Business state prediction method and device, electronic equipment and storage medium

Abstract

The application discloses a service state prediction method and device, electronic equipment and storage medium, and the system comprises: acquiring log historical data set and initial observation probability of each log of a system; constructing an initial hidden Markov model; calculating observation anomaly probability of any log observation sequence according to a forward algorithm module, initial observation probability and model initial parameters, and obtaining anomaly probability distribution result of the log; performing weighted fusion on the anomaly probability distribution result, determining service state sequence length of the system according to the weighted anomaly probability distribution result; acquiring initial service state of the system; performing backtracking analysis on the initial service state according to a Viterbi algorithm module, model initial parameters and service state sequence length, and obtaining target service state sequence of the system; and through a target hidden Markov model, fault recovery and intervention are advanced from post-repair to in-process or even pre-process, so that the maintenance capability and business continuity guarantee capability of the system are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network device management, and particularly relates to a service state prediction method and device, electronic equipment and a storage medium. BACKGROUND

[0002] A business system is a hardware and software integrated platform built by an enterprise to support daily operation and achieve specific business objectives, and efficiency is improved and decisions are optimized through automatic processes and data integration. Therefore, the running state of the business system is the core of the enterprise digital transformation, and its stability and efficiency directly affect the enterprise's operational efficiency, risk control ability and market competitiveness.

[0003] Currently, the maintenance of the running state of the business system mainly analyzes the running data before the fault occurs, resulting in low maintenance efficiency, and obviously increasing the risk of business interruption. Therefore, in the process of maintaining the running state of the business system, the prior art has the problem of poor system maintenance ability and business continuity guarantee ability due to the ability to only remedy after the fact. SUMMARY

[0004] The embodiments of the present application provide a business state prediction method and device, electronic equipment and a storage medium, which aims to advance the fault recovery and intervention of the business system from after-the-fact remediation to in-the-process or even before-the-fact, in order to improve the system's maintenance ability and business continuity guarantee ability.

[0005] To solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0006] A business state prediction method, comprising:

[0007] obtaining a log historical data set of a system and an initial observation probability of each log;

[0008] constructing an initial hidden Markov model, inputting the log historical data set into the initial hidden Markov model, iteratively calculating and determining model initial parameters of the initial hidden Markov model, determining a target hidden Markov model according to the model initial parameters, the target hidden Markov model comprising a forward algorithm module and a Viterbi algorithm module;

[0009] calculating an observation anomaly probability of any log observation sequence according to the forward algorithm module, the initial observation probability and the model initial parameters, to obtain an anomaly probability distribution result of the log;

[0010] performing weighted fusion on the anomaly probability distribution result, and determining a business state sequence length of the system according to the weighted anomaly probability distribution result;

[0011] obtaining an initial business state of the system;

[0012] According to the Viterbi algorithm module, the model initial parameter and the service state sequence length, the initial service state is analyzed in a backward direction to obtain a target service state sequence of the system.

[0013] Optionally, the model initial parameter includes an initial state probability vector, a state transition probability matrix and an observation probability matrix; and the inputting of the log historical data set into the initial hidden Markov model, the iterative calculation and the determination of the model initial parameter of the initial hidden Markov model include:

[0014] The normal state occurrence frequency, the abnormal state occurrence frequency, the state transition probability set and the log state conditional probability set of the log historical data set are obtained;

[0015] The initial state probability vector is determined according to the normal state occurrence frequency and the abnormal state occurrence frequency;

[0016] The state transition probability matrix is determined according to a plurality of state transition probabilities in the state transition probability set;

[0017] The observation probability matrix is determined according to a plurality of log state conditional probabilities in the log state conditional probability set.

[0018] Optionally, the model initial parameter includes an initial state probability vector, a state transition probability matrix and an observation probability matrix; and the calculation of the observation abnormal probability of any log observation sequence according to the forward algorithm module, the initial observation probability and the model initial parameter to obtain an abnormal probability distribution result of a log includes:

[0019] The observation probability of any log at any time is recursively calculated based on the initial observation probability of any log, the initial state probability vector, the state transition probability matrix and the observation probability matrix;

[0020] The observation probability is arrayed to obtain the abnormal probability distribution result of the log;

[0021] The abnormal probability distribution result includes the observation probability of any log at any time.

[0022] Optionally, after the target service state sequence of the system is obtained, the method further includes:

[0023] The abnormal service time of the system is determined according to the target service state sequence;

[0024] The abnormal observation probability of all logs at the abnormal service time is screened out from the abnormal probability distribution result;

[0025] Compare the abnormal observation probabilities of all logs, and determine that the log corresponding to the maximum abnormal observation probability is an abnormal log.

[0026] Optionally, the system includes multiple logs; the weighted fusion of the abnormal probability distribution results comprises determining the service state sequence length of the system according to the weighted abnormal probability distribution results.

[0027] The weight of each log and the abnormal probability distribution result of all logs at a certain time are obtained respectively.

[0028] The weight of each log and the abnormal probability distribution result of the log are weighted and calculated to determine the log weight value of all logs at a certain time, and the log weight value sequence is determined according to the log weight values at all times.

[0029] A preset target time is obtained, and the service state sequence length is determined according to the time value of the preset target time in the log weight value sequence.

[0030] Optionally, the determination of the service state sequence length further comprises:

[0031] The maximum abnormal probability in the log weight value sequence is obtained, and the service state sequence length is determined according to the time value corresponding to the maximum abnormal probability.

[0032] Optionally, the model initial parameters include an initial state probability vector, a state transition probability matrix and an observation probability matrix; the backtracking analysis of the initial service state according to the Viterbi algorithm module, the model initial parameters and the service state sequence length to obtain the target service state sequence of the system comprises:

[0033] According to the initial service state, the initial state probability vector, the state transition probability matrix and the observation probability matrix, the service state probability of the system at the first time is calculated, and the business state corresponding to the maximum business state probability is determined as the target business state at the first time.

[0034] According to the target business state at the first time, the initial state probability vector, the state transition probability matrix and the observation probability matrix, the business state probability of the system at the second time is iteratively and recursively calculated, and the business state corresponding to the maximum business state probability is determined as the target business state at the second time, until a plurality of target business states at the times equal to the number of the service state sequence length are obtained.

[0035] arranging the target service state at the first moment, the target service state at the second moment, and target service states at a plurality of moments equal in number to the length of the service state sequence in time sequence to obtain the target service state sequence.

