Abnormal event root cause positioning method and device, electronic equipment and storage medium

Abstract

The invention provides an abnormal event root cause positioning method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring time sequence monitoring data of a target business index; performing anomaly detection based on the time sequence monitoring data to determine a time window of an abnormal event; obtaining multi-dimensional business feature data corresponding to the time window; performing causal analysis on the multi-dimensional business feature data to screen a candidate dimension subset having potential causal association with the abnormal event from a plurality of dimensions; performing contribution degree analysis on dimensions in the candidate dimension subset to quantify contribution values of the dimensions to the abnormal event of the target business index in the time window; and determining a core root cause dimension causing the abnormal event according to the contribution value. Therefore, the root cause positioning efficiency and the result reliability are improved.

Description

Technical Field

[0001] This application relates to the field of intelligent operation and maintenance and business monitoring technology, and in particular to a method, device, electronic device and storage medium for locating the root cause of abnormal events. Background Technology

[0002] With the rapid development of internet businesses, core operations such as membership subscriptions and online transactions on various platforms are characterized by high concurrency, multi-dimensionality, and volatility sensitivity. Ensuring the stability of these critical business metrics is crucial; any abnormal fluctuations, if not promptly addressed by identifying the root cause, could lead to revenue losses and a decline in user experience. Therefore, real-time monitoring of business metrics and rapid, accurate identification of the root cause when anomalies occur have become core challenges in the field of Artificial Intelligence for IT Operations (AIOps).

[0003] Currently, a common practice is to use time-series databases (such as Prometheus) combined with static thresholds for monitoring. Specifically, the system collects and stores time-series data of business metrics at fixed time granularities. Based on historical experience, operations personnel set a fixed numerical range as an alarm threshold for key metrics. When the real-time collected metric data consistently exceeds this threshold range, the monitoring system triggers an alarm. After an alarm is generated, operations or data analysts typically need to manually log into the relevant system to query various dimensions of data related to that time period (such as user region, device type, payment channel, etc.). Through manual comparison, filtering, and elimination, they gradually infer and locate the main dimensions that may be causing the anomaly.

[0004] However, this existing technical solution, due to its slow positioning process and high dependence on human experience, is difficult to meet the requirements of modern large-scale Internet services for real-time, accuracy and automation of monitoring systems. Summary of the Invention

[0005] The purpose of this application is to provide a method, apparatus, electronic device, and storage medium for locating the root cause of abnormal events, thereby solving the problems of slow root cause location processes and high dependence on human experience in existing technologies, which make it difficult to meet the real-time, accuracy, and automation requirements of modern large-scale Internet services for monitoring systems. The specific technical solution is as follows: Firstly, this application provides a method for root cause localization of abnormal events, including: Obtain time-series monitoring data of target business metrics; Anomaly detection is performed based on the time-series monitoring data to determine the time window in which anomalies occur. Obtain multi-dimensional business feature data corresponding to the time window; Causal analysis is performed on the multi-dimensional business feature data to select a subset of candidate dimensions that have potential causal relationships with the abnormal event from multiple dimensions; Contribution analysis is performed on the dimensions in the candidate dimension subset to quantify the contribution of each dimension to the occurrence of the abnormal event of the target business indicator within the time window; Based on the contribution value, the core root cause dimension leading to the abnormal event is determined.

[0006] In one possible implementation, the anomaly detection based on the time-series monitoring data to determine the time window in which the anomaly event occurred includes: The time-series monitoring data is processed using a fusion prediction model to generate dynamic anomaly detection thresholds; When the actual value of the target business indicator continuously deviates from the anomaly determination threshold at a preset number of consecutive monitoring points, an anomaly event is determined to have occurred. The time windows corresponding to the preset number of monitoring points are determined as the time windows in which the abnormal event occurs.

