number of events 100 to obtain target performance information 2, and the number of performance features included in the target performance information 1 and the target performance information 2 is 100. It is assumed that the target performance information 1 can be as shown in matrix B1, and the target performance information 2 can be as shown in matrix B2:

[0168]

[0169] After the electronic device obtains the plurality of target performance information, the electronic device can determine the fault prediction result according to the plurality of target performance information and the event information.

[0170] Optionally, the fault prediction result can include a failure probability of the target device and a normal probability of the target device.

[0171] Optionally, the fault prediction result can be represented by a classification vector (C1, C2), wherein C1 can be used to represent the normal probability of the target device, and C2 can be used to represent the failure probability of the target device.

[0172] For example, if there are 2 target performance information, which are target performance information 1 and target performance information 2 respectively, the target performance information 1 can be as shown in the above matrix B1, and the target performance information 2 can be as shown in the above matrix B2; and if the event information is as shown in the above matrix A1, the electronic device can process the target performance information 1, the target performance information 2, and the event information to determine the fault prediction result of the target device. It is assumed that the fault prediction result of the target device is (0.8, 0.2), and the failure probability of the target device is 0.8 and the normal probability of the target device is 0.2.

[0173] In the embodiment of the present application, the electronic device can obtain a plurality of initial performance information corresponding to a plurality of performance indicators of the target device, and obtain event information of a plurality of abnormal events of the target device, and then determine a fault prediction result of the target device according to the plurality of initial performance information and the event information. Since the electronic device can perform fault prediction based on the event information of the plurality of abnormal events and the plurality of initial performance information, compared with the prior art which only performs fault prediction according to the feature sequence obtained based on the abnormal log, the information expressed is more comprehensive, and thus the accuracy of fault prediction of the target device is improved.

[0174] In the following, Figure 2 on the basis of the embodiment shown in Figure 3 , the fault prediction method is described in detail.

[0175] Figure 3 Another flowchart of a fault prediction method provided by an exemplary embodiment of the present application is shown in FIG. 4. As shown in FIG. 4, the method can include the following steps. Figure 3

[0176] S301, obtaining a plurality of initial performance information corresponding to a plurality of performance indicators of the target device.

[0177] It should be noted that the execution process of step S301 can refer to the execution process of step S201, which will not be described here again.

[0178] S302, determining the event type and occurrence time of each abnormal event.

[0179] Since the target device generates an abnormal log corresponding to each abnormal event, the electronic device can obtain a plurality of abnormal logs of the target device to determine a plurality of abnormal events according to the plurality of abnormal logs.

[0180] Optionally, a plurality of event types can be preset. Each event type can be represented by a type identifier. For example, if there are m event types, the type identifier of event type 1 can be 01, the type identifier of event type 2 can be 02, and so on, and the type identifier of event type m can be m.

[0181] For any abnormal event, the abnormal event can have a corresponding event type and occurrence time.

[0182] Optionally, the event types of the plurality of abnormal events can be represented by a sequence. If there are L abnormal events, the event types of the L abnormal events can be represented as a 1*L matrix E:

[0183] E = [e1, e2, e3, …, eL] L ]

[0184] wherein, e​L a type identifier representing an event type of an abnormal event L.

[0185] For example, if there are 100 abnormal events, namely, abnormal event 1, abnormal event 2, abnormal event 3, …, abnormal event 100, the event types and occurrence time of the 100 abnormal events can be as shown in Table 3:

[0186] Table 3

[0187]

[0188] The event types of the 100 abnormal events can be represented as a matrix E1 = [0 2, 3 0, 0 2, …, 0 1].

[0189] In S303, for any abnormal event, a multi-dimensional event feature of the abnormal event is determined according to an event type of the abnormal event.

[0190] In an optional embodiment, the multi-dimensional event feature of the abnormal event can be determined according to the event type of the abnormal event by: obtaining preset feature information; and determining the multi-dimensional event feature of the abnormal event according to the event type of the abnormal event and the preset feature information.

[0191] The preset feature information can include a plurality of event types and event features corresponding to each event type.

[0192] Optionally, if there are m event types and d event dimensions, the preset feature information can include m event types and event features corresponding to each event type in d event dimensions. The preset feature information can be represented as a matrix F of d*m:

[0193]

[0194] wherein f dm represents a feature value of the event type m in the dth event dimension. The first column element can represent the event feature of the event type 1; the second column element can represent the event feature of the event type 2; …; the mth column element can represent the event feature of the event type m.

[0195] Optionally, the electronic device can obtain the preset feature information in a preset storage space. For example, if m is 30 and d is 512, the electronic device can obtain the preset feature information as shown in a matrix F1 of 512*30:

[0196]

[0197] In the matrix F1, from the first column to the 30th column, there are the event feature of the event type 1, the event feature of the event type 2, …, and the event feature of the event type 30, respectively.

[0198] Since the preset feature information includes the event features corresponding to each event type, the electronic device can determine the multi-dimensional event feature of each abnormal event in the preset feature information according to the event type of each abnormal event. If the preset feature information includes m event types and the event features corresponding to each event type in d event dimensions, the multi-dimensional event feature of each abnormal event can include the event features in d event dimensions.

[0199] Alternatively, the multi-dimensional event feature can be represented by a d*1 matrix G.

[0200] For example, if the preset feature information is as shown in matrix F1; if there are 100 abnormal events, the event types of the 100 abnormal events are represented by matrix E1 = [0 2, 3 0, 0 2, …, 0 1], the electronic device can determine that the event type of abnormal event 1 is event type 2, and then determine the event feature 2 corresponding to event type 2 in the preset feature information (i.e., matrix F1) as the multi-dimensional event feature 1 of abnormal event 1 according to event type 2, and the multi-dimensional event feature 1 can be as shown in the following matrix G1; similarly, the electronic device can determine the multi-dimensional event feature 2 of abnormal event 2 as shown in the following matrix G2; the electronic device can determine the multi-dimensional event feature 3 of abnormal event 3 as shown in the following matrix G3; …; the electronic device can determine the multi-dimensional event feature 100 of abnormal event 100 as shown in the following matrix G 100

[0201]

[0202] S304, generating event information according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event.

[0203] In an optional embodiment, the event information can be generated according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event by the following method: combining the multi-dimensional event features of the plurality of abnormal events in the order of occurrence time from late to early to obtain a combined event feature; generating a time feature according to the occurrence time of each abnormal event; and fusing the combined event feature and the time feature to obtain the event information.

