Index detection method and device, electronic equipment and storage medium

Abstract

The invention relates to an index detection method and device, electronic equipment and a storage medium. The essence of the index detection method is that index detection is divided into two links. In the first link, a target anomaly screening rule is utilized to preliminarily filter indexes, and suspected anomaly indexes are identified. The stage is simple in logic and relatively low in computing resource consumption, and aims to quickly exclude a large amount of normal index data and only retain a small amount of indexes which possibly have abnormalities. In the second link, deep analysis and fine judgment are carried out on the suspected abnormal indexes screened out in the first link in combination with derivative characteristics of the indexes, and finally whether the suspected abnormal indexes are real abnormal indexes or not is determined. Through the layering mechanism of coarse first and fine second, on the premise that the detection accuracy is ensured, the data volume needing complex calculation can be remarkably reduced, so that the overall anomaly recognition efficiency is improved, and calculation resources are reasonably allocated.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of information processing, and in particular, to an index detection method and device, an electronic device, and a storage medium. BACKGROUND

[0002] Microservice architecture is a design pattern that splits a large service into multiple independent microservice nodes, each of which is independently developed, deployed, and extended around a specific business function. This architecture meets the needs of high concurrency and rapid iteration by reducing coupling and improving flexibility. Microservice nodes communicate with each other through interfaces and message queues, forming complex call links. A large Internet company often has thousands of microservice nodes, and each microservice node usually provides multiple interfaces. In practice, different microservice nodes call each other, and the call relationship is extremely complex. If further refined to the call link of each interface in the microservice node, the complexity will be multiplied. For microservice nodes involving such complex call relationships, whether the microservice node is abnormal can be evaluated by monitoring whether the interface call index is abnormal. However, how to accurately identify the abnormality of the interface call index is a problem that needs to be solved. SUMMARY

[0003] To solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides an index detection method and device, an electronic device, and a storage medium.

[0004] In a first aspect, the present disclosure provides an index detection method, comprising: determining time series data associated with a target index and a target abnormality screening rule corresponding to the target index; extracting a native feature of the target index from the time series data associated with the target index, and determining whether the native feature of the target index satisfies the target abnormality screening rule; the native feature is a feature extracted from the time series data associated with the target index without being calculated through a preset type; if the native feature of the target index satisfies the target abnormality screening rule, extracting a derived feature of the target index from the time series data associated with the target index; the derived feature is a feature extracted from the time series data associated with the target index through the preset type calculation; determining whether the target index is abnormal based on the derived feature of the target index.

[0005] In a second aspect, the present disclosure also provides an index detection device, comprising: a determination module configured to determine time series data associated with a target index and a target abnormality screening rule corresponding to the target index; The first detection module is configured to extract a native feature of the target indicator from time-series data associated with the target indicator, and determine whether the native feature of the target indicator meets the target anomaly screening rule; the native feature is a feature extracted from the time-series data associated with the target indicator without performing a preset type of calculation. The derived feature extraction module is configured to extract a derived feature of the target indicator from the time-series data associated with the target indicator if the native feature of the target indicator meets the target anomaly screening rule; the derived feature is a feature extracted from the time-series data associated with the target indicator by performing the preset type of calculation. The second detection module is configured to determine whether the target indicator is abnormal based on the derived feature of the target indicator.

[0006] In a third aspect, the present disclosure also provides an electronic device, which comprises: one or more processors; a storage device configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the indicator detection method as described above.

[0007] In a fourth aspect, the present disclosure also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the indicator detection method as described above.

[0008] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has the following advantages: The technical solution provided by the embodiments of the present disclosure comprises the following steps: determining time series data associated with a target index and a target anomaly screening rule corresponding to the target index; extracting a native feature of the target index from the time series data associated with the target index, and determining whether the native feature of the target index meets the target anomaly screening rule; the native feature is a feature extracted from the time series data associated with the target index without using a preset type of calculation; if the native feature of the target index meets the target anomaly screening rule, extracting a derived feature of the target index from the time series data associated with the target index; the derived feature is a feature extracted from the time series data associated with the target index by using a preset type of calculation; and determining whether the target index is abnormal based on the derived feature of the target index. The essence is to divide the index detection into two links. In the first link, the target anomaly screening rule is used to preliminarily filter the index, and the suspected abnormal index is identified. The logic in this stage is simple, and the calculation resource consumption is small, which aims to quickly exclude a large number of normal index data and only keep a small number of indexes that may exist abnormally. In the second link, the suspected abnormal index screened in the first link is analyzed and judged in detail in combination with the derived feature of the index, and whether it is a real abnormality is finally confirmed. Through this hierarchical mechanism of "first rough and then fine", the amount of data that needs complex calculation can be significantly reduced under the premise of ensuring the detection accuracy, so as to improve the overall abnormality recognition efficiency and reasonably allocate the calculation resources. BRIEF DESCRIPTION OF DRAWINGS

[0009] The accompanying drawings, which are incorporated into and form a part of the specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the disclosure.

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, brief introductions will be given to the drawings needed to be used in the embodiments or prior art descriptions. Obviously, for those skilled in the art, other drawings can also be obtained from these drawings without any creative labor.

[0011] Figure 1 A flowchart of an index detection method provided by the embodiments of the present disclosure; Figure 2 A principle diagram of index detection provided by the embodiments of the present disclosure; Figure 3 A principle diagram of determining a target time period and a reference time period provided by the embodiments of the present disclosure; Figure 4 A structural schematic diagram of an index detection device in the embodiments of the present disclosure; Figure 5 A structural schematic diagram of an electronic device in the embodiments of the present disclosure. DETAILED DESCRIPTION

[0012] In order to enable a more clear understanding of the above-mentioned objects, features and advantages of the present disclosure, the schemes of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0013] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present disclosure, but the present disclosure can also be implemented in other different manners from those described herein; obviously, the embodiments described in the specification are only a part of the embodiments of the present disclosure, and not all the embodiments.

