Abnormality detection method and device, electronic equipment and storage medium

Abstract

The invention provides an anomaly detection method and device, electronic equipment and a storage medium. The method comprises the steps of collecting a data packet obtained by performing database query based on a service code; processing the data packet to obtain index data; determining a corresponding multi-dimensional mean vector and a covariance matrix from a corresponding preset baseline model according to the query statement ID; calculating a comprehensive abnormal score based on the multi-dimensional mean vector, the covariance matrix and the index data; calculating an independent abnormal score based on the index data of each dimension and the historical index data; and if the comprehensive exception score is greater than a preset threshold, generating alarm data based on the comprehensive exception score and the independent exception score of the performance index of each dimension. The method comprises the following steps: establishing index data of a multi-dimensional performance index for each SQL query statement ID; and overall anomaly detection is carried out based on the comprehensive anomaly score determined by the performance index data, so that potential memory overflow and system avalanche risks can be avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an exception detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] When performing a query operation on a database, a business code is often directly used to execute a corresponding operation on the database. An ORM framework does not provide complete database operation monitoring functions, and a user end can only obtain part of the execution information of an execution statement at the database connection pool level or the database side, so that the user end is difficult to completely obtain the execution information of the execution statement associated with the database operation; potential memory overflow and system avalanche risks caused by a sudden increase in data volume, an inefficient query mode or slow performance degradation. SUMMARY

[0003] Therefore, the embodiments of the present application provide an exception detection method and device, electronic equipment and storage medium to solve the problems of memory overflow and system avalanche risks in the prior art.

[0004] To achieve the above object, the embodiments of the present application provide the following technical solutions.

[0005] The first aspect shows an exception detection method, which comprises:

[0006] Obtaining a business code for executing a query on a database, wherein the business code contains a query statement ID;

[0007] Collecting a data packet obtained by querying the database based on the business code;

[0008] Processing the data packet to obtain index data of multi-dimensional performance indicators;

[0009] Determining a corresponding multi-dimensional mean vector and covariance matrix from a corresponding preset baseline model according to the query statement ID, wherein the preset baseline model is obtained by processing a historical data set based on the query statement ID;

[0010] Calculating a comprehensive anomaly score based on the multi-dimensional mean vector, the covariance matrix and the index data of the multi-dimensional performance indicators;

[0011] If the comprehensive anomaly score is greater than a preset threshold, generating alarm data.

[0012] Optionally, the method further comprises:

[0013] Obtaining historical time series data corresponding to the performance indicators of each dimension under each query statement ID in a preset time period;

[0014] For each dimension performance indicator, linear processing is performed based on the historical time series data to determine the corresponding slope and amplitude;

[0015] Based on the slope and amplitude, it is determined whether to generate a trend warning of the performance indicator of the dimension.

[0016] Optionally, the data packet is processed to obtain index data of the multi-dimensional performance indicator, including:

[0017] Based on the execution time in the data packet, the execution time consumption is calculated;

[0018] Based on the dimension of the data in the data packet, the corresponding return row number is determined;

[0019] Based on the field type statistics of the data packet, the corresponding result set total bytes are calculated;

[0020] Based on the paging data in the data packet, the corresponding paging depth is determined;

[0021] Based on the parameters in the data packet, the parameter complexity is determined;

[0022] Based on the return data set in the data packet, the result set sparsity is determined;

[0023] Based on the number of occurrences of the preset keyword in the SQL text of the data packet and the corresponding preset weight, the SQL static complexity is calculated;

[0024] One or more of the execution time consumption, return row number, result set total bytes, paging depth, parameter complexity, result set sparsity and SQL static complexity are combined to obtain index data of the multi-dimensional performance indicator.

[0025] Optionally, the process of processing the historical data set based on the query statement ID to obtain the preset baseline model includes:

[0026] For each query statement ID, the historical data set corresponding to all performance indicators in the historical time period is obtained from the historical data cache;

[0027] The historical data set is divided into different arrays;

[0028] Based on the array, the mean vector of all data of each dimension performance indicator is calculated, and it is used as a multi-dimensional mean vector;

[0029] A preset processing model is called to process the array, and the corresponding covariance matrix is output;

[0030] The multi-dimensional mean vector and the covariance matrix are combined to form the preset baseline model corresponding to the query statement ID.

[0031] Optionally, the comprehensive anomaly score is calculated based on the multi-dimensional mean vector, the covariance matrix, and the index data of the multi-dimensional performance indicator, and the comprehensive anomaly score is calculated based on the covariance matrix, the difference between the observation vector and the multi-dimensional mean vector, and the first matrix.

[0032] The index data of the multi-dimensional performance indicator is converted into an observation vector.

[0033] The vector transposition processing is performed based on the observation vector and the multi-dimensional mean vector to obtain a first matrix.

[0034] The comprehensive anomaly score is calculated based on the covariance matrix, the difference between the observation vector and the multi-dimensional mean vector, and the first matrix.

[0035] Optionally, the method further comprises:

[0036] For each performance indicator in the multi-dimensional performance indicator, historical index data corresponding to the performance indicator in a historical time is obtained.

[0037] The historical mean and the historical standard deviation are calculated based on the historical index data.

[0038] A first value is calculated based on the performance indicator data and the historical mean.

[0039] The ratio of the first value to the historical standard deviation is taken as an independent anomaly score of the performance indicator of the dimension.

[0040] Optionally, the method further comprises:

[0041] The performance indicators are sorted according to the independent anomaly scores of the performance indicators of each dimension to obtain an anomaly contribution degree list.

[0042] The comprehensive anomaly score and a preset overall anomaly alarm type are combined to obtain alarm information.

