System operation abnormity tracing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a system operation abnormity tracing method and device, electronic equipment and a storage medium, belongs to the technical field of computers, and is suitable for the field of financial science and technology and the field of medical health care. The method comprises the following steps: acquiring multi-source operation data of a target system; performing time sequence extraction based on the multi-source operation data to obtain an event occurrence time sequence of the operation event; performing causal reasoning based on the event occurrence time sequence to obtain an event causal relationship of the operation event; performing graph construction based on the event causal relationship to obtain a target causal graph of the operation event; performing exception tracing on the operation event based on the target causal diagram to obtain a target operation exception path; and performing exception optimization based on the target operation exception path to obtain an exception optimization suggestion. The method can be applied to business management systems related to financial science and technology and medical health care, and the accuracy of running abnormity tracing can be improved by performing system running abnormity tracing on the business management systems.

Description

Technical Field

[0001] This application relates to the field of computer technology, and is applicable to the fields of financial technology and medical and health care and elderly care. In particular, it relates to a method and device for tracing the source of system operation anomalies, electronic devices and storage media. Background Technology

[0002] Anomaly tracing refers to the process of tracing and locating the root cause of abnormal events during program or system operation through systematic technical means. It can be applied to business management systems related to financial technology, healthcare, and elderly care. By tracing the source of system operation anomalies in the business management system, the cause of the anomalies can be found to assist developers or maintenance personnel in debugging.

[0003] Currently, the main approach is to use distributed tracing data to construct service topology diagrams from operational data. This visually displays the request / response dependencies between services and identifies potential fault points based on the service topology diagram. However, the service topology diagram shows the potential interaction paths between components, rather than the actual causal relationships, which makes it impossible to accurately trace the source of anomalies and affects the accuracy of tracing the source of operational anomalies.

[0004] Therefore, improving the accuracy of tracing operational anomalies has become an urgent technical problem to be solved. Summary of the Invention

[0005] The main objective of this application is to provide a method, apparatus, electronic device, and storage medium for tracing system malfunctions, aiming to improve the accuracy of tracing malfunctions.

[0006] To achieve the above objectives, a first aspect of this application proposes a method for tracing the source of system malfunctions, the method comprising: Acquire multi-source operational data of the target system; Acquire multi-source operational data of the target system; Based on the multi-source operational data, time-series extraction is performed to obtain the event occurrence time sequence of the operational events; wherein, the operational events occur on the target system; Based on the sequence of events, causal reasoning is performed to obtain the causal relationship of the running events; Based on the causal relationships of the events, a graph is constructed to obtain the target causal graph of the running events; Based on the target cause-effect graph, the abnormal source of the running event is traced to obtain the target running abnormal path of the target system; Based on the abnormal path of the target system, anomaly optimization is performed to obtain anomaly optimization suggestions for the target system.

[0007] In some embodiments, the step of tracing the abnormal origin of the runtime events based on the target cause-effect graph to obtain the target runtime abnormal path of the target system includes: The target cause-effect graph is traversed to obtain abnormal node data; Based on the abnormal node data, the target cause-effect graph is traversed to obtain the original cause-effect path of the running event; The target system's abnormal operation path is obtained by performing structured processing based on the original causal path.

[0008] In some embodiments, the step of performing anomaly optimization based on the target abnormal path to obtain anomaly optimization suggestions for the target system includes: Based on the abnormal path of the target operation, causal inference is performed to obtain the causal influencing nodes; Causal inference is performed based on the causal influencing nodes to obtain the inference results; wherein, the inference results are used to characterize whether the target system is operating abnormally or normally after the causal influencing nodes are adjusted. If the simulation results are used to characterize the target system's operation as normal after the causal influence nodes are adjusted, then the abnormal optimization suggestions for the target system are generated based on the causal influence nodes.

[0009] In some embodiments, after performing anomaly optimization based on the target abnormal path to obtain anomaly optimization suggestions for the target system, the method further includes: Receive system operation query data; The system operation query data is transformed into a causal query statement; The target query node is determined based on the causal query statement; Based on the target query node, the target cause-effect graph is traversed to obtain the target query path; A running status report of the target system is generated based on the target query path.

[0010] In some embodiments, after performing anomaly optimization based on the target abnormal path to obtain anomaly optimization suggestions for the target system, the method further includes: Receive an exception debugging instruction; wherein the exception debugging instruction includes exception node information and exception debugging parameters; Candidate debugging nodes are selected from the target cause-effect graph based on the abnormal node information; Based on the abnormal debugging parameters, the candidate debugging nodes are modified to obtain the target debugging node; Causal inference is performed based on the target debugging node to obtain inference operation feedback data; wherein, the inference operation feedback data is used to characterize whether the operation of the target system after parameter modification according to the abnormal debugging instruction is an abnormal operation or a normal operation.