[0007] In one possible implementation, the step of processing the time-series monitoring data using a fusion prediction model to generate dynamic anomaly detection thresholds includes: The macroeconomic change components of the target business indicator are fitted using a trend cycle prediction sub-model. By using a residual learning sub-model, nonlinear fluctuation learning is performed on the residuals of the macroscopic change components to obtain nonlinear fluctuation data; The macroscopic change component and the nonlinear fluctuation data are weighted and fused to obtain the target predicted value; Extract the change features of the time-series monitoring data, and calculate the anomaly score based on the change features; The anomaly determination threshold is generated based on the target predicted value, the anomaly score, and the preset benchmark fluctuation parameters.

[0008] In one possible implementation, the step of performing causal analysis on the multi-dimensional business feature data to filter out a subset of candidate dimensions that have a potential causal relationship with the abnormal event from multiple dimensions includes: Obtain a predefined business causal graph, which represents the causal dependencies between dimensions as a directed acyclic graph; Multiple analysis objects are selected from the multiple dimensions, wherein each analysis object is a combination of one or more dimensions; For each analysis object, based on the business cause-effect graph, calculate the conditional probability of the abnormal event occurring when the analysis object is intervened; Based on the conditional probability and the probability of the occurrence of the abnormal event without intervention, determine whether there is a causal relationship between the analysis object and the abnormal event; The analysis objects that are determined to have a causal relationship are added to the candidate dimension subset.

[0009] In one possible implementation, selecting multiple analysis objects from the multiple dimensions, wherein each analysis object is a combination of one or more dimensions, includes: Divide multiple dimensions into multiple dimension groups, where each dimension group contains one or more dimensions; For each dimension group, calculate the information gain of the dimension group with respect to the anomalous event; According to the information gain from largest to smallest, the multiple dimensions are grouped and sorted to obtain the dimension grouping sequence; A predetermined number of dimension groups are selected from the beginning of the dimension grouping sequence as target groups, wherein each target group is an analysis object.

[0010] In one possible implementation, the contribution analysis of dimensions in the candidate dimension subset to quantify the contribution of each dimension to the occurrence of the abnormal event of the target business indicator within the time window includes: For each target dimension in the candidate dimension subset, enumerate all possible subsets in the candidate dimension subset that do not contain the target dimension; For each subset, calculate the marginal effect on the anomalous event when the target dimension is added to the subset; Based on all the marginal effects calculated for the target dimension, calculate the contribution of the target dimension to the occurrence of the anomalous event in the target business indicator within the time window.

[0011] In one possible implementation, acquiring time-series monitoring data of the target business metrics includes: Receive real-time transaction data from the business system; The flow data is subjected to dimension completion and real-time aggregation processing to obtain aggregated result data with multiple dimension labels, each dimension label corresponding to one dimension; The aggregated data is synchronized to the time-series database at a predetermined time granularity to form the time-series monitoring data.

[0012] Secondly, this application provides an abnormal event root cause localization device, comprising: The first acquisition module is used to acquire time-series monitoring data of the target business metrics; The detection module is used to perform anomaly detection based on the time-series monitoring data in order to determine the time window in which the abnormal event occurs; The second acquisition module is used to acquire multi-dimensional business feature data corresponding to the time window; The filtering module is used to perform causal analysis on the multi-dimensional business feature data to filter out a subset of candidate dimensions that have potential causal relationships with the abnormal event from multiple dimensions. The quantification module is used to perform contribution analysis on the dimensions in the candidate dimension subset, so as to quantify the contribution value of each dimension to the occurrence of the abnormal event of the target business indicator within the time window. The determination module is used to determine the core root cause dimension that leads to the abnormal event based on the contribution value.

[0013] In one possible implementation, the detection module is specifically used for: The time-series monitoring data is processed using a fusion prediction model to generate dynamic anomaly detection thresholds; When the actual value of the target business indicator continuously deviates from the anomaly determination threshold at a preset number of consecutive monitoring points, an anomaly event is determined to have occurred. The time windows corresponding to the preset number of monitoring points are determined as the time windows in which the abnormal event occurs.