[0043] The alarm data is collected based on the anomaly contribution degree list and the alarm information.

[0044] The second aspect shows an anomaly detection device, and the device comprises:

[0045] An acquisition unit is configured to acquire a business code for performing a query on a database, wherein the business code contains a query statement ID.

[0046] A collection unit is configured to collect a data packet obtained by performing a database query based on the business code.

[0047] A processing unit is configured to process the data packet to obtain index data of a multi-dimensional performance indicator.

[0048] determining, according to the query statement ID, a corresponding multi-dimensional mean vector and a covariance matrix from a corresponding preset baseline model, wherein the preset baseline model is obtained by processing a historical data set based on the query statement ID;

[0049] calculating, based on the multi-dimensional mean vector, the covariance matrix, and the index data of the multi-dimensional performance indicator, a comprehensive anomaly score;

[0050] judging, if the comprehensive anomaly score is greater than a preset threshold, to generate alarm data.

[0051] A third aspect shows an electronic device, which includes a processor and a memory, the memory is used to store data generated program code and data, and the processor is used to call the program instructions in the memory to execute the anomaly detection method as any one of the first aspect.

[0052] A fourth aspect shows a storage medium, which includes a storage program, wherein when the program runs, the device where the storage medium is located executes the anomaly detection method as any one of the first aspect.

[0053] Based on the above-mentioned anomaly detection method, device, electronic device and storage medium provided by the embodiments of the present application, the method includes: obtaining a business code for executing a query on a database, the business code containing a query statement ID; collecting a data packet obtained by querying the database based on the business code; processing the data packet to obtain index data of a multi-dimensional performance indicator; determining, according to the query statement ID, a corresponding multi-dimensional mean vector and a covariance matrix from a corresponding preset baseline model, wherein the preset baseline model is obtained by processing a historical data set based on the query statement ID; calculating, based on the multi-dimensional mean vector, the covariance matrix, and the index data of the multi-dimensional performance indicator, a comprehensive anomaly score; if the comprehensive anomaly score is greater than a preset threshold, generating alarm data, the alarm data including alarm information and an anomaly contribution degree list. In the embodiments of the present application, index data of a multi-dimensional performance indicator is established for each SQL query statement ID; on this basis, the comprehensive anomaly score calculated based on the index data of the multi-dimensional performance indicator is used for overall anomaly detection, so that potential memory overflow and system avalanche risks can be avoided. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only embodiments of the present application, and those skilled in the art can obtain other drawings according to the provided drawings without creative labor.

[0055] Figure 1 A flow diagram of an abnormality detection method is shown for an embodiment of the present application.

[0056] Figure 2 A structural diagram of an abnormality detection device is shown for an embodiment of the present application. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0058] The terms "first", "second", "third", "fourth" and the like in the description of the specification and claims of the present application and the above drawings (if any) are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to the process, method, product or device.

[0059] It should be noted that the description involving "first", "second" and the like in the present application is only for the purpose of description, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of various embodiments can be combined with each other, but must be based on the fact that a person skilled in the art can realize it. When the combination of technical solutions contradicts each other or cannot be realized, it should be considered that the combination of technical solutions does not exist, and is not within the scope of protection required by the present application.

[0060] In this application, the terms "comprise", "contain" or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such a process, method, article or device. Without more limitations, the element defined by the statement "comprises a" does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0061] Referring to Figure 1 A flowchart of an abnormality detection method is shown for an embodiment of the present application, and the method comprises:

[0062] Step S101: Obtain business code for executing a query on a database, wherein the business code contains a query statement ID;

[0063] In the process of specifically implementing step S101, an interceptor MultiDimBehaviorInterceptor class is created, and the interceptor is configured to accurately intercept the query method of the interface org.apache.ibatis.executor.Executor through the functions @Intercepts and @Signature annotations, that is, to intercept the business code for executing a query on a database, and to generate a corresponding query statement ID based on the SQL statement in the business code.

[0064] It should be noted that if the business code is the same, the corresponding query statement ID is also the same.

[0065] Step S102: Collect data packets obtained based on the database query of the business code;

[0066] In the process of implementing step S102, the following operations are performed inside the intercept method: first, the core class MappedStatement encapsulating the SQL mapping configuration is obtained by calling the invocation object, and the unique identification SQL ID and SQL text of this query are extracted therefrom; next, the class RowBounds object (for paging information) and the parameter object (for parameter information) of the paging query are obtained from the function invocation.getArgs() of the target method parameter, and the context information is obtained; then, the timestamp T_start = System.nanoTime() before the query is recorded. Subsequently, the original database query is executed by calling Object result = invocation.proceed(), and the returned Java object (usually a List) is stored in the result variable, and the timestamp T_end = System.nanoTime() at the end of the query is recorded; finally, the data obtained in the previous steps, i.e., the unique identification SQL ID, the SQL text, the context information, the timestamp before the query, the timestamp at the end of the query, and the data in the result variable are encapsulated into a temporary, non-persistent multi-dimensional raw performance data packet (A).

[0067] The data packet (A) is a Java object containing the following information:

[0068] Identification sqlId: com.mycompany.UserMapper.findUserById;

[0069] Data in the return dataset result variable resultObject: result variable (i.e., Java object reference of the query result);

[0070] Paging data rowBounds: RowBounds;

[0071] Parameter parameter: parameter;

[0072] Timestamp before query startTime: T_start;

[0073] Timestamp at the end of the query endTime: T_end.

[0074] It should be noted that the SQL ID is usually a combination of the fully qualified name and the method name of the Mapper interface, for example, com.mycompany.UserMapper.findUserById.