[0011] In some embodiments, the step of extracting the timing sequence of runtime events based on the multi-source runtime data includes: The multi-source operational data is standardized to obtain standard operational data; Events are extracted from the standard operating data to obtain candidate events; The target running timestamp is obtained by extracting timestamps from the standard running data. The timing sequence of the events is constructed based on the target runtime timestamp and the candidate events.

[0012] In some embodiments, the step of constructing a graph based on the event causal relationships to obtain a target causal graph of the running events includes: Construct event nodes based on the aforementioned causal relationships; Determine the directed edges of the events based on the aforementioned causal relationships; A graph is constructed based on the event nodes and the directed edges of the events to obtain the target causal graph of the running events.

[0013] To achieve the above objectives, a second aspect of this application provides a system operation anomaly tracing device, the device comprising: The runtime data acquisition module is used to acquire multi-source runtime data of the target system; The timing extraction module is used to perform timing extraction based on the multi-source runtime data to obtain the event occurrence timing of the runtime events; wherein the runtime events occur on the target system; The causal reasoning module is used to perform causal reasoning based on the timing of the events to obtain the causal relationship of the running events; The cause-effect graph construction module is used to construct a graph based on the causal relationships of the events to obtain the target cause-effect graph of the running events. The anomaly tracing module is used to trace the anomalies of the running events based on the target cause-effect graph to obtain the target running anomaly path of the target system; The optimization suggestion generation module is used to perform anomaly optimization based on the target running abnormal path to obtain anomaly optimization suggestions for the target system.

[0014] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect.

[0015] To achieve the above objectives, a fourth aspect of the present application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect.

[0016] The system operation anomaly tracing method, apparatus, electronic device, and storage medium proposed in this application acquire multi-source operational data of the target system, extract time series data based on the multi-source operational data, and obtain the event occurrence time series of operational events. Specifically, the operational events occur on the target system, and the accurate acquisition of the event occurrence time series clarifies the sequence of events, providing a foundation for causal inference. Next, causal inference is performed based on the event occurrence time series to obtain the event causal relationships of the operational events, accurately uncovering these relationships and revealing the inherent logic between events. Furthermore, a graph is constructed based on the event causal relationships to obtain a target causal graph of the operational events, visually presenting complex causal connections. Further, anomaly tracing is performed on the operational events based on the target causal graph to quickly locate the root cause of the anomaly and obtain the target operational anomaly path of the target system, improving the accuracy and efficiency of operational anomaly tracing. Finally, anomaly optimization is performed based on the target operational anomaly path to obtain anomaly optimization suggestions for the target system, effectively improving the stability and reliability of the target system. Attached Figure Description

[0017] Figure 1 This is a flowchart of the system operation anomaly tracing method provided in the embodiments of this application; Figure 2 yes Figure 1 The flowchart of step S102 in the document; Figure 3 yes Figure 1 The flowchart of step S104 in the process; Figure 4 yes Figure 1 The flowchart of step S105 in the process; Figure 5 yes Figure 1 The flowchart of step S106 in the process; Figure 6 This is a flowchart of a system operation anomaly tracing method provided in another embodiment of this application; Figure 7 This is a flowchart of a system operation anomaly tracing method provided in another embodiment of this application; Figure 8This is a schematic diagram of the system operation anomaly tracing device provided in the embodiments of this application; Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0019] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0021] First, let's analyze some of the terms used in this application: Artificial intelligence (AI) is a new branch of computer science that studies, develops, and applies theories, methods, technologies, and systems to simulate, extend, and expand human intelligence. It aims to understand the essence of intelligence and produce intelligent machines that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thought. Furthermore, AI utilizes digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceiving the environment, acquiring knowledge, and using that knowledge to achieve optimal results.

[0022] Natural Language Processing (NLP): NLP uses computers to process, understand, and utilize human language (such as Chinese and English). It is a branch of artificial intelligence and an interdisciplinary field of computer science and linguistics, often referred to as computational linguistics. NLP includes syntactic analysis, semantic analysis, and discourse understanding. It is commonly used in machine translation, handwritten and printed character recognition, speech recognition and text-to-speech conversion, intent recognition, information extraction and filtering, text classification and clustering, sentiment analysis, and opinion mining. It involves data mining, machine learning, knowledge acquisition, knowledge engineering, artificial intelligence research, and linguistic research related to language computation.