[0036] A service state prediction device comprises:

[0037] A historical data set acquisition module is configured to acquire a log historical data set of a system.

[0038] An HMM construction module is configured to construct an initial HMM, input the log historical data set into the initial HMM, iteratively calculate and determine model initial parameters of the initial HMM, determine a target HMM according to the model initial parameters, and the target HMM comprises a forward algorithm module and a Viterbi algorithm module.

[0039] An abnormal probability distribution result calculation module is configured to calculate an observation abnormal probability of any log observation sequence according to the forward algorithm module and the model initial parameters, and obtain an abnormal probability distribution result of the log.

[0040] A service state sequence length determination module is configured to perform weighted fusion on the abnormal probability distribution result, and determine a service state sequence length of the system according to the weighted abnormal probability distribution result.

[0041] An initial service state acquisition module is configured to acquire an initial service state of the system.

[0042] A target service state sequence module is configured to perform backtracking analysis on the initial service state according to the Viterbi algorithm module, the model initial parameters, and the service state sequence length, and obtain a target service state sequence of the system.

[0043] An electronic device comprises a memory and a processor, the memory stores a computer program, and the computer program is executed by the processor to make the processor execute the following steps:

[0044] Acquire a log historical data set of a system.

[0045] Construct an initial HMM, input the log historical data set into the initial HMM, iteratively calculate and determine model initial parameters of the initial HMM, determine a target HMM according to the model initial parameters, and the target HMM comprises a forward algorithm module and a Viterbi algorithm module.

[0046] According to the forward algorithm module and the model initial parameter, an observation abnormal probability of any log observation sequence is calculated, and an abnormal probability distribution result of the log is obtained;

[0047] The abnormal probability distribution result is weighted and fused, and a business state sequence length of the system is determined according to the weighted abnormal probability distribution result;

[0048] An initial business state of the system is obtained;

[0049] According to the Viterbi algorithm module, the model initial parameter and the business state sequence length, the initial business state is analyzed in a backtracking manner, and a target business state sequence of the system is obtained.

[0050] A computer readable storage medium, which stores a computer program, the computer program is loaded by a processor to execute the steps of the business state prediction method.

[0051] In the embodiment of the application, the log historical data set of the system is parsed by constructing an initial hidden Markov model, the model initial parameter of the initial hidden Markov model is determined to obtain a target hidden Markov model, and the synergy and correlation of the target hidden Markov model and the log historical data set are ensured. According to the forward algorithm module, the initial observation probability and the model initial parameter, the observation abnormal probability of any log observation sequence is calculated, the abnormal probability distribution result of the log is predicted, the observation abnormal probability of the log at any time based on any log observation sequence is predicted, and the data integrity of the observation abnormal probability is ensured. The abnormal probability distribution result is weighted and fused, the business state sequence length of the system is determined according to the weighted abnormal probability distribution result, the business state sequence length is automatically determined, that is, the time point of the system state that needs to be focused on is determined, and the recursion end point of the Viterbi algorithm. The target business state sequence of the system is obtained by analyzing the initial business state in a backtracking manner, the business state of the system at the time point that needs to be focused on is determined, finally, the business state of the system at a specific time point is predicted and output by the target hidden Markov model, which is beneficial to the recovery and intervention of the fault from the after-the-fact remedy to the in-process or even pre-process, and improves the maintenance ability and business continuity guarantee ability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0053] Figure 1A scene schematic diagram of an embodiment of the service state prediction system provided by the embodiment of the present application;

[0054] Figure 2 A scene schematic diagram of another embodiment of the service state prediction system provided by the embodiment of the present application;

[0055] Figure 3 A flow schematic diagram of an embodiment of the service state prediction method provided by the embodiment of the present application;

[0056] Figure 4 A flow schematic diagram of an embodiment of the service state prediction method provided by the embodiment of the present application;

[0057] Figure 5 A structure schematic diagram of an embodiment of the service state prediction device provided by the embodiment of the present application;

[0058] Figure 6 A structure schematic diagram of an embodiment of the electronic device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0060] In the following description, specific embodiments of the present application will be described with reference to steps and symbols executed by one or more computers, unless otherwise specified. Therefore, these steps and operations will be mentioned several times by the computer execution, and the computer execution referred to herein includes the operation of the computer processing unit represented by the electronic signal in a structured form. This operation transforms the data or maintains it at the location in the memory system of the computer, which can reconfigure or otherwise change the operation of the computer in a manner known to those skilled in the art. The data structure maintained by the data is the physical location of the memory, which has specific characteristics defined by the data format. However, the principles of the present application are described in the above description, which does not represent a limitation, and those skilled in the art will understand that the various steps and operations described below can also be implemented in hardware.

[0061] The term "module" or "unit" used herein can be regarded as a software object executed on the operating system. Different components, modules, engines and services described herein can be regarded as implementation objects on the operating system. The apparatus and method described herein are preferably implemented in software, and of course can also be implemented in hardware, all within the scope of protection of the present application.

[0062] The embodiment of the present application provides a service state prediction method and device, electronic equipment and a storage medium.

[0063] Please refer to Figure 1 , Figure 1 The scene schematic diagram of an embodiment of the service state prediction system provided by the embodiment of the present application can include a client 100 and a server 200, the client 100 and the server 200 are connected through a network, the server 200 is integrated with a service state prediction device, the server 200 can be a work platform server (namely a server loaded with a work platform), such as a server in Figure 1 The client 100 can access the server 200. In the embodiment of the present application, the server 200 is mainly used for obtaining a log historical data set and an initial observation probability of each log of a system; constructing an initial hidden Markov model, inputting the log historical data set into the initial hidden Markov model, iteratively calculating and determining model initial parameters of the initial hidden Markov model, determining a target hidden Markov model according to the model initial parameters, the target hidden Markov model including a forward algorithm module and a Viterbi algorithm module; calculating an observation abnormal probability of any log observation sequence according to the forward algorithm module, the initial observation probability and the model initial parameters, obtaining an abnormal probability distribution result of the log; performing weighted fusion on the abnormal probability distribution result, determining a service state sequence length of the system according to the weighted abnormal probability distribution result; obtaining an initial service state of the system; performing backtracking analysis on the initial service state according to the Viterbi algorithm module, the model initial parameters and the service state sequence length, obtaining a target service state sequence of the system.