[0204] Alternatively, the event information can include the multi-dimensional event feature of each abnormal event.

[0205] Alternatively, since there are L abnormal events, and the multi-dimensional event feature of each abnormal event includes event features in d event dimensions, the combined event feature can be represented by a d*L matrix H.

[0206] In the following, combined with Figure 4 ​The process of generating event information is described.

[0207] Figure 4 The process of generating event information is described. Figure 4 For example, if there are 100 abnormal events, respectively abnormal event 1, abnormal event 2, abnormal event 3, …, abnormal event 100, the occurrence time of the 100 abnormal events can be shown in Table 3 in the order from late to early; if the multi-dimensional event feature 1 of abnormal event 1 is shown in the above-mentioned matrix G1, the multi-dimensional event feature 2 of abnormal event 2 is shown in the above-mentioned matrix G2, the multi-dimensional event feature 3 of abnormal event 3 is shown in the above-mentioned matrix G3, …, and the multi-dimensional event feature 100 of abnormal event 100 is shown in the above-mentioned matrix G 100 , the multi-dimensional event features of the 100 abnormal events can be combined in the order from late to early, to obtain a combined event feature, which can include multi-dimensional event feature 1, multi-dimensional event feature 2, multi-dimensional event feature 3, …, and multi-dimensional event feature 100, and the combined event feature can be represented as a 30*100 matrix H1:

[0208]

[0209] Alternatively, the time feature can be generated according to the occurrence time of each abnormal event by determining the latest occurrence time among the multiple occurrence times of the multiple abnormal events, determining the time difference between each occurrence time and the latest occurrence time to obtain multiple time differences, determining the feature value corresponding to each time difference, and combining the feature values of the multiple time differences to obtain the time feature.

[0210] The latest occurrence time refers to the occurrence time of the latest abnormal event among the multiple abnormal events, i.e. the current time, because the latest abnormal event occurs at the current time.

[0211] Alternatively, the unit of the time difference can be minutes (min). The time difference can represent the proximity of the occurrence time of each abnormal event to the current time.

[0212] For example, if there are 100 abnormal events, respectively abnormal event 1, abnormal event 2, abnormal event 3, …, abnormal event 100, the occurrence time of the 100 abnormal events can be shown in Table 3 in the order from late to early, the latest occurrence time among the occurrence times of the 100 abnormal events can be determined as the occurrence time 2024 / 4 / 25 14:00 of abnormal event 1, the time difference between each occurrence time and the latest occurrence time can be determined to obtain multiple time differences, and the multiple time differences can be shown in Table 4:

[0213] Table 4

[0214]

[0215] Optionally, the feature value corresponding to each time difference can be determined as follows: determine at least one time granularity; round down each time difference according to at least one time granularity to obtain at least one rounded result for each time difference; map the at least one rounded result for each time difference using a dynamic embedding function to obtain at least one initial feature value corresponding to each time difference; sum the at least one initial feature value corresponding to each time difference to obtain the feature value corresponding to each time difference.

[0216] The time granularity can be at least one of the following: day, hour, or minute.

[0217] For example, if there are 100 time differences as shown in Table 4, and if there are 3 time granularities, namely day, hour, and minute, then the 100 time differences can be rounded down according to these 3 time granularities to obtain 300 rounded results, as shown in Table 5:

[0218] Table 5

[0219] Time difference (min) 0 4 171 …… 4319 Day 0 0 0 …… 3 Hour 0 0 2 …… 71 Minute 0 4 171 …… 4319

[0220] The electronic device can then use a dynamic embedding function to map the three rounded results of each time difference in Table 5 to obtain three initial feature values ​​corresponding to each time difference. For example... Figure 4 In the table, the three initial eigenvalues ​​corresponding to time difference 1 can be eigenvalue 1-1, eigenvalue 1-2, and eigenvalue 1-3; the three initial eigenvalues ​​corresponding to time difference 2 can be eigenvalue 2-1, eigenvalue 2-2, and eigenvalue 2-3; ...; the three initial eigenvalues ​​corresponding to time difference 100 can be eigenvalue 100-1, eigenvalue 100-2, and eigenvalue 100-3. Assume that the three initial eigenvalues ​​corresponding to each time difference can be as shown in Table 6:

[0221] Table 6

[0222] Time difference (min) 0 4 171 …… 4319 Initial eigenvalue corresponding to "Day" 0.10 0.10 0.10 …… 0.02 Initial eigenvalue corresponding to "Hour" 0.05 0.05 0.04 …… 0.04 Initial eigenvalue corresponding to "Minute" 0.16 0.09 0.05 …… 0.03

[0223] like Figure 4 As shown, the electronic device can sum at least one initial feature value corresponding to each time difference, thus obtaining the feature value corresponding to each time difference. Assume the feature value corresponding to each time difference can be as shown in Table 7:

[0224] Table 7

[0225] Time difference (min) 0 4 171 …… 4319 Eigenvalue 0.31 0.24 0.19 …… 0.09

[0226] Optionally, after determining the eigenvalues ​​corresponding to each time difference, the eigenvalues ​​of multiple time differences can be combined to obtain the time features. The time features can be represented by a 1*L matrix W.

[0227] For example, if there are 100 time differences, and the feature values ​​corresponding to each time difference are shown in Table 7, then the electronic device can combine the feature values ​​corresponding to the 100 time differences to obtain the time feature. The time feature can be represented as matrix W1 = [0.31, 0.24, 0.19, ..., 0.09].

[0228] After the electronic device determines the combined event features and time features, it can determine the multi-dimensional event features of each abnormal event in the combined event features, and determine the feature value of the time difference corresponding to each abnormal event in the time features. The feature value of the time difference is added to the multi-dimensional event features to fuse the combined event features and time features to obtain event information.

[0229] For example, such as Figure 4 As shown, the electronic device can add the feature value corresponding to multi-dimensional event feature 1 with the feature value corresponding to time difference 1, add the feature value corresponding to multi-dimensional event feature 2 with the feature value corresponding to time difference 2, and so on, and add the feature value corresponding to multi-dimensional event feature 100 with the feature value corresponding to time difference 100, so as to fuse the combined event features and time features to obtain event information. If the combined event features are as shown in matrix H1 and the time features are as shown in matrix W1, then the combined event features and time features can be fused to obtain event information, as shown in matrix A1.