[0075] Step S103: processing the data packet to obtain index data of the multi-dimension performance index;

[0076] It should be noted that the process of implementing step S103 includes the following steps.

[0077] Step S11: calculating execution time consumption based on the execution time in the data packet;

[0078] It should be noted that the execution time includes the timestamp before the query starts and the timestamp T_end when the query ends.

[0079] In the process of implementing step S11, the timestamp T_start before the query starts and the timestamp T_end when the query ends are substituted into formula (1) for calculation to obtain the execution time consumption Duration, and the execution time consumption Duration is converted from nanoseconds to milliseconds.

[0080] Formula (1):

[0081]

[0082] Step S12: determining the corresponding return row number based on the dimension of the data in the data packet;

[0083] In the process of implementing step S12, the dimension of the return data resultObject in the data packet is checked. If it is a preset dimension, the return row number RowCoun is the size of the data packet, i.e. RowCount is its size(), if it is other dimension, RowCount is 1 (assuming non-empty), if it is null, RowCount is 0.

[0084] It should be noted that the preset dimension is set in advance according to multiple experiments, which can generally be set as an instance of the collection interface java.util.Collection.

[0085] Step S13: calculating the total bytes of the result set based on the field type of the data packet;

[0086] In the process of implementing step S13, to avoid the performance overhead caused by complete serialization, a lightweight estimation method is used to calculate the byte size ByteSize. This method traverses the return data resultObject (if it is a collection, then traverse each element in it), obtains all fields of the object through reflection, and accumulates the total byte size according to the field type (such as 4 bytes for int, 8 bytes for long, and the length of String is calculated according to UTF-8 encoding) to estimate the total byte size, i.e. the total bytes of the result set.

[0087] Step S14: determining the corresponding paging depth based on the paging data in the data packet;

[0088] In the process of implementing step S14, if the parameter contains RowBounds or similar objects for physical paging, i.e., paging data, the offset of the starting position of the record query is directly extracted therefrom, which is the paging depth of this query. If such paging parameters do not exist, the paging depth is recorded as 0.

[0089] Step S15: determining the parameter complexity based on the parameters in the data packet;

[0090] In the process of implementing step S15, the function ParamComplexity is called to analyze the structure of the input parameter used in the SQL query. If the parameter itself is a set (for example, a list used in the SQL `IN` clause), the size of the set is regarded as the parameter complexity; if the parameter is a map (Map), the number of key-value pairs thereof can be used as a measure of complexity, i.e., the parameter complexity.

[0091] Optionally, it further includes: checking whether a collection type member variable is contained in the parameter object by reflection, so as to cope with more complex parameter structures.

[0092] Step S16: determining the result set sparsity based on the returned data set in the data packet;

[0093] In the process of implementing step S16, the function Sparsity is called to measure the effectiveness of the returned data set. Specifically, through the reflection mechanism, part of the objects in the returned result set (for example, the first 100 objects) are sampled and checked, and in the sample objects, the values of all fields are checked one by one, the number of fields with empty values is counted, and finally, the total number of fields with empty values is divided by the total number of fields in the sample objects to obtain a decimal number between 0 and 1, which is the result set sparsity.

[0094] It should be noted that the higher the value of the result set sparsity is, the more empty values in the returned data, and the lower the data effectiveness is.

[0095] Step S17: calculating the SQL static complexity based on the number of occurrences of the preset keywords in the SQL text of the data packet and the corresponding preset weights;

[0096] In the process of implementing step S17, the SQL text itself is statically analyzed without executing the SQL, and specifically, the number of occurrences of the preset keywords in the SQL statement is counted by using a text matching technology such as a regular expression, for example, JOIN (connection), GROUP BY (grouping), and nested SELECT (subquery).

[0097] Then, for each preset keyword, there is a corresponding preset weight (for example, the weight of a subquery is higher than that of a JOIN), the count value of each keyword is multiplied by its weight and summed up to obtain a quantitative SQL static complexity.

[0098] Step S18: combine one or more of the execution time, the number of returned rows, the total bytes of the result set, the pagination depth, the parameter complexity, the sparsity of the result set, and the SQL static complexity to obtain a multi-dimensional performance indicator.

[0099] In the process of implementing step S18, one or more of the calculation results of steps S11 to S17 are encapsulated into a structured multi-dimensional real-time performance indicator, i.e., the performance indicator data of multiple dimensions.

[0100] For example, the performance indicator data (B) is a Java object containing the following information:

[0101] *sqlId: com.mycompany.UserMapper.findUserById;

[0102] *duration: 25.7 (ms);

[0103] *rowCount: 150 (rows);

[0104] *byteSize: 30720 (bytes);

[0105] *paginationDepth: 1400;

[0106] *paramComplexity: 10;

[0107] *sparsity: 10%;

[0108] *sqlComplexity: 50;

[0109] *timestamp: current timestamp.

[0110] Optionally, it also includes:

[0111] The real-time performance indicator data of the multi-dimensional performance indicator is encapsulated into an event and published to a high-performance in-memory message queue (such as Disruptor or java.util.concurrent.ArrayBlockingQueue). This operation is completed in the business main thread and must be extremely fast to avoid increasing the query response time.

[0112] Optionally, further comprising: obtaining the event from the queue by one or more independent background consumer threads; the consumer thread is responsible for persisting the real-time metric data (B) of the multi-dimensional performance indicator in the event into a history data cache (e.g. Redis).

[0113] Optionally, further comprising: in the history data cache Redis, creating a ZSET (ordered set) for each metric (e.g. rowCount) of each SQL_ID. For example, zadd history:rowCount:com.mycompany.UserMapper.findUserById <timestamp> <rowcount>In this way, each performance indicator of each query forms a time series data. At the same time, in order to ensure storage efficiency, old data can be cleaned regularly (such as only keeping the last 7 days).