[0064] In this embodiment of the invention, the server 200 can be a standalone server, a server network, or a server cluster. For example, the server 200 described in this embodiment includes, but is not limited to, a computer, a network host, a single network server, a set of multiple network servers, or a cloud server composed of multiple servers. The cloud server is composed of a large number of computers or network servers based on cloud computing. In this embodiment of the invention, communication between the server and the client can be achieved through any communication method, including but not limited to, mobile communication based on the 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), and Worldwide Interoperability for Microwave Access (WiMAX), or computer network communication based on the TCP / IP Protocol Suite (TCP / IP) and User Datagram Protocol (UDP).

[0065] It is understood that the client 100 used in this embodiment of the invention can be understood as a client device. A client device includes both receiving and transmitting hardware, that is, a device with receiving and transmitting hardware capable of performing bidirectional communication on a bidirectional communication link. Such a client device may include cellular or other communication devices, having a single-line display, a multi-line display, or a cellular or other communication device without a multi-line display. Specifically, the client 100 may be a desktop terminal or a mobile terminal, specifically a mobile phone, tablet computer, laptop computer, etc.

[0066] Those skilled in the art will understand that Figure 1 The application environment shown is merely one application scenario of the solution in this application and does not constitute a limitation on the application scenario of the solution in this application. Other application environments may include those that are more specific to this application. Figure 1 The number of more or fewer servers shown, or the server network connectivity relationships, for example... Figure 1 Only one server and two clients are shown in the diagram. It is understood that the business status prediction system may also include one or more other servers, and / or one or more clients connected to the server network, which is not limited here.

[0067] In some embodiments of the present application, the work platform can be an enterprise office platform, for example, WeChat for enterprise, and the server 200 can further include an enterprise office platform contact server, an enterprise office platform configuration management server, and a Web management server. An enterprise user or a developer can access the Web management server through a Web browsing terminal to configure the field configuration information on the enterprise office platform configuration management server, and set and store the enterprise user information of the enterprise staff of the enterprise office platform on the enterprise office platform contact server.

[0068] In addition, as Figure 2 shown, Figure 2 the business state prediction system provided by the embodiments of the present application, the business state prediction system can further include a storage end 300 for storing data, such as an object database, which stores object data, which can include application templates (such as approval templates, clock-in templates, and various application templates), file data (such as Word files, Excel files, or PPT files in various formats), picture data (such as jpg, png, bmp, and various formats of pictures), and various data. Correspondingly, the object database can also be divided into various types of data, such as an application database, a file database, or a picture database.

[0069] It should be noted that Figures 1-2 the scene diagram of the business state prediction system shown is only an example, and the business state prediction system and the scene described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of the business state prediction system and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0070] The following will be described in detail in conjunction with specific embodiments.

[0071] In this embodiment, the business state prediction device will be described from the perspective of the business state prediction device, which can be integrated in the server 200.

[0072] The present application provides a business state prediction method, please refer to Figure 3 , Figure 3 the flowchart of the business state prediction method provided by the embodiments of the present application, which includes:

[0073] S301: Obtain the log historical data set of the system and the initial observation probability of each log;

[0074] In a specific embodiment, the log data is a "running fingerprint" of a modern digital system, and almost all software and hardware systems with computing functions generate log records during operation. Therefore, the system in the present application can be any modern digital system containing log data, which is not limited herein.

[0075] The logs of the system are classified into operating system logs, database logs and middleware logs according to the system architecture, classified into server running logs according to the resource dimension, classified into business system logs according to the business dimension, and the logs of the system can also be additional information obtained by the system. The classification standard of the logs is not limited in the present application, and the types and quantities of the logs are also not limited, but obviously, the more abundant the types and quantities of the logs are, the more accurate the subsequent system business state prediction result is.

[0076] The log historical data set refers to the complete set of all recorded and collected log events of various types generated by the system in the past period of time, and to improve the effect of business state prediction, the log historical data set covers all related logs that can be generated by the system.

[0077] Since the log historical data set includes different log types, and different types of logs represent different characteristics of the system, and because the same type of log can also contain different state information of the system, each log needs to be analyzed individually, and each log is the smallest calculation unit of log analysis, which can be a certain type of log or a certain log, and is not limited herein to meet the state analysis of the system.

[0078] The initial observation probability of each log is the observation state of the log at time zero obtained by analyzing the historical data set, which can be normal log, abnormal log, or other observation states of the log, which is not described herein. For example, by statistical analysis of historical data, it can be calculated that when the "disk space is insufficient" log appears, the proportion (probability) of the system actually being in the "high-risk" state is how much.

[0079] S302: Construct an initial hidden Markov model, input the log historical data set into the initial hidden Markov model, iteratively calculate and determine the model initial parameters of the initial hidden Markov model, determine a target hidden Markov model according to the model initial parameters, and the target hidden Markov model includes a forward algorithm module and a Viterbi algorithm module;

[0080] In one embodiment, a Hidden Markov Model (HMM) is a statistical model that describes a double stochastic process consisting of a sequence of hidden states and a sequence of observations. The core assumption is that the current state depends only on the previous state (Markov property) and the observation depends only on the current state. In this application, HMM is used to predict the abnormal state of a business system through log data.

[0081] A Hidden Markov Model is defined by the following five-tuple:

[0082] 1. Set of hidden states .

[0083] where the set of hidden states is the actual state of the system (normal / abnormal) and cannot be directly observed by the observer.

[0084] 2. Set of observation states .

[0085] The measurable output (e.g., observable data of the system).

[0086] 3. State transition probability matrix (T) A = [a ij ] ).

[0087] where a ij represents the probability of transitioning from state s i to s j , satisfying the Markov property: the current state depends only on the previous state.

[0088] 4. Observation probability matrix (O) B = [b j (k)] ).

[0089] b j (k) represents the probability of generating observation s j under state o k .

[0090] 5. Initial state probability distribution (π) π = π i ).

[0091] The probability of the system being in each hidden state at the initial time.

[0092] It should be noted that for a specific model or type of system, the hidden state set and the observation state set are determined and relatively fixed, so after determining the state transition probability matrix (A), the observation probability matrix (B) and the initial state probability vector (π) of the hidden Markov model, a reliable target hidden Markov model can be obtained.