[0230] By incorporating time features into the combined event features to obtain event information, we can better express the unequal time intervals of abnormal events and strengthen the representation of time information.

[0231] S305. Determine the number of events for multiple abnormal events.

[0232] Since there are L abnormal events, the electronic device can determine the number of events that are multiple abnormal events as L.

[0233] For example, if there are 100 abnormal events, then the number of events can be determined to be 100.

[0234] S306. Based on the number of events, perform feature mapping processing on multiple initial performance information to obtain multiple target performance information.

[0235] In an optional embodiment, for any one initial performance information, the initial performance information can be mapped to target performance information according to the number of events by the following method: determining a preset dimension D; performing feature extraction and mapping on the initial performance information according to the number of events L and the preset dimension D to obtain the target performance information.

[0236] Optionally, the electronic device can perform D times of feature extraction and mapping on the initial performance information according to the preset dimension D to obtain D intermediate performance features, and then perform splicing on the D intermediate performance features to obtain the target performance information.

[0237] For any one time of feature extraction and mapping, the electronic device can perform feature extraction on the initial performance information through a convolution layer and perform marginal 0 padding to obtain an initial performance feature; the electronic device can perform mapping on the initial performance feature through a linear layer to obtain an intermediate performance feature.

[0238] Optionally, a matrix P of X*L can be preset in the linear layer.

[0239] Optionally, the initial performance information can be represented by a matrix J of 1*X; the initial performance feature can be represented by a matrix J' of 1*X; and the intermediate performance feature can be represented by a matrix J" of 1*L.

[0240] For example, if there are two initial performance information, initial performance information 1 as shown in Table 1 and initial performance information 2 as shown in Table 2, since the initial performance information 1 includes 72 CPU utilization rates, the initial performance information 1 can be represented as J1 = [0.82, 0.80, 0.95, 0.75, …, 0.80, 0.70]; and since the initial performance information 2 includes 36 memory utilization rates, the initial performance information 2 can be represented as J2 = [0.85, 0.89, 0.70, 0.60, …, 0.86, 0.88].

[0241] If the preset dimension D is 512, the electronic device can perform 512 times of feature extraction processing and mapping processing on the initial performance information 1 to obtain 512 intermediate performance features corresponding to the initial performance information 1. For example, in the first time of feature extraction processing and mapping processing, the electronic device can perform feature extraction processing on J1 = [0.82, 0.80, 0.95, 0.75, …, 0.80, 0.70] through a convolution layer, and perform marginal 0 supplement to obtain initial performance feature 1, which can be expressed as a 1*72 matrix J'1 = [0.52, 0.49, 0.61, 0.75, …, 0, 0]. A 72*100 matrix P1 can be preset in the linear layer, and the electronic device can perform mapping processing on the initial performance feature 1 through the matrix P1 in the linear layer to obtain intermediate performance feature 1, which can be expressed as a 1*100 matrix J”1 = [0.05, 0.21, 0.13, 0.56, …, 0.30, 0.41].

[0242] Assuming that among the 512 intermediate performance features corresponding to the initial performance information 1, the intermediate performance feature 1 can be expressed as a 1*100 matrix J”1 = [0.05, 0.21, 0.13, 0.56, …, 0.30, 0.41], the intermediate performance feature 2 can be expressed as a 1*100 matrix J”2 = [0.03, 0.01, 0.25, 0.13, …, 0.79, 0.36], and the intermediate performance feature 512 can be expressed as a 1*100 matrix J”512 = [0.01, 0.19, 0.34, 0.76, …, 0.45, 0.20], the 512 intermediate performance features can be spliced to obtain target performance information 1, which can be expressed as matrix B1. 512

[0243] Similarly, the electronic device can perform 512 times of feature extraction processing and mapping processing on the initial performance information 2 to obtain 512 intermediate performance features corresponding to the initial performance information 2, and then perform splicing processing on the 512 intermediate performance features to obtain target performance information 2, which can be expressed as matrix B2.

[0244] In the technical solution of the present application, the initial performance information is subjected to feature extraction processing and mapping processing according to the event quantity L and the preset dimension D to obtain target performance information, which can align the plurality of target performance information with the event information in time and improve the accuracy of fault prediction.

[0245] S307, splicing processing is performed on the plurality of target performance information to obtain spliced performance information.

[0246] ​Since each target performance information is transformed based on the initial performance information of the target device, the plurality of target performance information can represent the characteristics of the target device under a plurality of performance indicators, and therefore, after the plurality of target performance information is spliced, the spliced performance information can represent the overall performance characteristics of the target device.

[0247] If there are n target performance information, each target performance information can be represented by a feature matrix B of D*L, and the n target performance information can be spliced to obtain spliced performance information, which can be represented by a matrix Z of (n*D)*L.

[0248] For example, if there are 2 target performance information, the target performance information 1 is shown as matrix B1, and the target performance information 2 is shown as matrix B2, the electronic device can splice the 2 target performance information to obtain spliced performance information, which can be represented as a 1024*100 matrix Z as follows:

[0249]

[0250] S308, processing the spliced performance information and the event information to obtain a fault prediction result.

[0251] In an optional embodiment, the spliced performance information and the event information can be processed to obtain a fault prediction result by the following method: performing N times of fusion processing on the spliced performance information and the event information to obtain target performance characteristics and target event characteristics, N is an integer greater than or equal to 1; determining the fault prediction result according to the target performance characteristics and the target event characteristics.

[0252] Optionally, the electronic device can be provided with a target model. The target model can be used to predict the fault prediction result of the target device within a future preset time length. The future preset time length has been determined when the target model is trained. For example, the future preset time length can be 48 hours in the future.

[0253] The electronic device can process the spliced performance information and the event information through the target model to obtain a fault prediction result. The target model can be a model based on an attention mechanism. It should be noted that the structure of the target model is not limited in the technical solutions of the present application.

[0254] In the embodiments of the present application, an exemplary target model is provided. In the following, the structure of the target model is described in combination with Figure 5 The structure of the target model is described.

[0255] Figure 5 The structure of the target model provided in the example embodiments of the present application is shown in the following schematic diagram. Please refer to Figure 5The target model can include an encoder, a fusion layer, a first fully connected layer, an activation layer, and a second fully connected layer.

[0256] The encoder can include N encoding layers. For the i-th encoding layer, the i-th encoding layer can include a sub-encoding layer 1, a sub-encoding layer 2, an attention layer 1, and an attention layer 2. The attention layers can use a cross attention mechanism for fusion processing.