[0023] In computer science, a cause-effect graph is a black-box testing technique that visualizes the logical relationships between system inputs (causes) and outputs (effects). It analyzes various combinations of input conditions and their impact on the output through graphical methods, and is particularly suitable for scenarios where there are mutual constraints and dependencies between input conditions.

[0024] Anomaly tracing refers to the process of tracing and locating the root cause of abnormal events during program or system operation through systematic technical means. It can be applied to business management systems related to financial technology, healthcare, and elderly care. By tracing the source of system operation anomalies in the business management system, the cause of the anomalies can be found to assist developers or maintenance personnel in debugging.

[0025] Currently, the main approach is to use distributed tracing data to construct service topology diagrams from operational data. This visually displays the request / response dependencies between services and identifies potential fault points based on the service topology diagram. However, the service topology diagram shows the potential interaction paths between components, rather than the actual causal relationships, which makes it impossible to accurately trace the source of anomalies and affects the accuracy of tracing the source of operational anomalies.

[0026] Based on this, embodiments of this application provide a method and apparatus for tracing system operation anomalies, an electronic device, and a storage medium, aiming to improve the accuracy of tracing operation anomalies.

[0027] The system operation anomaly tracing method, apparatus, electronic device, and storage medium provided in this application are specifically described through the following embodiments. First, the system operation anomaly tracing method in this application is described.

[0028] The embodiments of this application can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence (AI) refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0029] Foundational technologies for artificial intelligence generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies mainly encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0030] The system operation anomaly tracing method provided in this application relates to the field of artificial intelligence technology. This system operation anomaly tracing method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the system operation anomaly tracing method, but is not limited to the above forms.

[0031] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0032] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0033] Figure 1 This is an optional flowchart of the system operation anomaly tracing method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S106.

[0034] Step S101: Obtain multi-source operational data of the target system; Step S102: Perform time series extraction based on multi-source operational data to obtain the event occurrence time series of operational events; wherein, the operational events occur on the target system; Step S103: Perform causal reasoning based on the sequence of events to obtain the causal relationship of the running events; Step S104: Construct a graph based on the causal relationships of events to obtain the target causal graph of the running events; Step S105: Based on the target cause-effect graph, perform anomaly tracing on the running events to obtain the target running anomaly path of the target system; Step S106: Perform anomaly optimization based on the target's abnormal running path to obtain anomaly optimization suggestions for the target system.

[0035] Steps S101 to S106, as illustrated in this embodiment, involve acquiring multi-source operational data of the target system, extracting the time sequence of events based on this data, and obtaining the event occurrence sequence of the operational events. The operational events occur on the target system, and accurately obtaining the event occurrence sequence clarifies the order of events, providing a foundation for causal reasoning. Next, causal reasoning is performed based on the event occurrence sequence to obtain the causal relationships of the operational events, accurately uncovering these relationships and revealing the inherent logic between events. A graph is then constructed based on these causal relationships to obtain the target causal graph of the operational events, visually presenting complex causal connections. Furthermore, anomaly tracing is performed on the operational events based on the target causal graph to quickly locate the root cause of the anomaly and obtain the target operational anomaly path of the target system, improving the accuracy and efficiency of anomaly tracing. Finally, anomaly optimization is performed based on the target operational anomaly path to obtain anomaly optimization suggestions for the target system, effectively improving the stability and reliability of the target system.

[0036] In step S101 of some embodiments, the target system refers to a specific computer system, software application, network architecture, etc., that needs to be analyzed, monitored, or optimized.

[0037] For example, in fintech scenarios, the target system can be an online banking system, a mobile payment system, a risk assessment and monitoring system, a robo-advisor system, an insurance underwriting system, etc., and is not limited to these.

[0038] In healthcare and elderly care scenarios, the target system can be an electronic health record system, a telemedicine system, an intelligent health early warning system, an electronic medical record system, a hospital information management system, etc., but is not limited to these. Multi-source operational data means data collected from multiple different sources, which may include system logs, sensor data, user operation records, performance indicator monitoring tools, etc.

[0039] For example, multi-source runtime data can include, but is not limited to: System lifecycle metrics include: Git commit frequency, average PR size, code churn rate, cyclomatic complexity (from SAST), build time, and test pass rate.

[0040] Security metrics include: dependency vulnerability counts (by severity), Common Vulnerability Scoring System (CVSS) score, runtime exploitability data, and secret scan results.

[0041] Operational metrics: latency, error rate, throughput (RED metrics), CPU / memory utilization, high availability status, canary release success rate, etc.

[0042] Business / User Metrics: User-perceived latency (from RUM), conversion rate, session duration, etc.