[0014] In one possible implementation, the detection module is further configured to: The macroeconomic change components of the target business indicator are fitted using a trend cycle prediction sub-model. By using a residual learning sub-model, nonlinear fluctuation learning is performed on the residuals of the macroscopic change components to obtain nonlinear fluctuation data; The macroscopic change component and the nonlinear fluctuation data are weighted and fused to obtain the target predicted value; Extract the change features of the time-series monitoring data, and calculate the anomaly score based on the change features; The anomaly determination threshold is generated based on the target predicted value, the anomaly score, and the preset benchmark fluctuation parameters.

[0015] In one possible implementation, the filtering module is specifically used for: Obtain a predefined business causal graph, which represents the causal dependencies between dimensions as a directed acyclic graph; Multiple analysis objects are selected from the multiple dimensions, wherein each analysis object is a combination of one or more dimensions; For each analysis object, based on the business cause-effect graph, calculate the conditional probability of the abnormal event occurring when the analysis object is intervened; Based on the conditional probability and the probability of the occurrence of the abnormal event without intervention, determine whether there is a causal relationship between the analysis object and the abnormal event; The analysis objects that are determined to have a causal relationship are added to the candidate dimension subset.

[0016] In one possible implementation, the filtering module is further configured to: Divide multiple dimensions into multiple dimension groups, where each dimension group contains one or more dimensions; For each dimension group, calculate the information gain of the dimension group with respect to the anomalous event; According to the information gain from largest to smallest, the multiple dimensions are grouped and sorted to obtain the dimension grouping sequence; A predetermined number of dimension groups are selected from the beginning of the dimension grouping sequence as target groups, wherein each target group is an analysis object.

[0017] In one possible implementation, the quantization module is specifically used for: For each target dimension in the candidate dimension subset, enumerate all possible subsets in the candidate dimension subset that do not contain the target dimension; For each subset, calculate the marginal effect on the anomalous event when the target dimension is added to the subset; Based on all the marginal effects calculated for the target dimension, calculate the contribution of the target dimension to the occurrence of the anomalous event in the target business indicator within the time window.

[0018] In one possible implementation, the first acquisition module is specifically used for: Receive real-time transaction data from the business system; The flow data is subjected to dimension completion and real-time aggregation processing to obtain aggregated result data with multiple dimension labels, each dimension label corresponding to one dimension; The aggregated data is synchronized to the time-series database at a predetermined time granularity to form the time-series monitoring data.

[0019] Thirdly, an electronic device is provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; When a processor executes a program stored in memory, it implements any of the steps described in the first aspect.

[0020] Fourthly, a computer-readable storage medium is provided, characterized in that the computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of any of the methods described in the first aspect.

[0021] Fifthly, a computer program product containing instructions is provided, which, when run on a computer, causes the computer to execute any of the above-described methods for locating the root cause of an abnormal event.

[0022] Beneficial effects of the embodiments in this application: This application provides a method, apparatus, electronic device, and storage medium for root cause localization of abnormal events. In this embodiment, firstly, intelligent analysis is performed on the time-series monitoring data of the target business indicators to accurately determine the abnormal event and its occurrence time window, overcoming the shortcomings of traditional static threshold alarms, such as poor adaptability and high false alarm rates. Subsequently, multi-dimensional business feature data associated with this time window is acquired, and a subset of candidate dimensions with potential causal relationships to the abnormal event is selected from numerous dimensions through causal analysis, achieving automatic identification of key influencing dimensions. Based on this, contribution analysis is further performed on each dimension in the candidate dimension subset, quantifying the specific contribution value of each dimension to the abnormal event, thereby identifying the main influencing dimensions in an objective and quantitative manner, eliminating the subjectivity and uncertainty of manual analysis. Finally, the system automatically determines the core root cause dimension leading to the abnormal event based on the contribution value, completing a fully automated closed loop from anomaly detection to root cause localization. This solution transforms the traditional investigation process, which relies on manual experience and gradual trial-and-error, into a fast, accurate, and automatic root cause localization process based on data and algorithms, significantly improving the efficiency and reliability of root cause localization results.