[0257] The i-th encoding layer can be preset with the following formula (1) in the attention layer 1, and the following formula (2) in the attention layer 2, which can be used to calculate the cross attention:

[0258]

[0259]

[0260] wherein, are query vectors, key vectors, and value vectors generated based on the spliced performance information hidden state input Z i-1 ; are query vectors, key vectors, and value vectors generated based on the event information hidden state input A i-1 , and d' is the dimension of the query vectors, key vectors, and value vectors.

[0261] Optionally, any one of the encoding layers can further include at least one of the following layers: a dense layer, a normalization layer, and a feedforward layer.

[0262] In an optional embodiment, the spliced performance information and the event information can be fused N times to obtain the target performance feature and the target event feature in the following manner: the spliced performance information and the event information are fused to obtain a first performance feature and a first event feature; the i-1 performance feature and the i-1 event feature are fused to obtain an i performance feature and an i event feature; wherein i is 2, 3, …, N in turn, the N performance feature is determined as the target performance feature, and the N event feature is determined as the target event feature.

[0263] Optionally, in the first encoding layer, the electronic device can fuse the event information in the splicing performance information through the sub-encoding layer 1-1 and the attention layer 1-1 to obtain the first fused performance information, and can fuse the splicing performance information in the event information through the sub-encoding layer 1-2 and the attention layer 1-2 to obtain the first fused event information; then the electronic device can perform compression processing on the first fused performance information and the first fused event information through the dense layer respectively to obtain the first compressed performance information and the first compressed event information; the electronic device can perform normalization processing on the first compressed performance information and the first compressed event information through the normalization layer to obtain the first performance information and the first event information; the electronic device can perform mapping processing on the first performance information and the first event information through the feedforward layer to obtain the first performance feature and the first event feature.

[0264] In the i-th encoding layer, the electronic device can fuse the i-1-th event feature in the i-1-th performance feature to obtain the i-th fused performance information, and can fuse the i-1-th performance feature in the i-1-th event feature to obtain the i-th fused event feature; then the electronic device can perform compression processing on the i-th fused performance information and the i-th fused event information through the dense layer respectively to obtain the i-th compressed performance information and the i-th compressed event information; the electronic device can perform normalization processing on the i-th compressed performance information and the i-th compressed event information through the normalization layer to obtain the i-th performance information and the i-th event information; the electronic device can perform mapping processing on the i-th performance information and the i-th event information through the feedforward layer to obtain the i-th performance feature and the i-th event feature.

[0265] When i is equal to N, the electronic device can perform fusion processing on the N-1-th performance feature and the N-1-th event feature through the N-th encoding layer to obtain the N-th performance feature and the N-th event feature, and can determine the N-th performance feature as the target performance feature and determine the N-th event feature as the target event feature.

[0266] Optionally, the fault prediction result can be determined according to the target performance feature and the target event feature in the following manner: performing splicing processing on the target performance feature and the target event feature to obtain a target feature; performing enhancement processing on the target feature to obtain a target enhanced feature; and determining the fault prediction result according to the target enhanced feature.

[0267] Optionally, the target performance feature can be represented by a matrix O z , and the target event feature can be represented by a matrix O A .

[0268] The electronic device can perform splicing processing on the matrix O z and the matrix O A through the fusion layer in the target model to obtain a target feature, and the target feature can be represented by O P .

[0269] Optionally, the electronic device can enhance the target features using the first fully connected layer and activation layer in the target model to obtain enhanced target features. These enhanced target features can be represented by a one-dimensional matrix O. F If expressed as follows, O can be calculated using the following formula (3). F :

[0270] o F =Tanh(O P W F +b F Formula (3)

[0271] Where Tanh(·) represents the activation function; W F b represents the coefficient vector; F This represents the bias vector.

[0272] Optionally, after obtaining the target enhancement features, the electronic device can process the target enhancement features through the second fully connected layer in the target model to obtain a classification vector, which can be used to represent the fault prediction result.

[0273] For example, if the stitching performance information is as shown in matrix Z and the event information is as shown in matrix A1, then the electronic device can process the stitching performance information and event information through the encoder, dense layer, first normalization layer, feedforward layer, and second normalization layer in the target model to obtain target performance features and target event features. Assume the target performance features can be a 1*1000 matrix O. z = [0.32, 0.58, 0.09, 0.14, ..., 0.63], the target event features can be a 1*1000 matrix O A Given the values ​​[0.12, 0.69, 0.48, 0.07, ..., 0.24], the electronic device can concatenate the target performance characteristics and target event characteristics to obtain the target features. Assume the target features can be represented as a 2*1000 matrix O. P :

[0274]

[0275] The electronic device can then enhance the target features using formula (3) to obtain the enhanced target features. Assume the enhanced target features can be expressed as o F = [0.22, 0.27, 0.05, 0.62, ..., 0.91]. The electronic device can process the target enhancement features through the second fully connected layer in the target model to obtain the classification vector (0.8, 0.2). If the target model's future preset duration is the next 48 hours, then the probability of the target device failing in the next 48 hours can be determined to be 0.8, and the probability of normal operation is 0.2.

[0276] Since the target model adopts an encoder based on an attention mechanism, better fusion processing of the spliced performance information and the event information is achieved, and for elements far apart, the forgetting phenomenon of the recurrent neural network is not affected, so that the target model is used to process the spliced performance information and the event information, and the accuracy of fault prediction is improved.

[0277] It should be noted that in the training process of the model, a plurality of sample data and a sample label corresponding to each sample data can be determined. After processing each sample data by the model to obtain a fault prediction result corresponding to each sample data, the loss value (Loss) of the model can be calculated according to the fault prediction result corresponding to each sample data and the sample label, and the parameters are updated by back propagation and gradient descent method, so that the target model is trained.

[0278] In the embodiment of the application, the electronic device can obtain a plurality of initial performance information corresponding to a plurality of performance indicators of a target device, and determine the event type and occurrence time of each abnormal event. For any one abnormal event, the electronic device can determine the multi-dimensional event feature of the abnormal event according to the event type of the abnormal event. The electronic device can generate event information according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event. The electronic device can determine the number of events of a plurality of abnormal events, and perform feature mapping processing on a plurality of initial performance information according to the number of events to obtain a plurality of target performance information, and then perform splicing processing on the plurality of target performance information to obtain spliced performance information. The electronic device can process the spliced performance information and the event information to obtain a fault prediction result. Since the electronic device can perform fault prediction based on the event information of a plurality of abnormal events and a plurality of initial performance information, compared with the prior art which only performs fault prediction based on a feature sequence obtained based on abnormal logs, the information expressed is more comprehensive; and the time information of the unequal time intervals of the plurality of abnormal events is better expressed by adding the time feature in the event information, so that the accuracy of fault prediction of the target device is improved.