[0093] In this embodiment, the model initial parameters include the state transition probability matrix (A), the observation probability matrix (B) and the initial state probability vector (π), then by inputting the log historical data set into the initial hidden Markov model, the model initial parameters of the initial hidden Markov model can be directly iteratively calculated, and then the target hidden Markov model can be directly obtained.

[0094] The forward algorithm (Forward Algorithm), also known as the forward algorithm, is a key dynamic programming method for efficiently calculating the probability P(O|λ) of the observation sequence in the hidden Markov model. It avoids enumerating all possible hidden state paths, reduces the exponential computational complexity to polynomial, and is a key tool for solving the "probability calculation problem" of the hidden Markov model.

[0095] The Viterbi algorithm is a dynamic programming algorithm for solving the most likely state sequence in the hidden Markov model. Its core goal is to backtrack and deduce the optimal hidden state sequence that produces the observation based on the observation sequence. The Viterbi algorithm calculates the conditional probability of all possible hidden state sequences under a given observation sequence through dynamic programming, and finally selects the path with the maximum probability as the optimal solution.

[0096] S303: Calculate the observation anomaly probability of any log observation sequence according to the forward algorithm module, the initial observation probability and the model initial parameters, and obtain the abnormal probability distribution result of the log;

[0097] In a specific embodiment, the log observation sequence refers to an observation data set of a log arranged in time sequence or a group of logs of the same type. By analyzing the abnormal probability of each observation element in the log observation sequence, it can be identified whether there is abnormal behavior of the system at the time point corresponding to the observation element, and thus real-time detection and early warning of the system running state can be realized.

[0098] The abnormal probability distribution result shows the observation anomaly probability of any log or observation sequence of the log to be concerned in the system, and is sorted in a standard manner, so as to timely discover the logs and time points with high observation anomaly probability, and thus accurately locate the potential risk points of the system.

[0099] Further, since the forward algorithm is provided with a recursive mechanism of dynamic programming, the path enumeration problem of exponential complexity can be converted into polynomial-level calculation, and thus the abnormality degree of each observation sequence can be accurately evaluated by accumulating the probability layer by layer through the recursive formula, which not only greatly improves the calculation efficiency and ensures the completion of abnormality detection of large-scale log data within a limited time, but also adaptively obtains a plurality of reasonable log observation sequences and observation abnormality probability of each log observation sequence according to the characteristics of the system itself, so as to obtain the abnormality probability distribution result of the system as a whole.

[0100] S304: Weighted fusion is performed on the abnormality probability distribution result, and the service state sequence length of the system is determined according to the weighted abnormality probability distribution result.

[0101] In an embodiment, the service state sequence length refers to the number or sum of steps of different "states" experienced by a service entity in its life cycle. In the present application, since the log observation sequence and the service state sequence also contain time point information, the time difference value can be determined by combining the known time information after the time point to be concerned is determined, so as to determine the specific length of the service state sequence.

[0102] In addition, since the abnormality probability distribution result contains the observation abnormality probability of a plurality of logs, different log types have different influences on the system service state, and the observation abnormality probability of different logs at the same time point is also different, therefore, by weighted fusion of the abnormality probability distribution result, the abnormality influences of various logs of the system can be comprehensively considered, so as to intuitively and accurately show the overall service state of the system, and to determine the length of the service state sequence.

[0103] S305: Obtain the initial service state of the system.

[0104] In an embodiment, the initial service state refers to the basic state of the system at the beginning of the service, which is generally normal service state or abnormal service state of the system. By determining the initial service state of the system, a reference is provided for the subsequent service state conversion, and the analyzability of the service state sequence is ensured.

[0105] S306: Perform backtracking analysis on the initial service state according to the Viterbi algorithm module, the initial model parameters and the service state sequence length, to obtain the target service state sequence of the system.

[0106] In an embodiment, the backtracking analysis refers to reiteratively progressing the initial service state on the basis of the determined service state sequence length, so as to determine a service state sequence which is equal in number to the service state sequence length and has the maximum abnormality probability value, and obtain the target service state sequence of the system, and thus determine the service state of the system at the time point to be concerned.

[0107] It should be noted that, since the forward algorithm can only predict the observation abnormal probability of the log at a certain time point, and cannot directly show the hidden state, i.e., the business state of the system, in order to reveal the change of the business state of the system, it is necessary to use the Viterbi algorithm to perform backtracking analysis, and through the dynamic programming principle, the initial parameters of the model are combined to gradually deduce the business state of the system at each time point, and finally a complete target business state sequence is constructed.

[0108] In the embodiment of the application, the initial hidden Markov model is constructed to analyze the log historical data set of the system, the initial parameters of the initial hidden Markov model are determined to obtain the target hidden Markov model, which can ensure the cooperation and correlation of the target hidden Markov model and the log historical data set; the observation abnormal probability of any log observation sequence is calculated according to the forward algorithm, the initial observation probability and the initial parameters of the model, the abnormal probability distribution result of the log is predicted, the observation abnormal probability of the log at any time point based on any log observation sequence is realized, and the data integrity of the observation abnormal probability is ensured; the abnormal probability distribution result is weighted and fused, the business state sequence length of the system is determined according to the weighted abnormal probability distribution result, the business state sequence length can be automatically determined, i.e., the time point of the system state that needs to be focused on, the recursive end point of the Viterbi algorithm; the initial business state is analyzed by backtracking according to the Viterbi algorithm, the initial parameters of the model and the business state sequence length, the target business state sequence of the system is obtained, the business state of the system at the time point that needs to be focused on can be determined, finally, the business state of the system at a specific time point is predicted and output by the target hidden Markov model, which is beneficial to advance the fault recovery and intervention from after-the-fact remediation to in-process or even pre-process, and improve the maintenance ability and business continuity assurance ability of the system.

[0109] In a specific embodiment, in S301, the log historical data set includes the logs of the operating system database, the database, the middleware, the server and the business system of the system, and also includes the logs of the environment control, the business system state and the server, which is not limited here.

[0110] Specifically, the logs of the operating system database, the database, the middleware, the server and the business system are collected by using rsyslog or nxlog, and the environment control, the business system state and the server load information are obtained by API.