[0114] Step S104: determining the corresponding multi-dimensional mean vector and covariance matrix from the corresponding preset baseline model according to the query statement ID.

[0115] The preset baseline model is obtained by processing the historical data set based on the query statement ID.

[0116] In the process of implementing step S104, it is judged whether there is a multi-dimensional covariance baseline model corresponding to the query statement ID. If there is, the multi-dimensional performance covariance baseline model (C) of the query calculated in advance is obtained from the cache (such as Redis HASH) according to the query statement ID sqlId. The model includes a 7-dimensional mean vector μ and a 7x7 covariance matrix Σ. If there is no corresponding multi-dimensional covariance baseline model, the performance indicator data is stored for subsequent training of the preset baseline model based on the historical data set corresponding to the query statement ID. That is, no abnormality is judged at this time, and the performance indicator data of the query is continuously collected until the periodic task in the background successfully creates and caches the first baseline model based on the collected performance indicator data.

[0117] The preset baseline model is a 7-dimensional mean vector μ and a 7x7 covariance matrix Σ trained based on the historical data set corresponding to the query statement ID;

[0118] The specific training process of obtaining the preset baseline model based on the historical data set of the query statement ID is as follows:

[0119] A11: For each query statement ID, the historical data set corresponding to all dimension performance indicators in the historical time period is obtained from the historical data cache;

[0120] Specifically, the execution time, row number, and / or byte size indicator data of all performance indicators in the historical time period are pulled from the historical data cache (such as Redis ZSET), and are used as the historical data set;

[0121] The historical time period is pre-set, which can be set to the last N days, and N can be 7.

[0122] A12: The historical data set is divided into different arrays.

[0123] In the process of implementing step A21, the index data of each acquired performance indicator in the historical data set is composed into an array, that is, from the multiple ordered sets ZSET of the cache Redis, all data points of the 7 dimensions are pulled according to the timestamp range, and are combined into the form of List<double[]> or double[][]. Each double[] array represents the index data of the 7-dimensional performance indicator of one query.

[0124] A13: Calculate the mean vector μ of all data of each dimension of the performance indicator based on the array, and take it as a multi-dimensional mean vector.

[0125] The mean vector μ is a 7-dimensional vector, that is, it includes the vector mean of each dimension; wherein each vector is the arithmetic mean of all historical index data of the corresponding dimension.

[0126] Specifically, each element in the 7 dimensions of each array (i.e. each column of the matrix) is traversed, and the mean of each dimension is calculated based on the corresponding element of each dimension, i.e. the value corresponding to the performance indicator data, and stored in the result vector, thereby obtaining a multi-dimensional mean vector.

[0127] A14: Call a preset processing model to process the array and output the corresponding covariance matrix.

[0128] It should be noted that the preset processing model is a pre-trained calculation model, which can calculate the corresponding covariance matrix based on the array.

[0129] Specifically, all arrays in the historical time period are input into the preset processing model to output the corresponding covariance matrix Σ, i.e. a 7x7 covariance matrix.

[0130] It should be noted that the diagonal elements refer to the values on the diagonal line (from the top left to the bottom right) of the covariance matrix, which are the variances of each dimension itself, indicating the dispersion degree of the data of the dimension.

[0131] The non-diagonal elements refer to the values Σ(i,j) on the non-diagonal line, which are the covariances between the i-th dimension and the j-th dimension, indicating the correlation (positive correlation, negative correlation or no correlation) of the changes of the two dimensions.

[0132] A15: Group the multi-dimensional mean vector and the covariance matrix to form the preset baseline model corresponding to the query statement ID.

[0133] Specifically, the multi-dimensional mean vector and the covariance matrix are updated to the cache (Redis HASH) to form a new version of the multi-dimensional performance baseline model (C).

[0134] Step S105: calculating a comprehensive anomaly score based on the multidimensional mean vector, the covariance matrix, and the index data of the multidimensional performance index;

[0135] It should be noted that the process of implementing step S105 includes the following steps.

[0136] Step S21: converting the index data of the multidimensional performance index into an observation vector x;

[0137] In the process of implementing step S21, the execution time consumption, the number of returned rows, the total bytes of the result set, the paging depth, the parameter complexity, the result set sparsity, and the SQL static complexity in the performance index are written into a preset double array in a preset order, thus constituting the observation vector x of this query, i.e., generating a structured double[7] array, i.e., the observation vector x (data packet B).

[0138] It should be noted that the preset order is set by the technical personnel in advance according to the actual situation.

[0139] Step S22: performing vector transposition processing based on the observation vector and the multidimensional mean vector to obtain a first matrix;

[0140] In the process of implementing step S22, the difference between the observation vector and the multidimensional mean vector is calculated first, and the difference is transposed to obtain the first matrix .

[0141] Step S23: calculating a comprehensive anomaly score based on the covariance matrix, the difference between the observation vector and the multidimensional mean vector, and the first matrix.

[0142] In the process of implementing step S23, the inverse matrix of the covariance matrix of the observation vector and the multidimensional mean vector is calculated ; the square root of the product of the first matrix and the inverse matrix is obtained, thus obtaining the comprehensive anomaly score, as shown in formula (2).

[0143] Formula (2):

[0144]

[0145] It should be noted that the comprehensive anomaly score refers to the distance between the current observation vector and the distribution center of the historical data.

[0146] Step S106: determining whether the comprehensive anomaly score is greater than a preset threshold value, if yes, executing step S107, and if no or equal, it is determined that there is no anomaly.