[0279] If Figure 2 Or Figure 3 In the embodiment, the target device is a cloud server, and the application further provides a fault prediction method.

[0280] Figure 6 Another flowchart of a fault prediction method provided by an exemplary embodiment of the application is provided. Please refer to Figure 6 , the method comprises:

[0281] S601, obtaining a plurality of initial performance information corresponding to a plurality of performance indicators of a target device.

[0282] The target device can be a cloud server that needs to be subjected to failure prediction.

[0283] The target device can have multiple performance indicators. Each performance indicator has corresponding initial performance information.

[0284] For any one performance indicator, the initial performance information can include multiple performance data of the target device under the performance indicator in a historical period.

[0285] For example, if the target device is cloud server 1, the current time is 2024 / 4 / 25 14:00, and the preset time length is 3 days, the historical period can be 2024 / 4 / 22 14:00 to 2024 / 4 / 25 14:00. If the performance indicator is CPU utilization, the corresponding initial performance information can include multiple CPU utilization of cloud server 1 between 2024 / 4 / 22 14:00 and 2024 / 4 / 25 14:00.

[0286] Optionally, the electronic device or the data collection device can determine multiple performance indicators of the target device. For any one performance indicator, the electronic device or the data collection device can collect multiple performance data of the target device under the performance indicator according to the collection period corresponding to the performance indicator, and store the multiple performance data in a preset storage space. The preset storage space can be in the electronic device, in the data collection device, or in other storage devices.

[0287] The electronic device can determine multiple performance indicators of the target device, and then can obtain multiple initial performance information corresponding to the multiple performance indicators of the target device in a historical period in the preset storage space.

[0288] For example, if the target device is cloud server 1, if there are 2 performance indicators, CPU utilization and memory utilization, if the current time is 2024 / 4 / 25 14:00, and the historical period is 2024 / 4 / 22 14:00 to 2024 / 4 / 25 14:00, the electronic device can obtain initial performance information 1 corresponding to the CPU utilization of cloud server 1 and initial performance information 2 corresponding to the memory utilization of cloud server 1 in the preset storage space. Assuming that the initial performance information 1 can be as shown in Table 1 above, and the initial performance information 2 can be as shown in Table 2 above.

[0289] S602, obtaining event information of multiple abnormal events of the target device.

[0290] The target device can have multiple abnormal events during operation. For any one abnormal event, the abnormal event has a corresponding occurrence time. The occurrence times of the multiple abnormal events can be located in the historical period.

[0291] In an optional embodiment, the event information of the plurality of abnormal events of the target device is acquired, the event type and the occurrence time of each abnormal event are determined, the multi-dimensional event feature of each abnormal event is determined according to the event type of the abnormal event, and the event information is generated according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event, and the multi-dimensional event feature of each abnormal event is included in the event information.

[0292] The event information can include the feature of each abnormal event in d event dimensions. Optionally, the event information can be represented as a matrix A of d*L.

[0293] For example, if the target device is cloud server 1, 100 abnormal events occur in the cloud server 1, which are abnormal event 1, abnormal event 2, abnormal event 3, …, and abnormal event 100. The event type and occurrence time of the 100 abnormal events can be as shown in Table 3. For the 100 abnormal events, the electronic device can determine the multi-dimensional event feature of each abnormal event according to the event type of each abnormal event. Assuming that the electronic device can determine the multi-dimensional event feature of the 100 abnormal events as matrix G1, matrix G2, matrix G3, …, and matrix G100 respectively, as shown in Table 4. 100 According to the occurrence time of each abnormal event shown in Table 3 and the 100 multi-dimensional event features, the electronic device can generate event information, as shown in matrix A1.

[0294] S603, according to the plurality of initial performance information and the event information, determining the fault prediction result of the target device.

[0295] In an optional embodiment, the fault prediction result of the target device can be determined according to the plurality of initial performance information and the event information by the following method: determining the number of events of the plurality of abnormal events; performing feature mapping processing on the plurality of initial performance information according to the number of events to obtain a plurality of target performance information, the number of performance features included in the target performance information being the same as the number of events; and determining the fault prediction result according to the plurality of target performance information and the event information.

[0296] Optionally, the fault prediction result can include the failure probability of the target device and the normal probability of the target device.

[0297] Optionally, the fault prediction result can be represented by a classification vector (C1, C2), wherein C1 can be used to represent the normal probability of the target device, and C2 can be used to represent the failure probability of the target device.

[0298] For example, if there are 100 abnormal events, the number of events is 100. If there are 2 initial performance information, which are initial performance information 1 as shown in Table 1 and initial performance information 2 as shown in Table 2, since initial performance information 1 includes 72 CPU utilization rates, initial performance information 1 can be represented as J1 = [0.82, 0.80, 0.95, 0.75, …, 0.80, 0.70]; since initial performance information 2 includes 36 memory utilization rates, initial performance information 2 can be represented as J2 = [0.85, 0.89, 0.70, 0.60, …, 0.86, 0.88]. The electronic device can perform feature mapping processing on initial performance information 1 to obtain target performance information 1, which can be as shown in matrix B1; the electronic device can perform feature mapping processing on initial performance information 2 to obtain target performance information 2, which can be as shown in matrix B1. If the event information is as shown in the above matrix A1, the electronic device can process target performance information 1, target performance information 2, and event information to determine the failure prediction result of the target device. Assuming that the failure prediction result of the target device is (0.8, 0.2), the failure probability of the target device is 0.8 and the normal probability is 0.2.

[0299] In the embodiments of the present application, the electronic device can obtain a plurality of initial performance information corresponding to a plurality of performance indicators of the target device, and obtain event information of a plurality of abnormal events of the target device, and then can determine the failure prediction result of the target device according to the plurality of initial performance information and the event information. Since the electronic device can perform failure prediction based on the event information of the plurality of abnormal events and the plurality of initial performance information, compared with the prior art which only performs failure prediction based on the feature sequence obtained based on the abnormal log, the information expressed is more comprehensive, and therefore the accuracy of failure prediction of the target device is improved.