[0014] Figure 1 A flowchart of a target detection method provided by an embodiment of the present disclosure is provided, the embodiment can be applicable to the case of target detection in a client, and the method can be executed by a target detection device, which can be implemented in a software and / or hardware manner, and can be configured in an electronic device, such as a terminal, specifically including but not limited to a smart phone, a palm computer, a tablet computer, a wearable device with a display screen, a desktop computer, a notebook computer, an all-in-one machine, a smart home device, etc. Alternatively, the embodiment can be applicable to the case of target detection in a server, and the method can be executed by a target detection device, which can be implemented in a software and / or hardware manner, and can be configured in an electronic device, such as a server.

[0015] As shown in the method, the method can specifically include the following steps. Figure 1 S110, determining time series data associated with a target indicator, and a target abnormality screening rule corresponding to the target indicator.

[0016] The target indicator is an indicator that needs to be detected at present, and the purpose of detection is to determine whether the indicator is an abnormal indicator. Through whether the indicator is an abnormal indicator, the usage, performance, stability and health status of the microservice nodes in the microservice architecture can be evaluated. The present disclosure does not limit the specific indicator. Exemplarily, the target indicator is a failure rate, a call volume, a time delay, an order placement / order volume, etc.

[0017] In some scenarios, the microservice nodes of the microservice architecture include a plurality of interfaces. The interfaces in different microservice nodes can call each other, and different interfaces in the same microservice node can also call each other. The target indicator can be an interface call indicator. The interface call indicator may, for example, be quantitative data set for interface call behavior, which can reflect the usage, performance, stability and health status of the interface. Exemplarily, the interface call indicator may, for example, include a failure rate, a call volume and a time delay, etc.

[0018] ​In practice, the index can or can not be associated with a classification dimension. If the index is associated with a classification dimension, the number of classification dimensions associated with the index can be one or more. For example, if the calling volume is associated with a classification dimension, the two classification dimensions associated with the calling volume are the operator and the end platform. Among them, the dimension value under the operator classification dimension can take the values of operator 1, operator 2 or operator 3. The dimension value under the end platform classification dimension can take the values of end platform 1 or end platform 2.

[0019] On the basis of the above technical solutions, optionally, if the to-be-detected index is associated with M classification dimensions, M is a positive integer; the method can further include: disassembling the to-be-detected index to obtain a plurality of sub-indices; the sub-index has M labels, and the M labels correspond one-to-one to the M classification dimensions; the label represents the dimension value under the classification dimension corresponding to the label; at least one of the M labels of different sub-indices is different; and the sub-index is taken as a target index to determine whether the target index is abnormal.

[0020] For example, assume that the time delay is associated with one classification dimension, and the classification dimension associated with the time delay is the operator. Among them, the dimension values under the operator classification dimension are operator 1, operator 2 or operator 3. The time delay can be disassembled into three sub-indices, namely time delay-operator 1, time delay-operator 2 and time delay-operator 3. Each sub-index is taken as a target index in the technical solution provided by the present disclosure, and S110-S140 is used to detect the sub-index.

[0021] For the case where the to-be-detected index is associated with a classification dimension, the to-be-detected index is disassembled into a plurality of sub-indices, and each sub-index is detected by using the technical solution provided by the present disclosure to determine whether the sub-index is abnormal. Instead of detecting the to-be-detected index as a whole. This can make the judgment result of each sub-index more accurate and effectively avoid the situation that “part of the dimension sub-index has appeared abnormal, but is covered by the judgment result of other normal sub-index, resulting in failure of abnormal recognition”.

[0022] The time series data can be, for example, a set of a series of data points arranged in time sequence, wherein each data point (i.e., the index value of the target index) is associated with a specific time stamp for recording the change of the index value of the target index with time. The index value of the target index is the specific value of the target index. For example, if the target index is the calling volume, the value of the calling volume is the index value of the target index.

[0023] In the interface calling scenario, interface calling information is recorded each time the interface is called. The interface calling information may include, for example, interface calling time, time consumption, success or failure, context information of this call request (such as including user equipment, operator or region), and the like. Time series data associated with the target indicator can be extracted from the interface calling information.

[0024] Analysis of the time series data associated with the target indicator can extract the native features of the target indicator. The native features of the target indicator may be, for example, explicit attributes that can be directly obtained from the time series data associated with the target indicator, and the extraction process does not depend on complex pre-designed calculations, such as correlation analysis, statistical fitting, or regression modeling, and the like. In other words, the acquisition of native features is a direct observation result that is non-deductive and non-transformative, reflecting the basic behavior pattern of the indicator in the time dimension. Illustratively, the native features of the target indicator may include maximum value, minimum value, category, and fluctuation feature. The "category" refers to a behavior pattern type that can be directly identified from the time series data of the target indicator, reflecting its fluctuation law and change characteristics. Illustratively, the category may include periodicity type and / or fluctuation pattern type: when the indicator value presents regular repetition in time, it can be determined to have periodicity, which is further divided into "day cycle", "week cycle", or "month cycle", and the like, for example, an indicator with an indicator value rising at a fixed time period every day has a day cycle; when the indicator has no obvious period but has different change trends, it can be divided into "smooth class" (such as small fluctuation and slow change), "fluctuation class" (such as frequent fluctuation and large amplitude), or "sparse class" (such as long-term low value and occasional pulse) according to the fluctuation amplitude, change frequency, and the like. The fluctuation feature may be, for example, a dynamic change pattern, amplitude change, trend fluctuation, and shock behavior feature of the time series data of the target indicator in the time dimension, which is non-periodic, irregular, and free of indicator abnormal problems. Illustratively, if a smooth type indicator is stable at 100-99 for a long time. However, there have been several times in history when it has fallen to 95 for 10 time points. If this fluctuation decline is the norm of the indicator, the feature of this fluctuation decline can be taken as the fluctuation feature of the indicator.