[0147] In the implementation of step S106, the comprehensive abnormal score is compared with a preset threshold. If the comprehensive abnormal score is greater than the preset threshold, it indicates that there is an overall abnormality, and step S107 is performed. If the comprehensive abnormal score is less than or equal to the preset threshold, it indicates that there is no abnormality.

[0148] It should be noted that the preset threshold is preset, and can also be based on the 99% percentile of the chi-square distribution of 7 degrees of freedom, which is 18.475.

[0149] Optionally, before step S107 is performed, the following steps are further included.

[0150] Step S31: For each dimension of performance indicators in the multi-dimensional performance indicators, historical indicator data corresponding to the performance indicator in the historical time is obtained.

[0151] In the implementation of step S31, for each performance indicator, the same historical indicator data as the performance indicator in the historical time is queried from the database.

[0152] Step S32: The historical mean and the historical standard deviation are calculated based on the historical indicator data.

[0153] In the implementation of step S32, the average value of the historical indicator data is calculated to obtain the historical mean. Then, the covariance matrix is obtained from the preset baseline model corresponding to the historical indicator data, and the square root of the diagonal elements of the covariance matrix is taken as the historical standard deviation.

[0154] Step S33: A first value is calculated based on the performance indicator data and the historical mean.

[0155] Step S34: The ratio of the first value to the historical standard deviation is taken as the independent abnormal score of the performance indicator of the dimension.

[0156] In the implementation of steps S33 and S34, first, a first value is calculated based on the performance indicator data and the historical mean. Then, the ratio of the first value to the historical standard deviation is taken as the independent abnormal score, as shown in formula (3); thereby obtaining the independent abnormal score of each dimension.

[0157] Formula (3):

[0158] Z=(current performance indicator-historical mean) / historical standard deviation

[0159] The present application measures how many "standard deviations" the current value deviates from its historical mean by the above method. Generally, if the absolute value of Z exceeds a preset score, it is determined that the data of its dimension is abnormal.

[0160] It should be noted that the preset score is preset according to actual experience or experiment, and can be set to 2 or 3.

[0161] The application provides a standardized, unitless score, which is easy to compare across different indicators, and the corresponding independent anomaly score can be quickly calculated in the above manner.

[0162] In addition to the implementation manners of the step S33 and the step S34, the application further shows other implementation manners, after the step S32 is performed, further comprising:

[0163] The preset constructed scoring model is called to evaluate based on the historical standard deviation, the performance indicator and the historical mean value, to obtain the independent anomaly score corresponding to the performance indicator.

[0164] The scoring model is obtained by training based on a historical sample set.

[0165] Specifically, the historical standard deviation, the performance indicator and the historical mean value, and the corresponding anomaly score are taken as a training set to train an evaluation model capable of accurately evaluating the historical standard deviation, the performance indicator and the historical mean value.

[0166] It should be noted that in the process of implementing the step S106, there are other implementation manners.

[0167] In the first implementation manner, for each dimension, historical indicator data corresponding to the performance indicator in a historical time is obtained.

[0168] Then, the historical median corresponding to the dimension is calculated based on the historical indicator data.

[0169] Then, the historical median and the median absolute deviation MAD of the performance indicator data of the dimension are calculated, and the independent anomaly score is calculated based on the performance indicator data of the dimension, the historical median and the median absolute deviation, as shown in formula (4).

[0170] Formula (4):

[0171] Z = a * (performance indicator data - historical median) / MAD

[0172] Wherein, a is a preset coefficient, which is set according to experience or experiment, and can be generally set as 0.6745.

[0173] The application, since the median and the MAD are not sensitive to outliers in the data, the method is more stable and reliable when the historical data contains extreme abnormal values.

[0174] In the second implementation manner, first, for each dimension, historical indicator data corresponding to the performance indicator in a historical time is obtained.

[0175] determine a quartile range and an abnormal boundary based on the historical index data;

[0176] calculate a difference between the performance index data and the abnormal boundary of the dimension to obtain a first difference value; and take a ratio of the first difference value and the quartile range as an independent abnormal score.

[0177] It should be noted that the process of determining the quartile range and the abnormal boundary based on the historical index data includes:

[0178] First, the historical index data is arranged in ascending order and divided into four equal parts. The values at the three partition points are called quartiles. The values at the partition points are obtained and taken as the first value Q1, the second value Q2 and the third value Q3. The first value Q1 is less than the second value Q2, and the second value Q2 is less than the third value Q3.

[0179] Next, the difference between the third value Q3 and the first value Q1 is calculated, and the difference is taken as the quartile range IQR.

[0180] Finally, the lower boundary of the abnormal boundary is calculated based on the first value Q1 and the quartile range IQR, as shown in formula (5); and the upper boundary of the abnormal boundary is calculated based on the first value Q3 and the quartile range IQR, as shown in formula (6).

[0181] Formula (5):

[0182] Lower boundary = Q1 + b1*IQR,

[0183] Formula (6):

[0184] Upper boundary = Q3 + b2*IQR

[0185] Wherein, b1 and b2 are set according to experience or experiment, which can be the same or different.

[0186] For example, b1 and b2 can be set to 1.5.

[0187] It should be noted that the independent abnormal score here can be defined as the degree of the current value exceeding the boundary.

[0188] In the third implementation mode, first, for each dimension, the historical index data corresponding to the performance index in the historical time is obtained;

[0189] The performance index data is searched in the historical data to obtain the percentile, which is taken as the independent abnormal score.

[0190] For example, a query takes 120 ms, and its performance is in the 99.5 percentile of the historical time consumption data, then its anomaly score can be 99.5.

[0191] Step S107: generating alarm data.