[0300] In the following, on the basis of any of the above embodiments, in combination with Figure 7 The above failure prediction method is further described.

[0301] Figure 7 A process schematic diagram of a failure prediction method provided by an exemplary embodiment of the present application. Please refer to Figure 7 The electronic device can obtain a plurality of abnormal events of the target device.

[0302] Since each abnormal event has a corresponding event type and occurrence time, the electronic device can determine a plurality of event types of the plurality of abnormal events and a plurality of occurrence times of the plurality of abnormal events.

[0303] The preset feature information in the dynamic embedding layer can include a plurality of event types and event features corresponding to each event type. The electronic device can process the event type of each abnormal event through the dynamic embedding layer to obtain the multi-dimensional event feature of each abnormal event.

[0304] For example, if there are 100 abnormal events, the multi-dimensional event features of the 100 abnormal events can be obtained, and the multi-dimensional event feature of each abnormal event can be as shown in matrix G1, matrix G2, matrix G3, …, matrix G 100 as shown.

[0305] After determining the multi-dimensional event feature of each abnormal event, the multi-dimensional event features of the plurality of abnormal events can be combined in order from late to early occurrence time to obtain a combined event feature. For example, the combined event feature can be as shown in matrix H1.

[0306] The electronic device can also process the plurality of occurrence times of the plurality of abnormal events through the relative time embedding layer to obtain a time feature. The relative time embedding layer can be preset with a dynamic embedding function.

[0307] Specifically, the electronic device can determine the latest occurrence time among the plurality of occurrence times of the plurality of abnormal events, and determine the time difference between each occurrence time and the latest occurrence time to obtain a plurality of time differences. The electronic device can determine at least one time granularity, and perform down-round processing on each time difference according to the at least one time granularity to obtain at least one integer result of each time difference. The electronic device can then map each integer result of each time difference through the relative time embedding layer to obtain at least one initial feature value corresponding to each time difference. The electronic device can then sum the at least one initial feature value corresponding to each time difference to obtain a feature value corresponding to each time difference, and then combine the feature values of the plurality of time differences to obtain a time feature.

[0308] Since the time feature is determined according to the initial feature value corresponding to each time difference at different time granularities, the time feature enhances the feature expression of different time differences.

[0309] For example, if there are 100 abnormal events, the occurrence times of the 100 abnormal events are as shown in Table 3, the electronic device can determine 100 time differences, and then determine the feature values corresponding to the 100 time differences as shown in Table 7. The electronic device can combine the feature values corresponding to the 100 time differences to obtain a time feature, as shown in matrix W1.

[0310] After the electronic device determines the combined event feature and the time feature, the electronic device can fuse the combined event feature and the time feature to obtain event information, as shown in matrix A1.

[0311] The electronic device can obtain a plurality of initial performance information of the target device under a plurality of performance indicators. For example, the electronic device can obtain initial performance information 1 of the target device under CPU utilization, and initial performance information 2 under memory utilization.

[0312] The electronic device can determine the number of events L of the plurality of abnormal events, and perform feature mapping processing on each initial performance information through a convolution layer and a linear layer to obtain corresponding target performance information.

[0313] Specifically, the electronic device can perform D times of feature extraction processing and mapping processing on the initial performance information through the convolution layer and the linear layer according to the number of events L and the preset dimension D, to obtain D intermediate performance features, and then perform splicing processing on the D intermediate performance features to obtain the target performance information. Optionally, a matrix P of X*L can be preset in the linear layer.

[0314] For example, if there are 100 abnormal events, the number of events is 100. If there are 2 initial performance information, which are initial performance information 1 as shown in Table 1 and initial performance information 2 as shown in Table 2. According to Table 1, the initial performance information 1 can be represented as J1=[0.82, 0.80, 0.95, 0.75, …, 0.80, 0.70]; according to Table 2, the initial performance information 2 can be represented as J2=[0.85, 0.89, 0.70, 0.60, …, 0.86, 0.88]; if the preset dimension D is 512, the electronic device can perform 512 times of feature extraction processing and mapping processing on the initial performance information 1 to obtain 512 intermediate performance features, and then can perform splicing processing on the 512 intermediate performance features to obtain target performance information 1, which is assumed to be as shown in matrix B1; the electronic device can perform 512 times of feature extraction processing and mapping processing on the initial performance information 2 to obtain 512 intermediate performance features, and then can perform splicing processing on the 512 intermediate performance features to obtain target performance information 2, which is assumed to be as shown in matrix B2.

[0315] The electronic device can perform splicing processing on a plurality of target performance information to obtain spliced performance information. For example, if the target performance information 1 is as shown in matrix B1, and the target performance information 2 is as shown in matrix B2, the electronic device can perform splicing processing on the two target performance information to obtain spliced performance information, which can be as shown in matrix Z.

[0316] After the electronic device determines the spliced performance information and the event information, the electronic device can input the spliced performance information and the event information into a target model, and process the spliced performance information and the event information through the target model to obtain a fault prediction result.

[0317] It should be noted that the process of obtaining the fault prediction result by processing the spliced performance information and the event information through the target model can be referred to Figure 5 , which will not be described here in detail.

[0318] In the technical solution of the present application, compared with the fault prediction model based on system abnormal logs, the target model can better extract and represent the features of the sample. By information fusion and enhancement of the two different forms of data, i.e., the performance-based spliced performance information and the event information based on abnormal events, through the target model, the overall state of the target device can be more accurately evaluated according to the spliced performance information and the event information, so as to make more accurate fault prediction results.

[0319] Compared with the model based on system abnormal logs (HitAnomaly), the advantages of the target model are that: in fault prediction, the event information based on abnormal events (abnormal logs) and the spliced performance information based on performance are added, and the cross attention mechanism is used to fuse the information of different modalities, which can more comprehensively evaluate the state of the system and improve the accuracy of fault prediction.

[0320] Compared with the long short-term memory (LSTM) model, the advantages of the target model are that: (1) the dynamic embedding method is used to vectorize multiple abnormal events, and the distance and similarity between different abnormal events can be better represented and updated automatically in the training process, which can reduce the loss caused by feature extraction engineering to abnormal event log information. (2) The encoder based on the attention mechanism is adopted, which will not be affected by the forgetting phenomenon of the recurrent neural network for elements far apart, and can reduce the time of model training, and can better extract features.