[0025] The target anomaly screening rule may be, for example, an anomaly identification rule set for the target indicator. It is determined based on the native features of the historical time series data of the target indicator. Illustratively, if the historical time series data of the target indicator shows that the maximum value is 200 and the minimum value is 100, the target anomaly screening rule corresponding to the target indicator can be set to include an indicator value less than 100 or greater than 200. In some scenarios, a bias coefficient can be introduced when determining the target anomaly screening rule corresponding to the target indicator. Illustratively, if the bias coefficient is k, the historical time series data of the target indicator shows that the maximum value is 200 and the minimum value is 100, the target anomaly screening rule corresponding to the target indicator can be set to include an indicator value less than 100 k or greater than 200 k.

[0026] In practice, there can be various specific implementation methods for determining the target anomaly screening rule corresponding to the target indicator, and the present disclosure does not limit this. Illustratively, determining the target anomaly screening rule corresponding to the target indicator includes: identifying the target indicator to obtain an identification result; determining the target anomaly screening rule corresponding to the target indicator from the anomaly screening rule set based on the identification result; the anomaly screening rule set corresponds to the target indicator; the anomaly screening rule set includes a plurality of anomaly screening rules; different anomaly screening rules correspond to different use conditions; and the identification result satisfies the use condition of the target anomaly screening rule.

[0027] In some scenarios, the original characteristics of the same indicator in different business scenarios can be different. Illustratively, for some indicators, the indicator values are larger during weekends, and smaller during weekdays. For other indicators, the indicator values are larger during the activities of some marketing activities, and smaller during the activities of other marketing activities. In view of this phenomenon, different anomaly screening rules matching the same indicator can be configured for different business scenarios, and corresponding use conditions can be set for each anomaly screening rule; wherein the use condition is used to determine whether the anomaly screening rule is applicable to the current business scenario. The current business scenario is the business scenario corresponding to the time point of the time series data record associated with the target indicator.

[0028] In other scenarios, for indicators associated with a classification dimension, the original characteristics of the same indicator in the same business scenario can be different when the dimension values of the classification dimension are different. Illustratively, for some indicators, there is an operator classification dimension. When the dimension value of the operator classification dimension is operator 1, the indicator presents a larger call volume feature. When the dimension value of the operator classification dimension is operator 2, the indicator presents a smaller call volume feature. In view of this, multiple anomaly screening rules can be configured for the same indicator, and different anomaly screening rules correspond to different dimension values of the classification dimension. Corresponding use conditions are set for each anomaly screening rule; wherein the use condition is used to determine whether the dimension value of the classification dimension corresponding to the anomaly screening rule is consistent with the dimension value of the classification dimension of the target indicator.

[0029] The anomaly screening rule set may, for example, be a set of one or more anomaly screening rules corresponding to the target indicator, and different anomaly screening rules correspond to different use conditions. The purpose of identifying the target indicator using the indicator identification model is to extract information (such as the business scenario corresponding to the time point of the time series data record associated with the target indicator and / or the dimension value of the classification dimension of the target indicator) used to determine whether each use condition is satisfied.

[0030] Optionally, the process of identifying the target indicator can include identifying the following two aspects: a first aspect, semantic content; and a second aspect, native characteristics. The semantic content can include at least one of the following: a business meaning of the target indicator, a sensitive direction of the target indicator, and control filling information of the indicator. The business meaning of the target indicator can be, for example, a specific function such as success rate, traffic, latency, order quantity, and the like. For a case where the indicator is a composite indicator, the business semantic information of the composite indicator that needs to be detected can be identified by parsing a statement corresponding to the composite indicator. The composite indicator can be, for example, an indicator formed by at least two atomic indicators through addition, subtraction, or the like. The sensitive direction of the indicator can be, for example, upward sensitive, downward sensitive, or bidirectional sensitive. By way of example, indicators such as failure rate, latency, and CPU dedicated rate are upward sensitive indicators, and success rate is a downward sensitive indicator. The control filling information of the indicator can be, for example, a method of filling a null value of the indicator, and the like. The native characteristics of the target indicator can include at least one of the following: maximum value, minimum value, category, and fluctuation characteristics.

[0031] The essence of "determining, based on the identification result, a target anomaly screening rule corresponding to the target indicator from the set of anomaly screening rules" is to determine whether the use condition of each anomaly screening rule in the set of anomaly screening rules is satisfied. If the use condition of an anomaly screening rule is satisfied, the anomaly screening rule is determined to be the target anomaly screening rule.

[0032] In S120, native characteristics of the target indicator are extracted from the time series data associated with the target indicator, and it is determined whether the native characteristics of the target indicator satisfy the target anomaly screening rule. The native characteristics are characteristics extracted from the time series data associated with the target indicator without calculation of a preset type.

[0033] In S130, if the native characteristics of the target indicator satisfy the target anomaly screening rule, derivative characteristics of the target indicator are extracted from the time series data associated with the target indicator. The derivative characteristics are characteristics extracted from the time series data associated with the target indicator through calculation of a preset type.