[0111] In a specific embodiment, in S302, the initial model parameters include an initial state probability vector, a state transition probability matrix, and an observation probability matrix; the log historical data set is input into the initial hidden Markov model, and the initial model parameters of the initial hidden Markov model are iteratively calculated and determined, specifically including:

[0112] The normal state occurrence frequency, the abnormal state occurrence frequency, the state transition probability set, and the log state conditional probability set of the log historical data set are obtained; the initial state probability vector is determined according to the normal state occurrence frequency and the abnormal state occurrence frequency; the state transition probability matrix is determined according to the plurality of state transition probabilities in the state transition probability set; and the observation probability matrix is determined according to the plurality of log state conditional probabilities in the log state conditional probability set.

[0113] In a specific embodiment, the log state conditional probability refers to the conditional probability of generating an observation log event under different log states, which is a set of probability mappings from states to observations. For example, given the state "error", the probability of observing the log event "memory overflow" can be 0.7; given the state "normal", the probability of observing the event "user login" can be 0.9, and so on. The log state conditional probability set refers to the set of all log state conditional probabilities obtained based on the log historical data set.

[0114] It should be noted that the initial state probability vector refers to the distribution of the probability of the hidden state of the system. In this embodiment, the hidden state of the system includes the normal state and the abnormal state, and then the initial state probability vector is (normal state probability, abnormal state probability). By representing the normal state probability and the abnormal state probability of the system by the normal state occurrence frequency and the abnormal state occurrence frequency respectively, the initial state probability vector is obtained.

[0115] In a specific embodiment, when the normal state occurrence frequency of the log historical data set is 0.6 and the abnormal state occurrence frequency is 0.4, the initial state probability vector is (0.6, 0.4).

[0116] The state transition probability matrix is a matrix composed of probabilities of transitioning from a certain state to another state, representing the transition possibility of the system between different states. Specifically, the elements of the state transition probability matrix include the probability of transitioning from the normal state to the normal state, the probability of transitioning from the normal state to the abnormal state, the probability of transitioning from the abnormal state to the normal state, and the probability of transitioning from the abnormal state to the abnormal state. These probability values are obtained by counting the state transition in the log historical data set, ensuring that the matrix reflects the state change trend in the actual operation of the system.

[0117] The observation probability matrix represents the probability of generating a specific observation event under each state, and its elements are determined by the log state conditional probability set.

[0118] In the embodiment, the data and data conversion in the log history data set of the system are analyzed, the initial parameters of the model are directly determined according to the log history data set, the target hidden Markov model highly consistent with the system itself is constructed, the state recognition accuracy and the system anomaly detection efficiency are improved, and the reliability of the target hidden Markov model is ensured.

[0119] In a specific embodiment, in S303, the observation anomaly probability of any log observation sequence is calculated according to the forward algorithm module, the initial observation probability and the initial parameters of the model, and the abnormal probability distribution result of the log is obtained, specifically including: based on the initial observation probability, the initial state probability vector, the state transition probability matrix and the observation probability matrix of any log, the observation probability of any log at any time is recursively calculated; the observation probability is arrayed to obtain the abnormal probability distribution result of the log; wherein the abnormal probability distribution result includes the observation probability of any log at any time.

[0120] In the embodiment, the forward algorithm module decomposes the global path probability calculation into the superposition of local state transition through the recursive mechanism of dynamic programming, and retains the joint probability information of all paths. Since the recursive calculation can be stopped at any time point, the forward algorithm module can determine the observation probability of any log at any time. Then, by arraying the observation probability in a certain order, the abnormal probability distribution result representing the observation probability of the system can be obtained.

[0121] In a specific embodiment, the abnormal probability distribution result can be represented by a matrix. The rows of the matrix represent the observation probabilities of a certain log at different times, and the columns of the matrix correspond to different logs. Other forms can also be used, which are not limited herein.

[0122] In a specific embodiment, in S304, the system includes multiple logs; the abnormal probability distribution result is weighted and fused, and the business state sequence length of the system is determined according to the weighted abnormal probability distribution result, specifically including: the weight of each log and the abnormal probability distribution result of all logs at a certain time are obtained respectively; the weight of each log and the abnormal probability distribution result of the log are weighted and calculated to determine the log weight value of all logs at a certain time, and the log weight value sequence is determined according to the log weight value at all times; a preset target time is obtained, and the business state sequence length is determined according to the time value of the log weight value sequence at the preset target time.

[0123] In a specific embodiment, the system logs are divided into operating system logs, database logs and middleware logs, and the weights of the operating system logs, the database logs and the middleware logs are set to 0.7, 0.2 and 0.1 respectively according to the needs, so as to distinguish the importance of different log types, and flexibly modify the offset direction of the log weight according to the needs, so that the log weight sequence is more in line with the actual needs.

[0124] The log weight sequence is a time series data, and the value at each time point represents the comprehensive abnormality possibility score obtained by weighting and fusing all system log types (such as operating system, database, middleware logs) according to their importance weights (such as 0.7, 0.2, 0.1) at that moment.

[0125] After obtaining the log weight sequence, since the log weight sequence itself contains time information, it is generally necessary to determine the log state of the system at a specific moment according to the actual needs, so the preset target time is matched with the time value in the log weight sequence, and the time difference of the preset target time compared with the current time or a certain reference time is found, so as to directly determine the length of the business state sequence according to the time difference.

[0126] In another specific embodiment, after obtaining the log weight sequence, the maximum abnormal probability in the log weight sequence can also be obtained, and the length of the business state sequence is determined according to the time value corresponding to the maximum abnormal probability.

[0127] By taking the maximum abnormal probability as the reference to determine the time when the system is most likely to be abnormal, the time difference of the time when the system is most likely to be abnormal compared with the current time or a certain reference time is determined, and the length of the business state sequence is further accurately locked.

[0128] In a specific embodiment, after determining the length of the service state sequence in S305, the initial service state is analyzed by backtracking according to the Viterbi algorithm module, the initial model parameters and the length of the service state sequence, to obtain the target service state sequence of the system, including: calculating the service state probability of the system at the first time according to the initial service state, the initial state probability vector, the state transition probability matrix and the observation probability matrix, and determining that the service state corresponding to the maximum service state probability is the target service state at the first time; iteratively and recursively calculating the service state probability of the system at the second time according to the target service state at the first time, the initial state probability vector, the state transition probability matrix and the observation probability matrix, and determining that the service state corresponding to the maximum service state probability is the target service state at the second time, until a plurality of target service states at multiple times equal to the number of the length of the service state sequence are obtained; arranging the target service state at the first time, the target service state at the second time and the target service states at the multiple times equal to the number of the length of the service state sequence in chronological order to obtain the target service state sequence.