[0321] In the embodiment of the present application, the electronic device can obtain a plurality of abnormal events of a target device, and determine a plurality of event types and a plurality of occurrence times of the plurality of abnormal events. The electronic device can determine a multi-dimensional event feature of each abnormal event according to the event type of each abnormal event, and further determine a combined event feature. The electronic device can generate a time feature according to the occurrence time of each abnormal event. The electronic device can determine event information according to the combined event feature and the time feature. The electronic device can obtain a plurality of initial performance information corresponding to a plurality of performance indicators of the target device, and perform feature mapping processing on the plurality of initial performance information to obtain a plurality of target performance information, and further perform splicing processing on the plurality of target performance information to obtain spliced performance information. The electronic device can process the spliced performance information and the event information through a target model to obtain a fault prediction result. Since the electronic device can perform fault prediction based on the event information of the plurality of abnormal events and the plurality of initial performance information, compared with the prior art which only performs fault prediction according to the feature sequence obtained based on abnormal logs, the information expressed is more comprehensive; and the time feature is added in the event information, which better expresses the time information of the unequal time intervals of the plurality of abnormal events, thereby comprehensively improving the accuracy of fault prediction of the target device.

[0322] Figure 8 A structural schematic diagram of a fault prediction device provided by an exemplary embodiment of the present application is provided. Please refer to Figure 8 The fault prediction device 10 can include a first obtaining module 11, a second obtaining module 12, and a determining module 13, wherein,

[0323] The first obtaining module 11 is configured to obtain a plurality of initial performance information corresponding to a plurality of performance indicators of a target device, wherein the initial performance information includes a plurality of performance data of the target device under the performance indicators in a historical period;

[0324] The second obtaining module 12 is configured to obtain event information of a plurality of abnormal events of the target device, wherein the occurrence times of the plurality of abnormal events are located in the historical period;

[0325] The determining module 13 is configured to determine a fault prediction result of the target device according to the plurality of initial performance information and the event information.

[0326] The fault prediction device provided by the embodiment of the present application can execute the technical solutions shown in the above method embodiments, and the implementation principles and beneficial effects are similar, which will not be described here in detail.

[0327] In a possible implementation, the determining module 13 is specifically configured to:

[0328] determine the number of events of the plurality of abnormal events;

[0329] According to the event quantity, the plurality of initial performance information is subjected to feature mapping processing to obtain a plurality of target performance information, and the quantity of performance features included in the target performance information is the same as the event quantity.

[0330] According to the plurality of target performance information and the event information, the fault prediction result is determined.

[0331] In a possible implementation, for any one initial performance information, the determining module 13 is specifically configured to:

[0332] determine a preset dimension;

[0333] According to the event quantity and the preset dimension, the initial performance information is subjected to feature extraction processing and mapping processing to obtain the target performance information.

[0334] In a possible implementation, the determining module 13 is specifically configured to:

[0335] the plurality of target performance information is subjected to splicing processing to obtain spliced performance information;

[0336] The spliced performance information and the event information are processed to obtain the fault prediction result.

[0337] In a possible implementation, the determining module 13 is specifically configured to:

[0338] The spliced performance information and the event information are subjected to N times of fusion processing to obtain target performance features and target event features, and N is an integer greater than or equal to 1;

[0339] According to the target performance features and the target event features, the fault prediction result is determined.

[0340] In a possible implementation, the determining module 13 is specifically configured to:

[0341] The target performance features and the target event features are subjected to splicing processing to obtain target features;

[0342] The target features are subjected to enhancement processing to obtain target enhanced features;

[0343] According to the target enhanced features, the fault prediction result is determined.

[0344] In a possible implementation, the determining module 13 is specifically configured to:

[0345] The spliced performance information and the event information are subjected to fusion processing to obtain first performance features and first event features;

[0346] The i-1 performance feature and the i-1 event feature are fused to obtain an i performance feature and an i event feature; wherein the i is taken as 2, 3, …, N in turn, the N performance feature is determined as the target performance feature, and the N event feature is determined as the target event feature.

[0347] In a possible implementation, the second acquisition module 12 is specifically configured to:

[0348] determine the event type and the occurrence time of each abnormal event;

[0349] for any one abnormal event, determine the multi-dimensional event feature of the abnormal event according to the event type of the abnormal event;

[0350] generate the event information according to the occurrence time of each abnormal event and the multi-dimensional event feature of each abnormal event, the event information including the multi-dimensional event feature of each abnormal event.

[0351] In a possible implementation, the second acquisition module 12 is specifically configured to:

[0352] acquire preset feature information, the preset feature information including a plurality of event types and event features corresponding to each event type;

[0353] determine the multi-dimensional event feature of the abnormal event according to the event type of the abnormal event and the preset feature information.

[0354] In a possible implementation, the second acquisition module 12 is specifically configured to:

[0355] combine the multi-dimensional event features of the plurality of abnormal events in the order from the latest occurrence time to the earliest occurrence time to obtain a combined event feature;

[0356] generate a time feature according to the occurrence time of each abnormal event;

[0357] fuse the combined event feature and the time feature to obtain the event information.

[0358] In a possible implementation, the second acquisition module 12 is specifically configured to:

[0359] determine the latest occurrence time among the plurality of occurrence times of the plurality of abnormal events;

[0360] determine the time difference between each occurrence time and the latest occurrence time to obtain a plurality of time differences;

[0361] Determine a feature value corresponding to each time difference, and combine the feature values of the plurality of time differences to obtain the time feature.

[0362] The fault prediction device provided by the embodiments of the present application can implement the technical solutions shown in the method embodiments, and the implementation principles and beneficial effects are similar, which will not be described herein again.

[0363] Figure 9 A structural schematic diagram of an electronic device is provided for the exemplary embodiments of the present application. Please refer to Figure 9 The electronic device 20 can include a processor 21 and a memory 22. Exemplarily, the processor 21, the memory 22, and each part are connected with each other through a bus 23.

[0364] The memory 22 stores computer execution instructions;

[0365] The processor 21 executes the computer execution instructions stored in the memory 22, so that the processor 21 executes the method shown in the above method embodiments.

[0366] Correspondingly, the embodiments of the present application provide a computer readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, the computer execution instructions are used to implement the method provided by the above method embodiments.

[0367] Correspondingly, the embodiments of the present application can also provide a computer program product, which includes a computer program. When the computer program is executed by a processor, the computer program can implement the method shown in the above method embodiments.

[0368] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt a computer program product in the form of being implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program codes.