[0043] Please see Figure 2 In some embodiments, step S102 may include, but is not limited to, steps S201 to S204: Step S201: Standardize the multi-source operating data to obtain standard operating data; Step S202: Extract events from the standard operating data to obtain candidate events; Step S203: Extract timestamps from standard running data to obtain the target running timestamp; Step S204: Construct the time series based on the target runtime timestamp and candidate events to obtain the event occurrence time series.

[0044] Steps S201 to S204, as illustrated in this embodiment, standardize the multi-source operational data to obtain standard operational data, eliminating data discrepancies and resulting in unified and standardized operational data. Next, events are extracted from the standard operational data to obtain candidate events, accurately locating key information; timestamps are extracted from the standard operational data to obtain target operational timestamps, clarifying the event time points. Finally, a time sequence is constructed based on the target operational timestamps and candidate events to obtain the event occurrence time sequence, clearly presenting the chronological order and temporal relationship of events, facilitating subsequent construction of a cause-effect graph.

[0045] In step S201 of some embodiments, multi-source operational data is standardized. Data with different formats, dimensions, and units are converted and processed according to certain rules and standards to give it a unified format, dimension, and range. This can eliminate differences between different data sources and improve data consistency and comparability.

[0046] Specifically, standardization can include, but is not limited to, normalization, scaling, encoding uniform time granularity, and uniform numerical units.

[0047] In step S202 of some embodiments, after obtaining the standardized standard operating data, event extraction is performed on the standard operating data. Data segments that meet certain conditions are searched and matched within the standard operating data and extracted as candidate events. This process extracts events with specific significance from a large amount of standard operating data, reducing the complexity of data processing and focusing on key information that has a significant impact on system operation.

[0048] Specifically, the alternative events represent specific entities in the target system, including metrics (service-A:latency), events (deployment-Z), vulnerabilities (vulnerability-X), and even developers (developer-Y).

[0049] In step S203 of some embodiments, the target runtime timestamp is the runtime of the candidate event. This is achieved by extracting timestamps from standard runtime data and extracting the time information field of the candidate event to obtain the target runtime timestamp. This facilitates subsequent causal analysis to understand the changing patterns of the system's operating state over time. Furthermore, when a system failure occurs, the target runtime timestamp can be used to quickly locate the time of the failure for fault tracing and analysis.

[0050] In step S204 of some embodiments, the candidate events are integrated according to their corresponding target running timestamps to construct the temporal relationship of the events and obtain the event occurrence sequence. This can clearly present the order in which the candidate events occur, making it easier to understand the evolution of the system's operating state and thus perform causal reasoning based on the event occurrence sequence.

[0051] In step S102 of some embodiments, Granger Causality can also be used to determine the temporal order of standard running data to obtain the event occurrence sequence.

[0052] In step S103 of some embodiments, statistical methods, machine learning algorithms, or domain knowledge-based rules, such as Granger causality test algorithm, PC algorithm, or FCI algorithm, can be used to analyze the potential correlation between events in the event occurrence sequence, determine which events are causes and which events are effects, and thus derive the event causal relationship of the candidate events.

[0053] Please see Figure 3 In some embodiments, step S104 may include, but is not limited to, steps S301 to S303: Step S301: Construct event nodes based on the causal relationship of events; Step S302: Determine the directed edges of events based on the causal relationships of the events; Step S303: Construct a graph based on event nodes and directed edges to obtain the target causal graph of the running event.

[0054] Steps S301 to S303 as shown in the embodiments of this application construct event nodes based on candidate events in the event causal relationship, which can comprehensively cover running events; determine the directed edges of events based on the event causal relationship, which accurately reflects the logical connection of events; finally, construct a graph based on event nodes and event directed edges to obtain the target causal graph of running events, which can intuitively present the causal relationship of running events.

[0055] In step S301 of some embodiments, event nodes are constructed based on candidate events in the event causal relationship, that is, candidate events are used as event nodes. By constructing event nodes, the complex operation process can be simplified and modularized, making subsequent anomaly tracing clearer and more targeted.

[0056] In step S302 of some embodiments, the logical relationships between the various event nodes can be analyzed to determine whether a causal relationship exists. If it does, the cause event and the result event are identified, and they are connected by directed edges, with the arrows pointing to the result event.

[0057] It's important to note that in a causal graph, directed edges connect event nodes with causal relationships. The arrow direction indicates the direction of the causal relationship, from the cause event to the effect event. Directed edges clearly define the sequence and dependencies between events. Specifically, each event's directed edge contains rich metadata, such as causal strength (e.g., obtained from an EBM model), confidence level, and average time delay.