[0034] If the native characteristics of the target indicator satisfy the target anomaly screening rule, it means that the target indicator can be abnormal and needs to be further considered. If the native characteristics of the target indicator do not satisfy the target anomaly screening rule, it means that the target indicator is not abnormal and does not need to be further considered.

[0035] The derived features may, for example, be non-explicit attributes that can be directly obtained from the time series data associated with the target indicator, and the extraction process thereof relies on complex pre-designed calculations, such as correlation calculation, statistical fitting or regression modeling, etc. Illustratively, the derived features can include at least one of the following: statistical features and fitting features. Further, the derived features can include at least one of the following: daily growth rate, weekly growth rate, variance, slope, residual, Pearson coefficient and autocorrelation coefficient.

[0036] S140, determining whether the target indicator is abnormal based on the derived features of the target indicator.

[0037] Optionally, after S140, the method can further output prompt information reflecting whether the target indicator is abnormal. Optionally, summary information reflecting that the target indicator is determined to be abnormal can also be output. The summary information can include at least one of the following: which time period the target indicator is determined to be abnormal, the degree of abnormality of the target indicator and the direction of abnormality.

[0038] Illustratively, suppose that the time delay is associated with a classification dimension, and the associated classification dimension is the operator. Among them, the dimension values under the operator classification dimension are respectively operator 1, operator 2 or operator 3. The time delay can be decomposed into three sub-indicators, namely time delay-operator 1, time delay-operator 2 and time delay-operator 3.

[0039] Referring to Figure 2 For time delay-operator 1, the target abnormality screening rule corresponding to time delay-operator 1 is determined. After determining that the native features of time delay-operator 1 do not satisfy the target abnormality screening rule, it is determined that time delay-operator 1 is normal, and prompt information indicating that time delay-operator 1 is normal is output.

[0040] For time delay-operator 2, the target abnormality screening rule corresponding to time delay-operator 2 is determined. After determining that the native features of time delay-operator 2 satisfy the target abnormality screening rule, it is determined that time delay-operator 2 is suspected to be abnormal. The derived features of time delay-operator 2 are extracted; whether time delay-operator 2 is abnormal is judged based on the derived features of time delay-operator 2. If it is determined that time delay-operator 2 is normal, prompt information indicating that time delay-operator 2 is normal is output.

[0041] For time delay-operator 3, the target abnormality screening rule corresponding to time delay-operator 3 is determined. After determining that the native features of time delay-operator 3 satisfy the target abnormality screening rule, it is determined that time delay-operator 3 is suspected to be abnormal. The derived features of time delay-operator 3 are extracted; whether time delay-operator 3 is abnormal is judged based on the derived features of time delay-operator 3. If it is determined that time delay-operator 3 is abnormal, prompt information indicating that time delay-operator 3 is normal is output.

[0042] The technical solution determines time series data associated with a target index and a target anomaly screening rule corresponding to the target index. The original features of the target index are extracted from the time series data associated with the target index, and it is determined whether the original features of the target index meet the target anomaly screening rule. The original features are features extracted from the time series data associated with the target index without using a preset type of calculation. If the original features of the target index meet the target anomaly screening rule, the derived features of the target index are extracted from the time series data associated with the target index. The derived features are features extracted from the time series data associated with the target index by using a preset type of calculation. Whether the target index is abnormal is determined based on the derived features of the target index. The essence is to divide the index detection into two links. In the first link, the target anomaly screening rule is used to preliminarily filter the index, and the suspected abnormal index is identified. The logic in this stage is simple, and the calculation resource consumption is small. The purpose is to quickly exclude a large number of normal index data, and only keep a small number of indexes that may have abnormalities. In the second link, the suspected abnormal index screened in the first link is analyzed and judged in detail in combination with the derived features of the index, and whether it is a real abnormality is finally confirmed. Through this hierarchical mechanism of "first rough and then fine", the amount of data that needs complex calculation can be significantly reduced under the premise of ensuring detection accuracy, thereby improving the overall abnormality identification efficiency and reasonably allocating calculation resources.

[0043] On the basis of the above technical solution, S130 can include determining an observation time node and a plurality of reference time nodes; extracting, from the time series data associated with the target index, the derived features of the target index at the observation time node and the derived features of the target index at the reference time nodes. S140 can include determining whether the target index is abnormal based on the derived features of the target index at the observation time node and the derived features of the target index at the plurality of reference time nodes.

[0044] The observation time node may, for example, be a time point indicated by a timestamp of a last data point in the time series data associated with the target index. Alternatively, the reference time nodes are earlier than the observation time node. Alternatively, the reference time nodes and the observation time node are the same time in different timing periods. For example, assuming that the observation time node is 9:30 on September 5, the reference time nodes are selected as 9:30 on each day in a period before September 5 (for example, 9:30 on September 4, 9:30 on September 3, etc.).

[0045] The derived feature of the target indicator at the observation time node can be obtained by using the target indicator value at the observation time node in the process of calculating the derived feature of the target indicator. For example, assuming that the derived feature is a daily change rate and the observation time node is 9:30 on September 5, the daily change rate of the target indicator at the observation time node is equal to the difference between the target indicator value with the time stamp of 9:30 on September 5 and the target indicator value with the time stamp of 9:30 on September 4. The process of obtaining the derived feature (i.e., the daily change rate) of the target indicator at the observation time node uses the target indicator value with the time stamp of the observation time node.

[0046] Similarly, the derived feature of the target indicator at the reference time node can be obtained by using the target indicator value at the reference time node in the process of calculating the derived feature of the target indicator.