[0369] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a machine for implementing the functions described in the flowcharts and / or block diagrams.Figure 1 one or more processes and / or blocks Figure 1 means for performing the function specified by the block or blocks.

[0370] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 one or more processes and / or blocks Figure 1 means for performing the function specified by the block or blocks.

[0371] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the Figure 1 one or more processes and / or blocks Figure 1 means for performing the function specified by the block or blocks.

[0372] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0373] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory, etc. The memory is an example of computer readable media.

[0374] Computer readable media includes permanent and non-permanent, moveable and non- moveable media that can be implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile discs (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that is accessible to a computing device. According to the definition provided herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0375] It should also be noted that the terms "comprising," "including," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0376] The above description is merely illustrative of the application, and not restrictive. Various modifications and changes can become apparent to those skilled in the art. Incorporating any modification, equivalent substitution, improvement, etc. within the spirit and principle of the application, shall be included in the scope of the claims of the application.

Claims

1. A fault prediction method, characterized in that, include: Acquire multiple initial performance information corresponding to multiple performance indicators of the target device, wherein the initial performance information includes multiple performance data of the target device under the performance indicators within a historical period; Obtain event information of multiple abnormal events of the target device, wherein the occurrence time of the multiple abnormal events is within the historical time period; Based on the multiple initial performance information and the event information, the fault prediction result of the target device is determined.

2. The method according to claim 1, characterized in that, Based on the multiple initial performance information and the event information, the fault prediction result of the target device is determined, including: Determine the number of events among the multiple abnormal events; Based on the number of events, feature mapping processing is performed on the multiple initial performance information to obtain multiple target performance information, wherein the number of performance features included in the target performance information is the same as the number of events; The fault prediction result is determined based on the multiple target performance information and the event information.

3. The method according to claim 2, characterized in that, For any initial performance information, feature mapping is performed on the initial performance information according to the number of events to obtain the target performance information corresponding to the initial performance information, including: Determine the preset dimensions; Based on the number of events and the preset dimensions, feature extraction and mapping processes are performed on the initial performance information to obtain the target performance information.

4. The method according to claim 2, characterized in that, Based on the multiple target performance information and the event information, the fault prediction result is determined, including: The multiple target performance information is spliced ​​together to obtain spliced ​​performance information; The splicing performance information and the event information are processed to obtain the fault prediction result.

5. The method according to claim 4, characterized in that, The splicing performance information and the event information are processed to obtain the fault prediction result, including: The splicing performance information and the event information are fused N times to obtain target performance features and target event features, where N is an integer greater than or equal to 1; The fault prediction result is determined based on the target performance characteristics and the target event characteristics.

6. The method according to claim 5, characterized in that, Determining the fault prediction result based on the target performance characteristics and the target event characteristics includes: The target performance features and the target event features are concatenated to obtain the target features; The target features are enhanced to obtain enhanced target features; The fault prediction result is determined based on the target enhancement features.

7. The method according to claim 5 or 6, characterized in that, The splicing performance information and the event information are fused N times to obtain target performance features and target event features, including: The splicing performance information and the event information are fused to obtain the first performance feature and the first event feature; The (i-1)th performance feature and the (i-1)th event feature are fused to obtain the i-th performance feature and the i-th event feature; wherein i takes the values ​​2, 3, ..., N in sequence, and the N-th performance feature is determined as the target performance feature, and the N-th event feature is determined as the target event feature.

8. The method according to any one of claims 1-7, characterized in that, Obtain event information for multiple abnormal events of the target device, including: Determine the event type and time of occurrence for each abnormal event; For any given abnormal event, determine the multidimensional event characteristics of the abnormal event based on the event type of the abnormal event; The event information is generated based on the occurrence time of each abnormal event and the multidimensional event characteristics of each abnormal event. The event information includes the multidimensional event characteristics of each abnormal event.

9. The method according to claim 8, characterized in that, The multidimensional event characteristics of the abnormal event are determined based on the event type of the abnormal event, including: Obtain preset feature information, which includes multiple event types and event features corresponding to each event type; Based on the event type of the abnormal event and the preset feature information, the multidimensional event features of the abnormal event are determined.

10. The method according to claim 8 or 9, characterized in that, The event information is generated based on the occurrence time of each abnormal event and the multidimensional event characteristics of each abnormal event, including: The multidimensional event features of the multiple abnormal events are combined in order of occurrence from late to early to obtain combined event features. Generate temporal features based on the occurrence time of each abnormal event; The combined event features and the time features are fused to obtain the event information.

11. The method according to claim 10, characterized in that, Based on the occurrence time of each anomalous event, a time feature is generated, including: Determine the latest occurrence time among the multiple occurrence times of the multiple abnormal events; Determine the time difference between each occurrence time and the latest occurrence time to obtain multiple time differences; The feature value corresponding to each time difference is determined, and the feature values ​​of the multiple time differences are combined to obtain the time feature.

12. A fault prediction method, characterized in that, include: Acquire multiple initial performance information corresponding to multiple performance indicators of the target device. The initial performance information includes multiple performance data of the target device under the performance indicators within a historical period. The target device is a cloud server. Obtain event information of multiple abnormal events of the target device, wherein the occurrence time of the multiple abnormal events is within the historical time period; Based on the multiple initial performance information and the event information, the fault prediction result of the target device is determined.

13. The method according to claim 12, characterized in that, Based on the multiple initial performance information and the event information, the fault prediction result of the target device is determined, including: Determine the number of events among the multiple abnormal events; Based on the number of events, feature mapping processing is performed on the multiple initial performance information to obtain multiple target performance information, wherein the number of performance features included in the target performance information is the same as the number of events; The fault prediction result is determined based on the multiple target performance information and the event information.

14. The method according to claim 12 or 13, characterized in that, Obtain event information for multiple abnormal events of the target device, including: Determine the event type and time of occurrence for each abnormal event; For any given abnormal event, determine the multidimensional event characteristics of the abnormal event based on the event type of the abnormal event; The event information is generated based on the occurrence time of each abnormal event and the multidimensional event characteristics of each abnormal event. The event information includes the multidimensional event characteristics of each abnormal event.

15. An electronic device, characterized in that, include: At least one processor; as well as A memory that is communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which, when executed by the at least one processor, cause the electronic device to perform the method according to any one of claims 1-11 or 12-14.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, implement the method as described in any one of claims 1-11 or 12-14.

17. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the method as described in any one of claims 1-11 or 12-14.

Images