[0192] The alarm data includes alarm information and an anomaly contribution list.

[0193] It should be noted that the process of implementing step S107 includes the following steps.

[0194] Step S41: sorting the performance indicators according to the independent anomaly scores of each dimension, to obtain an anomaly contribution list.

[0195] In the process of implementing step S41, the performance indicators are sorted according to the absolute values of the independent anomaly scores of each dimension from large to small, to obtain an anomaly contribution list composed of the performance indicators and the independent anomaly scores.

[0196] Step S42: combining the comprehensive anomaly score and the alarm type of the preset overall anomaly to obtain alarm information.

[0197] In the process of implementing step S42, the comprehensive anomaly score and the alarm type of the preset overall anomaly are combined to construct a composite alarm information.

[0198] Step S43: collecting alarm data based on the anomaly contribution list and the alarm information.

[0199] In the embodiment of the application, a deep-embedded ORM framework is used to establish a dedicated index data for each SQL query, which includes multi-dimensional performance indicators such as time consumption, return row number, result set byte size, parameter complexity, paging depth, result set sparsity, and SQL static complexity. On this basis, overall and comprehensive anomaly judgment is performed on the index data of the multi-dimensional performance indicators to handle the internal correlation between the dimensions, and to identify overall anomalies hidden in complex relationships and difficult to be found by traditional methods from the perspective of multi-dimensional space. Further, the independent anomaly score of each dimension indicator is calculated to automatically locate and quantify which dimension or dimensions cause the current overall anomaly, so as to directly point out the "lesion" in the alarm and provide accurate root cause clues for developers to avoid potential memory overflow and system avalanche risks.

[0200] Optionally, based on the method shown in the embodiment of the application, the following steps are further included.

[0201] Step S51: Obtain historical time series data corresponding to each performance indicator of each dimension under each query statement ID within a preset time period;

[0202] In the process of implementing step S51, for each performance indicator data of each query statement ID, a preset time scheduling task is performed to pull the occurrence time and query duration of each performance indicator of the query statement ID within a preset time period (such as the past 6 hours) from the historical data cache, and the occurrence time and query duration are taken as historical time series data, that is, the historical time series data includes the occurrence time and query duration of each query within the preset time period.

[0203] Step S52: Linearly process the historical time series for each performance indicator of each dimension to determine the corresponding slope and magnitude.

[0204] In the process of implementing step S52, a scatter plot is drawn on a two-dimensional coordinate system with the occurrence time in the historical time series as the X-axis and the query duration as the Y-axis, and a straight line representing the overall trend is drawn in the scatter plot. This straight line is called a "regression line" or a "trend line". A preset application mathematical model is called to perform a linear regression analysis on the straight line to determine the corresponding slope and magnitude.

[0205] It should be noted that the preset application mathematical model is obtained by training different regression lines and corresponding slopes and magnitudes in advance.

[0206] The slope (Slope) represents the rate of change of the performance indicator over time, which can be a positive slope or a negative slope.

[0207] A positive slope indicates that the indicator is increasing (for example, the query duration is getting longer, which is a deterioration trend); a negative slope indicates that the indicator is decreasing (for example, the query duration is getting shorter, which is an optimization trend).

[0208] The unit of the slope is indicator unit / time unit (for example: ms / s).

[0209] The magnitude (Magnitude) refers to the absolute value of the slope, which represents the business meaning.

[0210] For example, a slope of 0.001 ms / s (i.e. 3.6 ms / hour) and a slope of 0.1 ms / s (i.e. 360 ms / hour) are both positive slopes, but the magnitude of the latter is much larger than that of the former, indicating that the performance deterioration speed is faster and the business impact is more serious.

[0211] Step S53: Determine whether to generate a trend warning for the performance indicator of the dimension based on the slope and magnitude.

[0212] In the process of implementing step S53, it is judged whether the slope is positive. If the slope of the regression line is statistically significantly positive and less than a first threshold, it is judged whether the amplitude is greater than a preset amplitude. If yes, it is determined that the index has a continuous deterioration trend, and a trend warning of the dimension performance index is generated. Otherwise, it is indicated that the performance index of the dimension does not have a deterioration trend.

[0213] It should be noted that the preset amplitude refers to the amplitude corresponding to the speed of deterioration reaching a degree worthy of attention.

[0214] Optionally, it is not enough to see only an upwardly inclined line, because random fluctuations in the data itself can happen to form an upward trend, so it is necessary to determine that the trend is truly present, rather than "pure coincidence". Therefore, the index of the probability P-value of pure coincidence of the observed trend is used for judgment. Specifically, a preset analysis model is called to analyze the historical time series to determine the corresponding P-value. If it is determined that the P-value is less than a first value, it is indicated that the trend of the drawn regression line is truly present.

[0215] The first value is set by the technical personnel in advance according to the experimental expression, and can be set to 0.05.

[0216] In the embodiment of the application, the time series data of each SQL index is continuously analyzed for a trend (such as the slope of linear regression analysis), so that potential risks of "slow deterioration" (such as continuous slow growth of memory occupation) are discovered in advance before any index breaks through a single execution threshold, a "predictive alarm" is issued, and faults are eliminated in the embryonic state.

[0217] Based on the abnormality detection method shown in the above embodiment of the application, correspondingly, the application also shows a structural schematic diagram of an abnormality detection device, as shown in Figure 2 The device comprises:

[0218] The acquisition unit 201 is configured to acquire a business code for executing a query on a database, wherein the business code comprises a query statement ID.

[0219] The collection unit 202 is configured to collect a data packet obtained by querying the database based on the business code.

[0220] The processing unit 203 is configured to process the data packet to obtain index data of a multi-dimensional performance index.