[0047] There are various specific implementation methods of determining whether the target indicator is abnormal based on the derived feature of the target indicator at the observation time node and the derived features of the target indicator at the plurality of reference time nodes, and the disclosure does not limit this. For example, the method of determining whether the target indicator is abnormal based on the derived feature of the target indicator at the observation time node and the derived features of the target indicator at the plurality of reference time nodes can include: determining whether the derived feature of the target indicator at the observation time node is an outlier relative to the derived features of the target indicator at the plurality of reference time nodes; and determining that the target indicator is abnormal if the derived feature of the target indicator at the observation time node is an outlier.

[0048] The determination of whether the derived feature of the target indicator at the observation time node is an outlier relative to the derived features of the target indicator at the plurality of reference time nodes can be determined by an outlier detection algorithm.

[0049] Further, the method can further include: determining a target period based on the observation time node; the target period being a period obtained by tracing back a first time length from the observation time node; determining a reference period based on the reference time node; the reference period being a period obtained by tracing back a first time length from the reference time node and moving forward a second time length. The extraction of the derived feature of the target indicator at the observation time node and the derived feature of the target indicator at the reference time node from the time series data associated with the target indicator includes: extracting the derived feature of the target indicator at the observation time node from the time series data associated with the target indicator in the target period; and extracting the derived feature of the target indicator at the reference time node from the time series data associated with the target indicator in the reference period.

[0050] The first duration and the second duration are pre-specified durations used to determine the target time period and the reference time period. This disclosure does not impose any restrictions on the specific values ​​of the first duration and the second duration. The first duration and the second duration may be equal or unequal.

[0051] For example, if both the first and second durations are 5 minutes, the observation time point is 13:20 on day N. See also Figure 3 The target time period is from 13:15 to 13:20 on day N. Multiple reference time points are set for 13:20 on day N-1, day N-2, day N-2, ..., and day N-100. The reference time period is from 13:15 to 13:25 on each day from day N-1 to day N-100. Assuming the derived feature is the daily average, the daily average value of the target indicator within the target time period (i.e., from 13:15 to 13:25 on day N) is calculated (i.e., the derived feature of the target indicator under the observation time point, denoted as derived feature a). Calculating the daily average value of the target indicator within the daily time period from 13:15 to 13:25 on days N-1 to N-100 yields 100 daily average values ​​(i.e., the derived features of the target indicator under 100 reference time points). The subsequent assessment will determine whether derivative feature a is an outlier, relative to the derived features of the target indicator at 100 reference time points.

[0052] This method extracts derived features of the target indicator at the observation time node from time-series data associated with the target indicator within the target time period. Essentially, when determining the derived features of the target indicator at the observation time node, a shorter (rather than longer) time period is selected for calculation. This reduces the computational workload of obtaining derived features. Furthermore, since the indicator values ​​of target features within periods closer to the observation time node have a higher correlation with the indicator values ​​at the observation time node, while those within periods farther away have a lower correlation, this method avoids being "diluted" or "overwhelmed" by a large amount of data from irrelevant time points.

[0053] Similarly, by setting up the extraction of derived features of the target indicator from time-series data associated with the target indicator within the reference period, the computational workload of obtaining derived features can be reduced. On the other hand, it can prevent the derived features of the target indicator at the reference time point from being "diluted" or "submerged" by a large amount of data from irrelevant time points.

[0054] On the basis of each of the technical solutions above, optionally, the "determining the time series data associated with the target indicator" in S110 can include: determining first time series data associated with the target indicator and second time series data associated with the target indicator; the starting time of the first time series data is later than or equal to the starting time of the second time series data, the ending time of the first time series data is earlier than or equal to the ending time of the second time series data, and the time range corresponding to the first time series data does not overlap with the time range corresponding to the second time series data. From the time series data associated with the target indicator, the derived features of the target indicator at the observation time node and the derived features of the target indicator at the reference time node are extracted, including: extracting the native features of the target indicator from the first time series data associated with the target indicator; and extracting the derived features of the target indicator from the second time series data associated with the target indicator.

[0055] The "the starting time of the first time series data is later than or equal to the starting time of the second time series data, the ending time of the first time series data is earlier than or equal to the ending time of the second time series data, and the time range corresponding to the first time series data does not overlap with the time range corresponding to the second time series data" means that the time range corresponding to the first time series data is shorter than the time range corresponding to the second time series data. The time range corresponding to the first time series data is a part of the time range corresponding to the second time series data. Exemplarily, the starting time of the time range corresponding to the first time series data is 00:00 of the N-10th day, and the ending time is 00:00 of the Nth day. The starting time of the time range corresponding to the second time series data is 00:00 of the N-100th day, and the ending time is 00:00 of the Nth day.

[0056] By setting the "extracting the native features of the target indicator from the first time series data associated with the target indicator; and extracting the derived features of the target indicator from the second time series data associated with the target indicator; the starting time of the first time series data is later than or equal to the starting time of the second time series data, the ending time of the first time series data is earlier than or equal to the ending time of the second time series data, and the time range corresponding to the first time series data does not overlap with the time range corresponding to the second time series data", the essence is that in the first link, when the target abnormality screening rule is used to preliminarily filter the indicators, the time series data associated with the target indicator with a shorter time range is used; in the second link, when the suspected abnormal indicators screened out in the first link are analyzed and judged in detail in combination with the derived features of the indicators, the time series data associated with the target indicator with a longer time range is used. In this way, it can be ensured that the first link can be completed quickly, and the accuracy of the judgment result given by the second link is improved.