[0058] In step S303 of some embodiments, based on the previously determined event nodes and directed edges, graphics drawing software or algorithms are used to arrange and connect the nodes and edges to form a clear and easy-to-read target cause-effect graph. The target cause-effect graph can present complex operational event relationships in an intuitive graphical way, quickly locate the root cause of the problem, predict the development trend of events, formulate corresponding countermeasures, and improve the reliability and operating efficiency of the system.

[0059] Please see Figure 4 In some embodiments, step S105 may include, but is not limited to, steps S401 to S403: Step S401: Perform node traversal on the target cause-effect graph to obtain abnormal node data; Step S402: Based on the abnormal node data, perform path traversal on the target cause-effect graph to obtain the original cause-effect path of the running event; Step S403: Based on the original causal path, perform structured processing to obtain the target system's abnormal operation path.

[0060] Steps S401 to S403, as illustrated in this embodiment, involve traversing the target cause-effect graph to obtain abnormal node data, enabling precise location of these data. Next, based on the abnormal node data, a path traversal is performed on the target cause-effect graph to obtain the original cause-effect path of the running event, clarifying the event's development logic. Finally, structured processing is performed on the original cause-effect path to obtain the target system's abnormal running path, facilitating rapid problem location, root cause analysis, and improved efficiency and accuracy of system anomaly handling.

[0061] In step S401 of some embodiments, all nodes in the target cause-effect graph are accessed sequentially in a certain order. The state, attributes, and other information of each node are checked to determine if any anomalies exist and to identify abnormal node data. This allows for rapid location of potentially problematic parts of the system, narrowing the scope of investigation and improving fault diagnosis efficiency. Abnormal node data refers to node-related information that deviates from normal expectations and may lead to system malfunctions, such as abnormal node states or values ​​exceeding range.

[0062] In step S402 of some embodiments, starting from the abnormal node, other nodes related to the node are visited sequentially according to the directed edges of events between nodes in the causal graph, forming a complete original causal path of the running event, which can reflect the causal development order of events during the system operation.

[0063] In step S403 of some embodiments, the nodes and connections in the original causal path are sorted out, redundant information is removed, and a unified representation method is used to obtain a clearer and more standardized target operational anomaly path, which is convenient for developers or operations personnel to understand and analyze based on the target operational anomaly path. Alternatively, an artificial intelligence model can be used to analyze the target operational anomaly path to derive the cause of the anomaly and optimization suggestions.

[0064] For example, nodes in the path can be grouped according to certain classification criteria, or the logical relationships between nodes can be represented using more standardized symbols.

[0065] Please see Figure 5 In some embodiments, step S106 may also include, but is not limited to, steps S501 to S503: Step S501: Perform causal inference based on the abnormal path of the target operation to obtain the causal influencing nodes; Step S502: Perform causal inference based on causal influence nodes to obtain the inference results; wherein, the inference results are used to characterize whether the target system is in an abnormal or normal operating state after the causal influence nodes are adjusted. Step S503: If the simulation results are used to characterize the target system's operation after the causal influence nodes are adjusted as normal, generate anomaly optimization suggestions for the target system based on the causal influence nodes.

[0066] Steps S501 to S503, as illustrated in this embodiment, accurately pinpoint the causal influencing nodes causing the anomaly by performing causal inference based on the abnormal target operating path, thus clarifying the source of the problem. Next, causal deduction is performed based on the causal influencing nodes to simulate the operation of the target system after adjusting the nodes, yielding the deduced operating results. These results characterize whether the target system's operation after adjusting the causal influencing nodes is abnormal or normal. Finally, if the deduced operating results characterize the target system's operation after adjusting the causal influencing nodes as normal, anomaly optimization suggestions are generated based on the causal influencing nodes, providing targeted optimization suggestions that effectively solve the target system's abnormal operation problem and improve system stability and operating efficiency.

[0067] In step S501 of some embodiments, a detailed analysis is performed on the abnormal path of the target operation. Using the logic and methods of causal inference, such as large models (e.g., GPT models), nodes that may cause abnormalities are identified, i.e., causal influence nodes.

[0068] In step S502 of some embodiments, after determining the causal influencing node, the parameters of the causal influencing node are adjusted, and causal inference is performed based on the causal influencing node with adjusted parameters to obtain the inference results. This helps developers or operations personnel evaluate the effectiveness of the adjustment plan, avoids making uncertain modifications directly in the target system, reduces system risks, and improves the accuracy and success rate of problem solving.

[0069] Specifically, the simulation results are used to characterize whether the target system is operating abnormally or normally after the causal influence nodes are adjusted.