[0221] The determining unit 204 is configured to determine a corresponding multi-dimensional mean vector and covariance matrix from a corresponding preset baseline model according to the query statement ID, wherein the preset baseline model is obtained by processing a historical data set based on the query statement ID.

[0222] The calculating unit 205 is configured to calculate a comprehensive abnormal score based on the multi-dimensional mean vector, the covariance matrix, and the index data of the multi-dimensional performance indicator.

[0223] The judging unit 206 is configured to generate alarm data if the comprehensive abnormal score is greater than a preset threshold.

[0224] The specific principles and execution processes of each unit in the abnormality detection device disclosed in the embodiments of the present application are the same as the corresponding contents in the abnormality detection method provided in the embodiments of the present application, and can be referred to the corresponding parts in the abnormality detection method disclosed in the embodiments of the present application, which will not be described here again.

[0225] In the embodiments of the present application, a deep-embedded ORM framework is used to establish a dedicated multi-dimensional performance indicator of each SQL query by a non-invasive method, which includes time consumption, return row number, result set byte size, parameter complexity, paging depth, result set sparsity, and SQL static complexity; on this basis, overall and comprehensive abnormality judgment is performed on the index data of the multi-dimensional performance indicator to process the internal correlation between each dimension, and to identify the overall abnormality hidden in the complex relationship from the multi-dimensional space, which is difficult to be found by the traditional method. Further, the independent abnormal score of each dimension indicator is calculated to automatically locate and quantify which dimension or which dimensions cause the overall abnormality, so as to directly point out the "lesion" in the alarm, and to provide accurate root cause clues for the developer to avoid potential memory overflow and system avalanche risks.

[0226] Optionally, based on the abnormality detection device shown in the embodiments of the present application, the judging unit 206 is further configured to:

[0227] Obtain historical time series data corresponding to the performance indicator of each dimension under each query statement ID in a preset time period;

[0228] Perform linear processing on the performance indicator of each dimension based on the historical time series data to determine a corresponding slope and amplitude;

[0229] Determine whether to generate a trend warning of the performance indicator of the dimension based on the slope and amplitude.

[0230] Optionally, based on the abnormality detection device shown in the embodiments of the present application, the processing unit 203 is specifically configured to:

[0231] calculate execution time consumption based on execution time in the data packet;

[0232] determine corresponding return row number based on dimension of data in the data packet;

[0233] calculate corresponding result set total bytes based on field type statistics of the data packet;

[0234] determine corresponding pagination depth based on pagination data in the data packet;

[0235] determine parameter complexity based on parameters in the data packet;

[0236] determine result set sparsity based on return data set in the data packet;

[0237] calculate SQL static complexity based on number of occurrence of preset keyword in SQL text of the data packet and corresponding preset weight;

[0238] combine one or more of the execution time consumption, return row number, result set total bytes, pagination depth, parameter complexity, result set sparsity and SQL static complexity to obtain index data of multi-dimensional performance index.

[0239] Optionally, the determination unit 204 is configured to process the historical data set of the query statement ID to obtain a preset baseline model, and specifically configured to:

[0240] for each query statement ID, obtain historical data set corresponding to all dimension performance indexes in a historical time period from the historical data cache;

[0241] divide the historical data set into different arrays;

[0242] calculate mean vector of all data of performance index of each dimension based on the arrays, and take the mean vector as a multi-dimensional mean vector;

[0243] invoke a preset processing model to process the arrays, and output corresponding covariance matrix;

[0244] compose the multi-dimensional mean vector and the covariance matrix to obtain the preset baseline model corresponding to the query statement ID.

[0245] Optionally, based on the anomaly detection device shown in the above embodiments of the present application, the calculation unit 205 is configured to calculate a comprehensive anomaly score based on the multi-dimensional mean vector, the covariance matrix and the index data of the multi-dimensional performance index, and specifically configured to:

[0246] convert the index data of the multi-dimensional performance index into an observation vector;

[0247] perform vector transposition processing based on the observation vector and the multi-dimensional mean vector to obtain a first matrix;

[0248] calculate a comprehensive anomaly score based on the covariance matrix, a difference between the observation vector and the multi-dimensional mean vector, and the first matrix.

[0249] Optionally, based on the anomaly detection device shown in the above embodiment of the present application, the calculation unit 205 is further configured to:

[0250] for each dimension of the multi-dimensional performance indicator, obtain historical indicator data corresponding to the performance indicator in a historical time;

[0251] calculate a historical mean and a historical standard deviation based on the historical indicator data;

[0252] calculate a first value based on the performance indicator data and the historical mean;

[0253] use a ratio of the first value to the historical standard deviation as an independent anomaly score of the performance indicator of the dimension.

[0254] Optionally, based on the anomaly detection device shown in the above embodiment of the present application, the judgment unit 206 is specifically configured to:

[0255] sort the performance indicators according to the independent anomaly scores of the performance indicators of each dimension to obtain an anomaly contribution degree list;

[0256] combine the comprehensive anomaly score and a preset overall anomaly alarm type to obtain alarm information;

[0257] collect alarm data based on the anomaly contribution degree list and the alarm information.

[0258] The embodiment of the present application provides an electronic device, which includes a processor and a memory, the memory is used to store anomaly detection program code and data, and the processor is used to call the program instructions in the memory to perform the steps shown in the anomaly detection method in the above embodiment.

[0259] The embodiment of the present application provides a storage medium, i.e., a computer readable storage medium, which includes the electronic device provided in the above embodiment of the present application, and the electronic device is used to execute the anomaly detection method disclosed in the embodiment of the present application.