[0057] On the basis of the above technical solutions, optionally, in the actual, if the technical solutions provided by the disclosure are executed in one or more electronic devices, the one or more electronic devices can be deployed as a microservice node in a microservice architecture. Alternatively, the one or more electronic devices are deployed as multiple microservice nodes in a microservice architecture.

[0058] On the basis of the above technical solutions, optionally, in the actual, if the technical solutions provided by the disclosure are executed in one or more electronic devices, the one or more electronic devices can be deployed as a microservice node in a microservice architecture. Alternatively, the one or more electronic devices are deployed as multiple microservice nodes in a microservice architecture.

[0059] In some scenarios, the model that can execute the technical solutions provided by the disclosure can be obtained by training the model. Subsequently, in the index detection process, the model is called to execute the technical solutions provided by the disclosure to complete the index detection task.

[0060] Optionally, in practice, two models can be trained respectively, which are the first model and the second model. The first model is used to perform the steps of determining the target abnormality screening rule corresponding to the target indicator, extracting the original features of the target indicator from the time series data associated with the target indicator, and determining whether the original features of the target indicator meet the target abnormality screening rule. If the execution result of the first model indicates that the original features of the target indicator meet the target abnormality screening rule, it is determined that the target indicator is a suspected abnormal indicator. The target indicator is input into the second model. If the execution result of the first model indicates that the original features of the target indicator do not meet the target abnormality screening rule, it is determined that the target indicator is a normal indicator. The second model is used to perform the steps of extracting the derived features of the target indicator from the time series data associated with the target indicator, and determining whether the target indicator is abnormal based on the derived features of the target indicator.

[0061] Optionally, when training the first model, a first sample set can be constructed in advance, the first sample set including a plurality of first sample information, the first sample information including time series data associated with an indicator and label information corresponding to the time series data, the label information reflecting whether the indicator is abnormal. By inputting the first sample information in the first sample set into the first model, the first model forms a target abnormality screening rule (also referred to as an indicator portrait in some scenarios) corresponding to the indicator, thereby having the ability to identify suspected abnormal indicators.

[0062] For the second model, the second model can be set to include a first module and a second module. In training, the first module extracts derived features of a second sample indicator from time series data associated with the second sample indicator, and inputs the derived features of the second sample indicator into the second module. The second module estimates whether the sample indicator is abnormal based on the derived features of the sample indicator, obtains an estimation result, and adjusts parameters in the second model to improve the accuracy of the estimation result.

[0063] Optionally, in practice, three microservice nodes can be included in the microservice architecture, which are the first microservice node, the second microservice node, and the third microservice node. The first microservice node is used to train the first model and the second model. The second microservice node is used to store and manage time series data associated with a plurality of different indicators, as well as the first model and the second model. The third microservice node is used to call the first model and the second model in the second microservice node to detect the to-be-detected indicators. Further, the second microservice node can be configured to issue a model training task to the first microservice node and / or issue an indicator detection task to the third microservice node. Optionally, the second microservice node and the third microservice node can be combined into the same microservice node.

[0064] It should be noted that, for the foregoing method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the disclosure is not limited by the order of the described actions, because according to the disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily necessary for the disclosure.

[0065] Figure 4 A structural schematic diagram of an index detection device in an embodiment of the disclosure. The index detection device provided by the embodiment of the disclosure can be configured in a client or can be configured in a server. Referring to FIG. 1, the index detection device specifically includes: Figure 4 The index detection device specifically includes: A determination module 310 configured to determine time series data associated with a target index and a target anomaly screening rule corresponding to the target index; A first detection module 320 configured to extract a native feature of the target index from the time series data associated with the target index and determine whether the native feature of the target index meets the target anomaly screening rule; the native feature is a feature extracted from the time series data associated with the target index without being calculated through a preset type; A derived feature extraction module 330 configured to extract a derived feature of the target index from the time series data associated with the target index if the native feature of the target index meets the target anomaly screening rule; the derived feature is a feature extracted from the time series data associated with the target index through the preset type calculation; A second detection module 340 configured to determine whether the target index is abnormal based on the derived feature of the target index.

[0066] Further, the determination module 310 is configured to: identify the target index to obtain an identification result; determine a target anomaly screening rule corresponding to the target index from an anomaly screening rule set based on the identification result; the anomaly screening rule set corresponds to the target index; the anomaly screening rule set includes a plurality of anomaly screening rules; different anomaly screening rules correspond to different use conditions; and the identification result meets the use condition of the target anomaly screening rule.

[0067] Further, the derived feature extraction module 330 is configured to: determine an observation time node and a plurality of reference time nodes; extract the derived feature of the target indicator at the observation time node from time series data associated with the target indicator, and the derived feature of the target indicator at the reference time node; The second detection module 340 is configured to: determine whether the target indicator is abnormal based on the derived feature of the target indicator at the observation time node and the derived features of the target indicator at the plurality of reference time nodes.

[0068] Further, the second detection module 340 is configured to: determine whether the derived feature of the target indicator at the observation time node is an outlier relative to the derived features of the target indicator at the plurality of reference time nodes; if the derived feature of the target indicator at the observation time node is an outlier, determine that the target indicator is abnormal.

[0069] Further, the derived feature extraction module 330 is configured to: determine a target period based on the observation time node; the target period is a period obtained by tracing back a first time length from the observation time node; determine a reference period based on the reference time node; the reference period is a period obtained by tracing back the first time length from the reference time node and shifting back the second time length; extract the derived feature of the target indicator at the observation time node from time series data associated with the target indicator in the target period; extract the derived feature of the target indicator at the reference time node from time series data associated with the target indicator in the reference period.