[0070] In step S503 of some embodiments, if the simulation results are used to characterize the target system's operation as normal after adjustments to the causal influencing nodes, then anomaly optimization suggestions for the target system are generated based on the causal influencing nodes, such as modifying code, updating configurations, or optimizing algorithms. This provides specific guidance for system repair and improvement, enabling developers to perform targeted optimization work and improve system stability and reliability.

[0071] In other embodiments, if the simulation results indicate an abnormal operating condition of the target system after adjustments to the causal impact nodes, the causal simulation is repeated, i.e., step S502 is executed again, until an abnormal optimization suggestion is obtained. If the causal recommendation still fails to yield an optimization suggestion within a preset number of attempts, an alarm message is generated to prompt developers or operations personnel to manually debug the anomaly.

[0072] Please see Figure 6In some embodiments, after step S106, the system runs an anomaly tracing method that includes, but is not limited to, steps S601 to S605: Step S601: Receive system operation query data; Step S602: Transform the system query data into a statement to obtain a causal query statement; Step S603: Determine the target query node based on the causal query statement; Step S604: Perform path traversal on the target cause-effect graph based on the target query node to obtain the target query path; Step S605: Generate a running status report of the target system based on the target query path.

[0073] Steps S601 to S605, as illustrated in this embodiment, involve receiving system operation query data and converting it into a causal query statement for subsequent processing. Next, target query nodes are determined based on the causal query statement, and a path traversal is performed on the target causal graph based on these nodes to identify target query paths related to the problem. Finally, a system operation status report is generated based on the target query paths, enabling efficient and accurate location of system operation problems and clear, intuitive result presentation, thus improving problem-solving efficiency.

[0074] It should be noted that the system operation queries are submitted by developers or operations personnel, and the questions may involve whether the system is functioning properly, whether the response time is too long, or whether a certain module is malfunctioning. Examples include: "What is the most likely root cause of the current slow system response?" and "How risky is it to push the latest security patch to the production environment now?"

[0075] In step S602 of some embodiments, natural language processing technology is used to perform semantic analysis and syntactic transformation on the received system operation query data, transforming it into a statement form that conforms to causal query logic, thereby obtaining a causal query statement, which is easier for the computer system to understand and process, and improves the accuracy and efficiency of the query.

[0076] In step S603 of some embodiments, searching and matching relevant nodes in a pre-constructed target causal graph according to the causal query statement as target query nodes can narrow the query scope and improve query efficiency.

[0077] Furthermore, starting from the identified target query node, the target causal graph is traversed according to the causal connections between nodes in the target causal graph. The nodes and directed edges traversed are recorded, and the causal chain that leads to the specific operating state of the system is displayed, thus forming the target query path.

[0078] Finally, the target query path is analyzed using a large-scale model (such as the GPT model) to generate an operational status report for the target system. This report details the target system's status under specific operating conditions, the causes of problems, and potential impacts, including system performance metrics, anomalies, and causal analysis results. It provides developers and operations personnel with intuitive and systematic information to quickly understand operational issues in the target system, offering strong support for decision-making and problem-solving.

[0079] Please see Figure 7 In some embodiments, after step S106, the system runs an anomaly tracing method that includes, but is not limited to, steps S701 to S704: Step S701: Receive an exception debugging instruction; wherein the exception debugging instruction includes exception node information and exception debugging parameters; Step S702: Based on the abnormal node information, candidate debugging nodes are selected from the target cause-effect graph; Step S703: Modify the parameters of the candidate debugging nodes based on the abnormal debugging parameters to obtain the target debugging node; Step S704: Perform causal inference based on the target debugging node to obtain inference operation feedback data; wherein, the inference operation feedback data is used to characterize whether the target system is in an abnormal operation or a normal operation after the parameters are modified according to the abnormal debugging command.

[0080] Steps S701 to S704, as illustrated in this embodiment, clarify the direction and key information for debugging by receiving an abnormal debugging instruction containing abnormal node information and abnormal debugging parameters. Next, candidate debugging nodes are selected from the target causal graph based on the abnormal node information, and the parameters of the candidate debugging nodes are modified based on the abnormal debugging parameters to obtain the target debugging node. Finally, causal inference is performed based on the target debugging node to obtain inference operation feedback data; wherein, the inference operation feedback data is used to characterize whether the target system's operation after parameter modification according to the abnormal debugging instruction is an abnormal operation or a normal operation.

[0081] It should be noted that the exception debugging command is proposed by the developer or operations personnel and belongs to the category of "intervention query (What-If analysis). It is used to verify whether the debugging by the developer or operations personnel is feasible, avoid making uncertain modifications directly to the target system, reduce system risks, and improve the accuracy and success rate of problem solving.