[0129] In a specific embodiment, the initial service state refers to the service state of the system at the starting time, which is usually set to the normal state.

[0130] It should be noted that the initial service state and the initial state probability vector are respectively the service state and the probability distribution of the system at the zeroth time, which are the basic input parameters of the Viterbi algorithm. After determining the length of the service state sequence, the number of iterations of the Viterbi algorithm is directly determined. Since the Viterbi algorithm is iterated based on the service state of the system, the target service state sequence obtained finally directly reflects the service state of the system at the target time.

[0131] In this embodiment, the service state of the system is analyzed by the Viterbi algorithm to directly determine the service state of the system at the target time, which realizes intuitive acquisition of the service state information of the system, solves the problem that the service state of the system cannot be directly displayed in the forward algorithm, and improves the efficiency and intuitiveness of service state recognition.

[0132] In a specific embodiment, after obtaining the service state of the system at the target time, since the service state of the system is generally represented as normal or abnormal, it is difficult to quickly troubleshoot the system through the service state of the system. Therefore, after obtaining the target service state sequence of the system, it further includes: determining the abnormal service time of the system according to the target service state sequence; filtering out the abnormal observation probability of all logs at the abnormal service time from the abnormal probability distribution result; comparing the abnormal observation probabilities of all logs, and determining that the log corresponding to the maximum abnormal observation probability is the abnormal log.

[0133] The abnormal business time refers to a time at which a target business state sequence result of the system is an abnormal state.

[0134] In this embodiment, in order to find problems of the system in time and pertinently, the abnormal business time of the system is taken as a breakthrough point, all logs corresponding to the time are found, and the log entries with higher abnormal observation probability are analyzed in depth, so as to determine the abnormal log causing the system to be abnormal, and thus the system is quickly maintained.

[0135] In a specific embodiment, the state of business abnormality has two kinds (normal / abnormal), as a hidden state, the log information found by the viewpoint has database logs, middleware logs, business system logs, and monitoring index data server load, and room dynamic information, these information can be used as observation sequences in a hidden Markov model (HMM), by analyzing these data, the state (normal or abnormal) of the current business system is inferred, and the specific steps are as follows:

[0136] 1) Hidden state: normal / abnormal;

[0137] 2) Observation state: database logs (normal log / abnormal log), middleware logs (normal log / abnormal log), business system logs (normal log / abnormal log), server load (low / high), and environment control state (normal / abnormal);

[0138] 3) Initial state distribution: p1=P(business normal state), p2=P(business abnormal state);

[0139] 4) State transition probability matrix: the transition probability matrix of two states;

[0140] 5) Observation probability matrix: ;

[0141] (B1=P(database log normal | business system normal));

[0142] (B2=P(database log abnormal | business system normal));

[0143] (B3=P(middleware log normal | business system normal));

[0144] (B4=P(middleware log abnormal | business system normal));

[0145] (B5=P(server load high | business system normal));

[0146] (B6=P(server load low | business system normal));

[0147] (B7=P(environment control state normal | business system normal));

[0148] (B8=P(Environmental control status abnormal | Business system normal)).

[0149] Please see Figure 4 , Figure 4 This is a flowchart illustrating an embodiment of the business status prediction method provided by the present invention. The flowchart clearly demonstrates the two-layer structure of the Hidden Markov Model (HMM): the business system status (normal / abnormal) is used as the hidden state, and multi-dimensional data such as database logs, middleware logs, and server load are used as the observation sequence. This flowchart essentially constructs a complete technical framework from log data collection to intelligent business status prediction, and achieves dynamic coupling optimization between the prediction system and the log parsing system. This transforms business anomaly prediction from passive response to proactive early warning, shifting the operational response time window forward.

[0150] Based on the above business status prediction method, the prediction results are used to adjust the log parsing strategy through a dynamic feedback mechanism, forming an iterative optimization path of "prediction-optimization-re-prediction", which improves the model prediction efficiency.

[0151] To facilitate better implementation of the service status prediction method provided in the embodiments of the present invention, the present invention also provides an apparatus based on the above-described service status prediction method. The meanings of the terms used are the same as in the above-described service status prediction method, and specific implementation details can be found in the descriptions in the method embodiments.

[0152] Please see Figure 5 , Figure 5 This is a schematic diagram of a service status prediction device according to an embodiment of the present invention. The service status prediction device 500 may include:

[0153] Historical dataset acquisition module 501 is used to acquire the system's historical log dataset;

[0154] Hidden Markov Model Construction Module 502 is used to construct an initial Hidden Markov Model, input the log history dataset into the initial Hidden Markov Model, iteratively calculate and determine the initial parameters of the initial Hidden Markov Model, and determine the target Hidden Markov Model based on the initial parameters. The target Hidden Markov Model includes a forward algorithm module and a Viterbi algorithm module.

[0155] The anomaly probability distribution result calculation module 503 is used to calculate the observation anomaly probability of any log observation sequence based on the forward algorithm module and the initial parameters of the model, and obtain the anomaly probability distribution result of the log.

[0156] The business state sequence length determination module 504 is used to perform weighted fusion of the abnormal probability distribution results and determine the length of the system's business state sequence based on the weighted abnormal probability distribution results.

[0157] Initial business status acquisition module 505 is used to acquire the initial business status of the system;

[0158] The target business state sequence module 506 is used to perform backtracking analysis on the initial business state based on the Viterbi algorithm module, the initial parameters of the model, and the length of the business state sequence, so as to obtain the target business state sequence of the system.

[0159] This invention also provides an electronic device, such as... Figure 6 As shown, Figure 6 This is a schematic diagram of the structure of an electronic device according to an embodiment of the present invention, specifically:

[0160] The electronic device may include components such as a processor 601 with one or more processing cores, a memory 602 with one or more computer-readable storage media, a power supply 603, and an input unit 604. Those skilled in the art will understand that... Figure 6 The electronic device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0161] The processor 601 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 602, and by calling data stored in the memory 602, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. Optionally, the processor 601 may include one or more processing cores; preferably, the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operation of the storage medium, user interface, and application programs, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 601.