[0070] Further, the determination module 310 is configured to: determine first time series data and second time series data associated with the target indicator; the start time of the first time series data is later than or equal to the start time of the second time series data, the end time of the first time series data is earlier than or equal to the end time of the second time series data, and the time range corresponding to the first time series data does not overlap with the time range corresponding to the second time series data; The derived feature extraction module 330 is configured to: extract the native feature of the target indicator from the first time series data associated with the target indicator; extract the derived feature of the target indicator from the second time series data associated with the target indicator.

[0071] Further, if the to-be-detected index is associated with M classification dimensions, M being a positive integer, the device further comprises a disassembling module configured to: disassemble the to-be-detected index to obtain a plurality of sub-indices; the sub-indices have M labels, the M labels one-to-one corresponding to the M classification dimensions; the label represents a dimension value in the classification dimension corresponding thereto; at least one of the M labels of different sub-indices is different; take the sub-indices as the target index, and determine whether the target index is abnormal.

[0072] The index detection device provided by the embodiments of the present disclosure can perform the steps performed by the client or the server in the index detection method provided by the embodiments of the present disclosure, and has the execution steps and beneficial effects, which will not be described here.

[0073] Reference will be made in detail to the Figure 5 , which shows a structural schematic diagram of an electronic device 1000 suitable for implementing the embodiments of the present disclosure. The electronic device 1000 in the embodiments of the present disclosure can include, but is not limited to, a mobile terminal such as a mobile phone, a notebook computer, a digital broadcast receiver, a PDA (Personal Digital Assistant), a PAD (Tablet Personal Computer), a PMP (Portable Multimedia Player), a vehicle terminal (such as a vehicle navigation terminal), a wearable electronic device, and the like, and a fixed terminal such as a digital TV, a desktop computer, a smart home device, and the like. Figure 5 The electronic device shown is only an example, and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0074] As shown in Figure 5 , the electronic device 1000 can include a processing device (such as a central processor, a graphics processor, etc.) 1001, which can perform various appropriate actions and processes according to the programs stored in the read-only memory (ROM) 1002 or loaded from the storage device 1008 into the random access memory (RAM) 1003 to implement the index detection method of the embodiments as described in the present disclosure. In the RAM 1003, various programs and information required for the operation of the electronic device 1000 are also stored. The processing device 1001, the ROM 1002, and the RAM 1003 are connected to each other through a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0075] In general, the following devices can be connected to the I / O interface 1005: input devices 1006 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, and the like; output devices 1007 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, and the like; storage devices 1008 including, for example, a tape, a hard disk, and the like; and communication devices 1009. The communication devices 1009 can allow the electronic device 1000 to communicate wirelessly or through a wire with other devices to exchange information. Although Figure 5 The electronic device 1000 is shown with various devices, but it is understood that all of the illustrated devices are not required to implement or be present. More or fewer devices can alternatively be implemented or present.

[0076] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for executing the methods illustrated by the flowcharts, thereby implementing the index detection method as described above. In such embodiments, the computer program can be downloaded and installed from a network through the communication devices 1009, or installed from the storage devices 1008, or installed from the ROM 1002. When the computer program is executed by the processing devices 1001, the above-described functions defined in the methods of the embodiments of the present disclosure are performed.

[0077] It should be noted that the computer readable medium in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or apparatus. In the present disclosure, the computer readable signal medium can include an information signal in a baseband or as a part of a carrier wave, which carries computer readable program code. Such a propagated signal can take many forms, including but not limited to an electromagnetic signal, an optical signal or any suitable combination of the above. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium, which can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or apparatus. The program code contained in the computer readable medium can be transmitted by any suitable medium, including but not limited to a wire, a cable, an RF (radio frequency) or the like, or any suitable combination of the above.

[0078] In some embodiments, the client, server can communicate using any known or future developed network protocols, such as HTTP (HyperText Transfer Protocol), and can be interconnected with digital information of any form or medium (e.g., a communication network). Examples of communication networks include local area networks ("LAN"), wide area networks ("WAN"), internetworks (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any known or future developed networks.

[0079] The computer readable medium described above can be contained in the electronic device described above; or can exist separately without being assembled into the electronic device.

[0080] The computer readable medium described above carries one or more programs, when the one or more programs are executed by the electronic device, the electronic device: determining time series data associated with the target indicator, and a target anomaly screening rule corresponding to the target indicator; extract a native feature of the target index from the time series data associated with the target index, and determine whether the native feature of the target index satisfies the target anomaly screening rule; the native feature is a feature extracted from the time series data associated with the target index without being calculated through a preset type; If the native feature of the target index satisfies the target anomaly screening rule, extract a derived feature of the target index from the time series data associated with the target index; the derived feature is a feature extracted from the time series data associated with the target index through the preset type calculation; determine whether the target index is abnormal based on the derived feature of the target index.

[0081] Optionally, when the one or more programs are executed by the electronic device, the electronic device can further perform other steps described in the above embodiments.

[0082] Computer program code for carrying out operations of the present disclosure can be written in one or more programming languages or combinations of languages including object oriented programming languages such as Java, Smalltalk, C++ or conventional procedural programming languages such as "C" or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0083] The computer program product of the first aspect can include one or more non-transitory computer-readable media storing instructions to be executed by one or more processors of a computing device such that the one or more processors perform the steps of the method of the first aspect.

[0084] The units described in the embodiments of the present disclosure can be implemented by software, or by hardware, or by a combination of software and hardware. In some cases, the names of the units do not constitute a limitation on the units themselves.

[0085] The functions described in this document can be implemented in part or in whole using one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

[0086] In the context of the present disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more of: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0087] According to one or more embodiments of the present disclosure, the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors realize the index detection method as any of the described in the present disclosure.