[0082] In step S701 of some embodiments, the exception debugging instruction includes exception node information and exception debugging parameters. The exception node information indicates the specific location or component information where the exception occurs in the target system, such as a function, module, interface, or data node, thus clarifying the source of the exception that needs attention and debugging. The exception debugging parameters are various parameter settings related to exception debugging. These parameters control the method, scope, and degree of debugging the exception node, such as the magnitude of adjustment and the number of tests.

[0083] In step S702 of some embodiments, based on the abnormal node information in the abnormal debugging instruction, a search and matching is performed in the target cause-effect graph to find nodes related to the abnormal node information and use them as candidate debugging nodes. This can narrow the debugging scope, avoid blindly debugging the target system, and improve the targeting and effectiveness of debugging.

[0084] In step S703 of some embodiments, the selected candidate debugging nodes are modified according to the abnormal debugging parameters in the abnormal debugging instruction. For example, the configuration parameters and algorithm parameters of the candidate debugging nodes are adjusted, and the modified nodes are determined as the target debugging nodes.

[0085] In step S704 of some embodiments, after obtaining the target debugging nodes with modified parameters, the target system's operation after parameter modification at these nodes is simulated using causal inference logic and methods, based on the target debugging nodes, generating inference operation feedback data. This inference operation feedback data characterizes whether the target system's operation after parameter modification according to abnormal debugging instructions is abnormal or normal. Obtaining inference operation feedback data through causal inference allows for early prediction of the impact of parameter modifications on system operation, avoiding uncertain modifications directly to the target system, reducing system risk, and providing developers with decision-making basis to determine the effectiveness of the current debugging plan.

[0086] In some embodiments, the system operation query data may also be questions in the form of abnormal debugging instructions. Natural language processing technology is used to perform semantic analysis and syntactic transformation on the received system operation query data to obtain causal query statements, and then steps S701 to S704 are executed, which will not be described in detail here.

[0087] The system operation anomaly tracing method provided in this application embodiment can be used to trace anomalies in systems such as online banking systems, mobile payment systems, risk assessment and monitoring systems, intelligent investment advisory systems, and insurance underwriting systems in financial technology scenarios, as well as electronic health record systems, telemedicine systems, intelligent health early warning systems, electronic medical record systems, and hospital information management systems in medical, health and elderly care scenarios. It can quickly locate the root cause of the anomaly, obtain the target system's target operation anomaly path, and generate anomaly optimization suggestions, effectively improving the stability and reliability of the target system.

[0088] In addition to its applications in fintech and healthcare / elderly care, it can also be used in other scenarios, such as retail and e-commerce, and education, and is not limited to these.

[0089] Please see Figure 8 This application also provides a system operation anomaly tracing device, which can implement the above-mentioned system operation anomaly tracing method. The device includes: The runtime data acquisition module 801 is used to acquire multi-source runtime data of the target system; The timing extraction module 802 is used to extract timing data based on multi-source runtime data to obtain the event occurrence timing of runtime events; wherein, the runtime events occur on the target system; The causal reasoning module 803 is used to perform causal reasoning based on the sequence of events to obtain the causal relationship of the running events; The cause-effect graph construction module 804 is used to construct a graph based on the cause-effect relationship of events to obtain the target cause-effect graph of the running events. The anomaly tracing module 805 is used to trace the anomalies of running events based on the target cause-effect graph to obtain the target running anomaly path of the target system. The optimization suggestion generation module 806 is used to perform abnormal optimization based on the abnormal path of the target system and obtain abnormal optimization suggestions for the target system.

[0090] The specific implementation of the system operation anomaly tracing device is basically the same as the specific implementation of the above-mentioned system operation anomaly tracing method, and will not be repeated here.

[0091] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned system operation anomaly tracing method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0092] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the system operation anomaly tracing method of the embodiments of this application. The input / output interface 903 is used to implement information input and output; The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904); The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0093] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described system operation anomaly tracing method.

[0094] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0095] The system operation anomaly tracing method, apparatus, electronic device, and storage medium provided in this application acquire multi-source operation data of the target system, extract time series data based on the multi-source operation data, and obtain the event occurrence time series of operation events. The operation events occur on the target system, and the accurate acquisition of the event occurrence time series clarifies the sequence of events, providing a foundation for causal reasoning. Next, causal reasoning is performed based on the event occurrence time series to obtain the event causal relationships of the operation events, accurately uncovering these relationships and revealing the inherent logic between events. A graph is then constructed based on these causal relationships to obtain a target causal graph of the operation events, visually presenting complex causal connections. Furthermore, anomaly tracing is performed on the operation events based on the target causal graph to quickly locate the root cause of the anomaly and obtain the target operation anomaly path of the target system, improving the accuracy and efficiency of operation anomaly tracing. Finally, anomaly optimization is performed based on the target operation anomaly path to obtain anomaly optimization suggestions for the target system, effectively improving the stability and reliability of the target system.