[0162] The memory 602 can be used to store software programs and modules. The processor 601 executes various functional applications and data processing by running the software programs and modules stored in the memory 602. The memory 602 may mainly include a program storage area and a data storage area. The program storage area may store applications required for operating the storage medium and at least one function (such as sound playback function, image playback function, etc.); the data storage area may store data created according to the use of the electronic device. In addition, the memory 602 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 602 may also include a memory controller to provide the processor 601 with access to the memory 602.

[0163] The electronic device also includes a power supply 603 for powering the various components, preferably the power supply 603 is logically connected to the processor 601 through a power management storage medium, so as to realize the functions of management of charging, discharging and power consumption management through the power management storage medium. The power supply 603 can also include one or more than one direct current or alternating current power supply, rechargeable storage medium, power failure detection circuit, power converter or inverter, power state indicator and any other components.

[0164] The electronic device can also include an input unit 604, which can be used to receive input digital or character information, and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function controls.

[0165] Although not shown, the electronic device can also include a display unit and the like, which will not be described here. In particular, in the present embodiment, the processor 601 in the electronic device will load one or more executable files corresponding to the processes of one or more application programs into the memory 602 according to the following instructions, and run the application programs stored in the memory 602 by the processor 601, so as to realize various functions, such as:

[0166] Obtain a log history data set of a system and an initial observation probability of each log; construct an initial hidden Markov model, input the log history data set into the initial hidden Markov model, iteratively calculate and determine model initial parameters of the initial hidden Markov model, determine a target hidden Markov model according to the model initial parameters, the target hidden Markov model includes a forward algorithm module and a Viterbi algorithm module; calculate an observation anomaly probability of any log observation sequence according to the forward algorithm module, the initial observation probability and the model initial parameters, and obtain an anomaly probability distribution result of the log; perform weighted fusion on the anomaly probability distribution result, determine a business state sequence length of the system according to the weighted anomaly probability distribution result; obtain an initial business state of the system; perform backtracking analysis on the initial business state according to the Viterbi algorithm module, the model initial parameters and the business state sequence length, and obtain a target business state sequence of the system.

[0167] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructions, or by related hardware controlled by the instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0168] To this end, the embodiment of the present application provides a computer readable storage medium, which stores a computer program, the computer program is loaded by a processor to execute the steps in any one of the business state prediction methods provided by the embodiments of the present application. For example, the computer program loaded by the processor can execute the following steps:

[0169] obtain a log history data set of the system and an initial observation probability of each log; construct an initial hidden Markov model, input the log history data set into the initial hidden Markov model, iteratively calculate and determine model initial parameters of the initial hidden Markov model, determine a target hidden Markov model according to the model initial parameters, the target hidden Markov model comprising a forward algorithm module and a Viterbi algorithm module; calculate an observation abnormal probability of any log observation sequence according to the forward algorithm module, the initial observation probability and the model initial parameters, and obtain an abnormal probability distribution result of the log; perform weighted fusion on the abnormal probability distribution result, determine a business state sequence length of the system according to the weighted abnormal probability distribution result; obtain an initial business state of the system; perform backtracking analysis on the initial business state according to the Viterbi algorithm module, the model initial parameters and the business state sequence length, and obtain a target business state sequence of the system.

[0170] The specific implementation of each operation can refer to the foregoing embodiments, and will not be described here again.

[0171] The computer readable storage medium can include a read only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0172] The computer program stored in the computer readable storage medium can execute the steps of any one of the business state prediction methods provided by the embodiments of the present application, and thus can achieve the beneficial effects of any one of the business state prediction methods provided by the embodiments of the present application. Details are described in the foregoing embodiments, and will not be described here again.

[0173] The above describes in detail a business state prediction method, device, electronic equipment and storage medium provided by an embodiment of the present application. The principle and implementation manner of the present application are described by applying specific examples in this paper. The above embodiment is only used to help understand the method and core idea of the present application. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manner and application range will be changed. The above description should not be understood as limiting the present application.

Claims

1. A service state prediction method characterized by, The method comprises the following steps: acquiring a log history data set of a system and an initial observation probability of each log, the initial observation probability being a probability of an observation state of the log at time zero obtained by analyzing the history data set; constructing an initial hidden Markov model and inputting the log history data set into the initial hidden Markov model, iteratively calculating and determining model initial parameters of the initial hidden Markov model, determining a target hidden Markov model according to the model initial parameters, the target hidden Markov model comprising a forward algorithm module and a Viterbi algorithm module; calculating an observation anomaly probability of any log observation sequence according to the forward algorithm module, the initial observation probability and the model initial parameters, and obtaining an anomaly probability distribution result of the log; performing weighted fusion on the anomaly probability distribution result, determining a business state sequence length of the system according to the weighted anomaly probability distribution result, the business state sequence length being a total sum of different states experienced by a business entity in a life cycle; the system comprises multiple logs; the weight of each log and the anomaly probability distribution result of all logs at a certain time are acquired respectively; the weight of each log and the anomaly probability distribution result of the log are calculated by weighting to determine a log weight value of all logs at a certain time, and a log weight value sequence is determined according to the log weight value at all times; a preset target time is acquired, and the business state sequence length is determined according to the time value of the preset target time in the log weight value sequence; acquiring an initial business state of the system; performing backtracking analysis on the initial business state according to the Viterbi algorithm module, the model initial parameters and the business state sequence length to obtain a target business state sequence of the system, the model initial parameters comprising an initial state probability vector, a state transition probability matrix and an observation probability matrix; calculating a business state probability of the system at a first time according to the initial business state, the initial state probability vector, the state transition probability matrix and the observation probability matrix, and determining a business state corresponding to a maximum business state probability as a target business state at the first time; iteratively and recursively calculating a business state probability of the system at a second time according to the target business state at the first time, the initial state probability vector, the state transition probability matrix and the observation probability matrix, and determining a business state corresponding to a maximum business state probability as a target business state at the second time, until a plurality of target business states at a plurality of times equal to the business state sequence length are obtained; arranging the target business state at the first time, the target business state at the second time and the target business states at the plurality of times equal to the business state sequence length in chronological order to obtain the target business state sequence.