[0088] According to one or more embodiments of the present disclosure, the present disclosure provides a computer readable storage medium, having stored thereon a computer program, which, when executed by a processor, realizes the index detection method as any of the described in the present disclosure.

[0089] The present disclosure further provides a computer program product, which comprises a computer program or instructions, which, when executed by a processor, realizes the index detection method as described above.

[0090] It should be noted that, in this document, relational terms such as "first" and "second", and the like, are used solely to distinguish one entity or action from another entity or action, without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a..." does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0091] The above description is merely that of the specific embodiments of the present disclosure, to enable a person skilled in the art to understand or implement the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Accordingly, the present disclosure is not to be limited to the embodiments described herein but is to be accorded the broadest scope consistent with the principles and novel features disclosed herein.

Claims

1. An index detection method characterized by, The method comprises the following steps: determining time series data associated with a target indicator and a target anomaly screening rule corresponding to the target indicator; extracting original features of the target indicator from the time series data associated with the target indicator, and determining whether the original features of the target indicator meet the target anomaly screening rule; the original features are features extracted from the time series data associated with the target indicator without being calculated through a preset type; if the original features of the target indicator meet the target anomaly screening rule, extracting derived features of the target indicator from the time series data associated with the target indicator; the derived features are features extracted from the time series data associated with the target indicator through the preset type calculation; determining whether the target indicator is abnormal based on the derived features of the target indicator.

2. The method of claim 1, wherein, The determination of the target anomaly screening rule corresponding to the target indicator comprises the following steps: identifying the target indicator to obtain an identification result; determining the target anomaly screening rule corresponding to the target indicator from an anomaly screening rule set based on the identification result; the anomaly screening rule set corresponds to the target indicator; the anomaly screening rule set comprises a plurality of anomaly screening rules; different anomaly screening rules correspond to different use conditions; the identification result meets the use condition of the target anomaly screening rule.

3. The method of claim 1, wherein, The extraction of the derived features of the target indicator from the time series data associated with the target indicator comprises the following steps: determining an observation time node and a plurality of reference time nodes; extracting derived features of the target indicator at the observation time node and derived features of the target indicator at the reference time nodes from the time series data associated with the target indicator; The determination of whether the target indicator is abnormal based on the derived features of the target indicator comprises the following steps: determining whether the target indicator is abnormal based on the derived features of the target indicator at the observation time node and the derived features of the target indicator at the plurality of reference time nodes.

4. The method of claim 3, wherein, The determination of whether the target indicator is abnormal based on the derived features of the target indicator at the observation time node and the derived features of the target indicator at the plurality of reference time nodes comprises the following steps: determining whether the derived features of the target indicator at the observation time node are outliers relative to the derived features of the target indicator at the plurality of reference time nodes; if the derived features of the target indicator at the observation time node are outliers, determining that the target indicator is abnormal.

5. The method of claim 3, wherein, The method further comprises the following steps: determining a target period based on the observation time node; the target period is a period obtained by tracing back a first time length from the observation time node; determining a reference period based on the reference time node; the reference period is a period obtained by tracing back the first time length from the reference time node and shifting back a second time length; The extraction of the derived features of the target indicator at the observation time node and the derived features of the target indicator at the reference time nodes from the time series data associated with the target indicator comprises the following steps: extract the derived feature of the target indicator at the observation time node from the time series data associated with the target indicator in the target period; extract the derived feature of the target indicator at the reference time node from the time series data associated with the target indicator in the reference period.

6. The method of claim 3, wherein, The determining the time series data associated with the target indicator comprises: determining first time series data and second time series data associated with the target indicator; a starting time of the first time series data is later than or equal to a starting time of the second time series data, an ending time of the first time series data is earlier than or equal to an ending time of the second time series data, and a time range corresponding to the first time series data does not overlap with a time range corresponding to the second time series data; The extracting the derived feature of the target indicator at the observation time node from the time series data associated with the target indicator and the extracting the derived feature of the target indicator at the reference time node from the time series data associated with the target indicator in the reference period comprises: extracting a native feature of the target indicator from the first time series data associated with the target indicator; extracting a derived feature of the target indicator from the second time series data associated with the target indicator.

7. The method of claim 1, wherein, If the to-be-detected indicator is associated with M classification dimensions, M being a positive integer, the method further comprises: dissolving the to-be-detected indicator to obtain a plurality of sub-indicators; the sub-indicators have M labels, the M labels one-to-one correspond to the M classification dimensions; the label represents a dimension value in the classification dimension corresponding to the label; at least one of the M labels of different sub-indicators is different; taking the sub-indicator as the target indicator to determine whether the target indicator is abnormal.

8. An indicator detection device, characterized by comprise: a determining module configured to determine time series data associated with a target indicator and a target anomaly screening rule corresponding to the target indicator; a first detecting module configured to extract a native feature of the target indicator from the time series data associated with the target indicator and determine whether the native feature of the target indicator satisfies the target anomaly screening rule; the native feature is a feature extracted from the time series data associated with the target indicator without a preset type of calculation; a derived feature extraction module configured to, if the native feature of the target indicator satisfies the target anomaly screening rule, extract a derived feature of the target indicator from the time series data associated with the target indicator; the derived feature is a feature extracted from the time series data associated with the target indicator by the preset type of calculation; a second detecting module configured to determine whether the target indicator is abnormal based on the derived feature of the target indicator.

9. An electronic device, comprising: The electronic device comprises: one or more processors; a storage device configured to store one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the method in any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method in any one of claims 1-7. The program is executed by the processor to implement the method in any one of claims 1-7.

Images