[0023] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0024] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.

[0027] Figure 1 A flowchart of an abnormal event root cause localization method provided in an embodiment of this application; Figure 2 A flowchart of another abnormal event root cause localization method provided in the embodiments of this application; Figure 3 A flowchart of yet another method for locating the root cause of an abnormal event provided in an embodiment of this application; Figure 4 This application provides an architectural diagram of an abnormal event root cause localization system. Figure 5 A flowchart illustrating an anomaly localization and root cause analysis method provided in this application embodiment; Figure 6 This is a schematic diagram of the structure of an abnormal event root cause localization device provided in an embodiment of this application; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0029] The following disclosure provides numerous different embodiments or examples for implementing various structures of the invention. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of the invention. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.

[0030] Figure 1This is a flowchart illustrating a method for locating the root cause of an abnormal event, provided in an embodiment of this application. This method can be applied to one or more electronic devices such as smartphones, laptops, desktop computers, portable computers, and servers. Furthermore, the executing entity of this method can be hardware or software. When the executing entity is hardware, it can be one or more of the aforementioned electronic devices. For example, a single electronic device can execute this method, or multiple electronic devices can cooperate with each other to execute this method. When the executing entity is software, this method can be implemented as multiple software programs or software modules, or as a single software program or software module. No specific limitations are imposed here.

[0031] like Figure 1 As shown, the method specifically includes: S101. Obtain time-series monitoring data of target business metrics.

[0032] Time-series monitoring data refers to an ordered sequence of values ​​that reflect the key operational status indicators of a business system, which are sampled and recorded at fixed time intervals.

[0033] Target business metrics: These refer to the core business metrics being monitored, such as the total transaction amount or number of orders per minute for membership subscription services.

[0034] In this embodiment, a custom data collector or adapter is deployed to consume streaming events from the business system's message queue (such as RocketMQ) in real time. Subsequently, a stream processing engine (such as Apache Flink) is used to perform real-time parsing, dimensional correlation (such as associating with user information or product information), and aggregation calculations (such as counting by minutes) on these events. The aggregation results are then synchronously written to a high-performance online analytical processing database (such as StarRocks) and a time-series database (such as Prometheus). The time-series monitoring data is then obtained from the time-series database on demand.

[0035] S102. Based on the time-series monitoring data, perform anomaly detection to determine the time window in which the abnormal event occurs.

[0036] Anomaly detection refers to the process of identifying data points in time-series data that deviate from their expected normal patterns or regularities using algorithms.

[0037] Abnormal events: refer to confirmed, unexpected fluctuations in business indicators.

[0038] Time window: refers to a specific and continuous time range during which the abnormal event lasts.

[0039] In this embodiment, a predictive model can be used to analyze time-series monitoring data to generate anomaly detection thresholds that adapt to dynamic data changes. Specifically, the modeling results of macro-trends and cyclical patterns of business indicators, along with the learning results of micro-fluctuation patterns in data residuals, can be integrated to form a comprehensive predicted value. Based on this, the boundary of the detection threshold is dynamically determined by combining the fluctuation characteristics of the data itself (such as rate of change, statistical distribution, etc.). When the actual observed value of the target business indicator continuously deviates from (e.g., above or below) the anomaly detection threshold at multiple consecutive monitoring time points, an anomaly event is determined to have occurred, and the time period covered by these multiple consecutive monitoring points is defined as the time window for the anomaly event.

[0040] S103. Obtain multi-dimensional business feature data corresponding to the time window.

[0041] Multi-dimensional business characteristic data: refers to detailed or aggregated statistical data that are associated with business indicators and have multiple dimension labels within a specific time period.