[0260] The various embodiments described in this specification are described in progressive order of complexity, from the simplest embodiment to more complex embodiments. Identify commonalities in the various embodiments so that the disclosure is not redundant. Each embodiment is directed to the differences between that embodiment and the other embodiments. In particular, the system or system embodiments are described more simply because they are substantially similar to the method embodiments. The system or system embodiments are described with reference to the method embodiments. The systems and system embodiments described above are merely illustrative of the principles of this application. Any feature described in relation to one example can be used in relation to another example. The system and system embodiments described above are merely illustrative of the principles of this application. The units described as separate units can or can not be physically separate and the units shown as separate units can or can not be physical units, i.e. can be located at one place or distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments. Those skilled in the art can understand and implement without creative labor.

[0261] Those skilled in the art will further appreciate that the units and algorithm steps of the examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or any combination thereof. To clearly illustrate the interchangeability of hardware and software, the elements of the examples have been described generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the particular application and design constraints imposed on the overall system. Those skilled in the art can implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

[0262] The above description of disclosed embodiments enables one of ordinary skill in the art to make and use the application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles described herein can be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.< / rowcount> < / timestamp>

Claims

1. An anomaly detection method, characterized in that, The method includes: Obtain the business code that executes a query on the database, the business code containing the query statement ID; Collect data packets obtained by querying the database based on the business code; The data packets are processed to obtain multi-dimensional performance metrics. The corresponding multidimensional mean vector and covariance matrix are determined from the corresponding preset baseline model based on the query statement ID, wherein the preset baseline model is obtained by processing the historical dataset of the query statement ID; The comprehensive anomaly score is calculated based on the multidimensional mean vector, covariance matrix, and multidimensional performance index data. If the overall anomaly score is greater than a preset threshold, alarm data is generated.

2. The method according to claim 1, characterized in that, Also includes: Retrieve historical time series data corresponding to the performance metrics of each dimension under each query statement ID within a preset time period; For each performance metric, linear processing is performed based on the historical time series data to determine the corresponding slope and amplitude. Based on the slope and amplitude, determine whether to generate a trend warning for the performance metric of the dimension.

3. The method according to claim 1, characterized in that, The data packets are processed to obtain multi-dimensional performance metrics, including: Calculate the execution time based on the execution time in the data packet; The number of return rows is determined based on the dimensions of the data in the data packet; The total number of bytes in the result set corresponding to the field types of the data packet is calculated. The corresponding pagination depth is determined based on the pagination data in the data packet; Determine the parameter complexity based on the parameters in the data packet; The sparsity of the result set is determined based on the returned dataset in the data packet; The static complexity of SQL is obtained by calculating the number of times a preset keyword appears in the SQL text of the data packet and the corresponding preset weight. The performance metrics data are obtained by combining one or more of the following: execution time, number of returned rows, total bytes of result set, page depth, parameter complexity, result set sparsity, and SQL static complexity.

4. The method according to claim 1, characterized in that, The process of obtaining a preset baseline model by processing the historical dataset based on the query statement ID includes: For each query statement ID, retrieve the historical dataset corresponding to all dimensions of performance metrics within the historical time period from the historical data cache; The historical dataset is divided into different arrays; Calculate the mean vector of all data for each dimension of the performance index based on the array, and use it as a multidimensional mean vector; The array is processed by calling a preset processing model, and the corresponding covariance matrix is ​​output. The multidimensional mean vector and covariance matrix are used to form the preset baseline model corresponding to the query statement ID.

5. The method according to claim 1, characterized in that, The comprehensive anomaly score is calculated based on the multidimensional mean vector, covariance matrix, and multidimensional performance index data, including: The index data of the multi-dimensional performance indicators are converted into observation vectors; Based on the observation vector and the multidimensional mean vector, a vector transpose is performed to obtain the first matrix; The comprehensive anomaly score is calculated based on the covariance matrix, the difference between the observation vector and the multidimensional mean vector, and the first matrix.

6. The method according to claim 1, characterized in that, Also includes: For each dimension of the multi-dimensional performance metrics, obtain historical metric data corresponding to the performance metrics within a historical period. Calculate the historical mean and historical standard deviation based on the historical indicator data; The first value is calculated based on the performance index data and historical averages; The ratio of the first value to the historical standard deviation is used as the independent outlier score of the performance metric for the dimension.

7. The method according to claim 6, characterized in that, Generate alarm data, including: The performance metrics are sorted according to the independent anomaly scores of each dimension to obtain an anomaly contribution list. The alarm information is obtained by combining the comprehensive anomaly score with the preset alarm type for overall anomalies; Alarm data is obtained by compiling the list of abnormal contributions and alarm information.

8. An anomaly detection device, characterized in that, The device includes: The acquisition unit is used to acquire the business code for executing a query on the database, wherein the business code contains a query statement ID; The acquisition unit is used to acquire data packets obtained by querying the database based on the business code; The processing unit is used to process the data packet to obtain multi-dimensional performance index data. The determining unit is used to determine the corresponding multidimensional mean vector and covariance matrix from the corresponding preset baseline model based on the query statement ID, wherein the preset baseline model is obtained by processing the historical dataset of the query statement ID; The calculation unit is used to calculate the comprehensive anomaly score based on the multidimensional mean vector, covariance matrix, and multidimensional performance index data. The judgment unit is used to generate alarm data if the comprehensive anomaly score is greater than a preset threshold.

9. An electronic device, characterized in that, The electronic device includes a processor and a memory, the memory being used to store program code and data for data generation, and the processor being used to call program instructions in the memory to execute the anomaly detection method as described in any one of claims 1-7.

10. A storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to perform the anomaly detection method as described in any one of claims 1-7.

Images