2. The service state prediction method according to claim 1, characterized by, The model initial parameters comprise an initial state probability vector, a state transition probability matrix and an observation probability matrix; the inputting of the log history data set into the initial hidden Markov model and the iteratively calculating and determining of the model initial parameters of the initial hidden Markov model comprise: acquiring a normal state occurrence frequency, an abnormal state occurrence frequency, a state transition probability set, and a log state conditional probability set of the log history data set; determining the initial state probability vector according to the normal state occurrence frequency and the abnormal state occurrence frequency; determining the state transition probability matrix according to a plurality of state transition probabilities in the state transition probability set; determining the observation probability matrix according to a plurality of log state conditional probabilities in the log state conditional probability set.

3. The service state prediction method according to claim 1, characterized by, The model initial parameters include an initial state probability vector, a state transition probability matrix, and an observation probability matrix; the observation abnormal probability of any log observation sequence is calculated according to the forward algorithm module, the initial observation probability, and the model initial parameters, and an abnormal probability distribution result of the log is obtained, including: recursively calculating the observation probability of any log at any time based on the initial observation probability of any log, the initial state probability vector, the state transition probability matrix, and the observation probability matrix; arraying the observation probability to obtain the abnormal probability distribution result of the log; The abnormal probability distribution result includes the observation probability of any log at any time.

4. The service state prediction method according to claim 3, characterized by, After obtaining the target business state sequence of the system, further comprising: determining the abnormal business time of the system according to the target business state sequence; filtering out the abnormal observation probability of all logs at the abnormal business time in the abnormal probability distribution result; comparing the abnormal observation probability of all logs, and determining the log corresponding to the maximum abnormal observation probability as an abnormal log.

5. The service state prediction method according to claim 1, characterized by, The determination of the business state sequence length further comprises: obtaining the maximum abnormal probability in the log weight sequence, and determining the business state sequence length according to the time value corresponding to the maximum abnormal probability.

6. A service state prediction apparatus characterized by comprising: comprising: a history data set acquisition module for acquiring a log history data set of a system and an initial observation probability of each log, the initial observation probability being the observation state probability of the log at zero time obtained by analyzing the history data set; a hidden Markov model construction module for constructing an initial hidden Markov model, inputting the log history data set into the initial hidden Markov model, iteratively calculating and determining model initial parameters of the initial hidden Markov model, determining a target hidden Markov model according to the model initial parameters, the target hidden Markov model including a forward algorithm module and a Viterbi algorithm module; an abnormal probability distribution result calculation module for calculating the observation abnormal probability of any log observation sequence according to the forward algorithm module, the initial observation probability, and the model initial parameters, and obtaining an abnormal probability distribution result of the log. The service state sequence length determination module is configured to perform weighted fusion on the abnormal probability distribution result, determine a service state sequence length of the system according to the weighted abnormal probability distribution result, and the service state sequence length refers to a total number of different states experienced by a service entity in a life cycle; the system includes multiple logs; weights of each log and the abnormal probability distribution result of all logs at a certain time are obtained respectively; the weight of each log and the abnormal probability distribution result of the log are subjected to weighted calculation to determine a log weight value at the certain time, and a log weight value sequence is determined according to the log weight values at all times; a preset target time is obtained, and the service state sequence length is determined according to a time value of the preset target time in the log weight value sequence; The initial service state acquisition module is configured to obtain an initial service state of the system; The target service state sequence module is configured to perform backtracking analysis on the initial service state according to the Viterbi algorithm module, the model initial parameters and the service state sequence length to obtain a target service state sequence of the system; the model initial parameters include an initial state probability vector, a state transition probability matrix and an observation probability matrix; a service state probability of the system at a first time is calculated according to the initial service state, the initial state probability vector, the state transition probability matrix and the observation probability matrix, and a service state corresponding to a maximum service state probability is determined as a target service state at the first time; a service state probability of the system at a second time is iteratively and recursively calculated according to the target service state at the first time, the initial state probability vector, the state transition probability matrix and the observation probability matrix, and a service state corresponding to a maximum service state probability is determined as a target service state at the second time, until a plurality of target service states at a plurality of times equal to the service state sequence length are obtained; the target service states at the first time, the second time and the plurality of times equal to the service state sequence length are arranged in time sequence to obtain the target service state sequence.

7. An electronic device, comprising: The memory stores a computer program, and the processor executes the computer program to perform the following steps: Obtain a log historical data set of a system and an initial observation probability of each log, the initial observation probability being a probability of an observation state of the log at zero time obtained by analyzing the historical data set; Construct an initial hidden Markov model, input the log historical data set into the initial hidden Markov model, iteratively calculate and determine model initial parameters of the initial hidden Markov model, determine a target hidden Markov model according to the model initial parameters, and the target hidden Markov model includes a forward algorithm module and a Viterbi algorithm module; Calculate an observation abnormal probability of any log observation sequence according to the forward algorithm module, the initial observation probability and the model initial parameters to obtain an abnormal probability distribution result of the log. The abnormal probability distribution results are fused by weighting, and a service state sequence length of the system is determined according to the weighted abnormal probability distribution results, the service state sequence length being a sum of the number of different states experienced by a service entity in a life cycle; the system includes multiple logs; a weight of each log and the abnormal probability distribution results of all logs at a certain time are obtained respectively; the weight of each log and the abnormal probability distribution results of the log are calculated by weighting to determine a log weight value of all logs at a certain time, and a log weight value sequence is determined according to the log weight values at all times; a preset target time is obtained, and the service state sequence length is determined according to a time value of the target time in the log weight value sequence; An initial service state of the system is obtained; The initial service state is analyzed by backtracking according to the Viterbi algorithm module, the model initial parameters and the service state sequence length to obtain a target service state sequence of the system, the model initial parameters including an initial state probability vector, a state transition probability matrix and an observation probability matrix; a service state probability of the system at a first time is calculated according to the initial service state, the initial state probability vector, the state transition probability matrix and the observation probability matrix, and a target service state at the first time is determined as a service state corresponding to a maximum service state probability; a service state probability of the system at a second time is calculated by iterative recursion according to the target service state at the first time, the initial state probability vector, the state transition probability matrix and the observation probability matrix, and a target service state at the second time is determined as a service state corresponding to a maximum service state probability, until a plurality of target service states at times equal to the service state sequence length are obtained; the target service state at the first time, the target service state at the second time and the target service states at the times equal to the service state sequence length are arranged in time sequence to obtain the target service state sequence.

8. A computer-readable storage medium, characterized in that, A computer program is stored thereon, and the computer program is loaded by a processor to execute steps in the service state prediction method of any one of claims 1 to 5.

Images