[0096] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0097] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0098] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0099] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0100] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0101] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0102] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0103] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0104] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0105] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0106] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for tracing the source of system malfunctions, characterized in that, The method includes: Acquire multi-source operational data of the target system; Based on the multi-source operational data, time-series extraction is performed to obtain the event occurrence time sequence of the operational events; wherein, the operational events occur on the target system; Based on the sequence of events, causal reasoning is performed to obtain the causal relationship of the running events; Based on the causal relationships of the events, a graph is constructed to obtain the target causal graph of the running events; Based on the target cause-effect graph, the abnormal source of the running event is traced to obtain the target running abnormal path of the target system; Based on the abnormal path of the target system, anomaly optimization is performed to obtain anomaly optimization suggestions for the target system.

2. The method according to claim 1, characterized in that, The step of tracing the abnormal origins of the runtime events based on the target cause-effect graph to obtain the target runtime abnormal path of the target system includes: The target cause-effect graph is traversed to obtain abnormal node data; Based on the abnormal node data, the target cause-effect graph is traversed to obtain the original cause-effect path of the running event; The target system's abnormal operation path is obtained by performing structured processing based on the original causal path.

3. The method according to claim 1, characterized in that, The anomaly optimization based on the target abnormal path to obtain anomaly optimization suggestions for the target system includes: Based on the abnormal path of the target operation, causal inference is performed to obtain the causal influencing nodes; Causal inference is performed based on the causal influencing nodes to obtain the inference results; wherein, the inference results are used to characterize whether the target system is operating abnormally or normally after the causal influencing nodes are adjusted. If the simulation results are used to characterize the target system's operation as normal after the causal influence nodes are adjusted, then the abnormal optimization suggestions for the target system are generated based on the causal influence nodes.

4. The method according to claim 1, characterized in that, After performing anomaly optimization based on the target abnormal path to obtain anomaly optimization suggestions for the target system, the method further includes: Receive system operation query data; The system operation query data is transformed into a causal query statement; The target query node is determined based on the causal query statement; Based on the target query node, the target cause-effect graph is traversed to obtain the target query path; A running status report of the target system is generated based on the target query path.

5. The method according to claim 1, characterized in that, After performing anomaly optimization based on the target abnormal path to obtain anomaly optimization suggestions for the target system, the method further includes: Receive an exception debugging instruction; wherein the exception debugging instruction includes exception node information and exception debugging parameters; Candidate debugging nodes are selected from the target cause-effect graph based on the abnormal node information; Based on the abnormal debugging parameters, the candidate debugging nodes are modified to obtain the target debugging node; Causal inference is performed based on the target debugging node to obtain inference operation feedback data; wherein, the inference operation feedback data is used to characterize whether the operation of the target system after parameter modification according to the abnormal debugging instruction is an abnormal operation or a normal operation.

6. The method according to any one of claims 1 to 5, characterized in that, The step of extracting the event occurrence time sequence based on the multi-source operational data to obtain the operational event time sequence includes: The multi-source operational data is standardized to obtain standard operational data; Events are extracted from the standard operating data to obtain candidate events; The target running timestamp is obtained by extracting timestamps from the standard running data. The timing sequence of the events is constructed based on the target runtime timestamp and the candidate events.

7. The method according to any one of claims 1 to 5, characterized in that, The process of constructing a graph based on the causal relationships of the events to obtain the target causal graph of the running events includes: Construct event nodes based on the aforementioned causal relationships; Determine the directed edges of the events based on the aforementioned causal relationships; A graph is constructed based on the event nodes and the directed edges of the events to obtain the target causal graph of the running events.

8. A system operation anomaly tracing device, characterized in that, The device includes: The runtime data acquisition module is used to acquire multi-source runtime data of the target system; The timing extraction module is used to perform timing extraction based on the multi-source runtime data to obtain the event occurrence timing of the runtime events; wherein the runtime events occur on the target system; The causal reasoning module is used to perform causal reasoning based on the timing of the events to obtain the causal relationship of the running events; The cause-effect graph construction module is used to construct a graph based on the causal relationships of the events to obtain the target cause-effect graph of the running events. The anomaly tracing module is used to trace the anomalies of the running events based on the target cause-effect graph to obtain the target running anomaly path of the target system; The optimization suggestion generation module is used to perform anomaly optimization based on the target running abnormal path to obtain anomaly optimization suggestions for the target system.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images