[0042] In this embodiment, after the time window of the abnormal event is determined, a query is executed from an online analytical processing database (such as StarRocks). The query conditions are time ranges matching the time window, and the query content is the result of grouping and aggregating multiple preset dimensions (such as the user's province, client type, payment channel, membership level, purchase entry, etc.), for example, the number of orders and the amount under each dimension combination. These aggregated results with multiple dimension labels constitute multi-dimensional business feature data, providing a data foundation for subsequent root cause drill-down analysis.

[0043] S104. Perform causal analysis on the multi-dimensional business feature data to select a subset of candidate dimensions that have potential causal relationships with the abnormal event from multiple dimensions.

[0044] Causal analysis: refers to the analytical method that infers whether there is a causal relationship between variables based on the principles of statistical intervention, rather than just a correlation relationship.

[0045] Candidate dimension subset: refers to a set of one or more dimensions that are considered to have a possible causal relationship with the anomalous event after preliminary causal inference.

[0046] In this embodiment, firstly, based on business understanding or data characteristics, the analysis object to be examined is determined. This analysis object can be a single dimension or a combination of multiple dimensions. Then, the impact of each analysis object on the abnormal event is evaluated to determine whether it is a potential cause. Finally, those analysis objects determined to have significant causal impact are aggregated to form a subset of candidate dimensions. Through this step, the system can reduce the number of dimensions requiring in-depth quantitative analysis, laying the foundation for quickly locating the core root cause.

[0047] S105. Perform contribution analysis on the dimensions in the candidate dimension subset to quantify the contribution value of each dimension to the occurrence of the abnormal event of the target business indicator within the time window.

[0048] Contribution analysis: refers to the process of assessing the magnitude of the influence of multiple different factors on a common outcome.

[0049] Contribution value: refers to the specific numerical value that quantifies the magnitude of a factor's influence on the outcome.

[0050] In this embodiment, for a dimension to be evaluated, it is envisioned being added to various combinations (subsets) composed of other different dimensions. The change in the indicator used to measure abnormal events (such as order loss) before and after its addition is calculated. This change reflects the marginal contribution of the dimension under that specific combination. Then, through a reasonable allocation rule, the marginal contributions under all possible combinations are comprehensively calculated to finally obtain the overall contribution value of the dimension. This process ensures the fairness and systematic nature of the contribution allocation, avoiding the bias that may be caused by simple weighted averaging. Through this step, the impact of each dimension on abnormal events can be characterized by specific numerical values, providing an objective and quantitative basis for finally determining the core root cause.

[0051] S106. Based on the contribution value, determine the core root cause dimension that led to the abnormal event.

[0052] Core root cause dimension: refers to the business dimension that is identified as playing the most significant role in the occurrence of the abnormal event.

[0053] In this embodiment, all calculated dimensional contribution values ​​are normalized to obtain the contribution percentage of each dimension. By sorting or setting a threshold, one or more dimensions with the largest contribution (e.g., dimensions with a contribution exceeding 50%) are identified as the core root cause dimensions leading to the abnormal event. Finally, the system can automatically generate a diagnostic report containing the core root cause dimension, its scope of impact, and recommended measures, and push it to relevant personnel.

[0054] The technical solution provided in this application first performs intelligent analysis on the time-series monitoring data of target business indicators to accurately determine abnormal events and their occurrence time windows, overcoming the shortcomings of traditional static threshold alarms, such as poor adaptability and high false alarm rates. Then, it acquires multi-dimensional business feature data associated with this time window and uses causal analysis to filter out a subset of candidate dimensions with potential causal relationships to the abnormal event, achieving automatic identification of key influencing dimensions. Based on this, it further performs contribution analysis on each dimension in the candidate dimension subset, quantifying the specific contribution value of each dimension to the abnormal event, thereby identifying the main influencing dimensions in an objective and quantitative manner, eliminating the subjectivity and uncertainty of manual analysis. Finally, the system automatically determines the core root cause dimension leading to the abnormal event based on the contribution value, completing a fully automated closed loop from anomaly detection to root cause localization. This solution transforms the traditional investigation process, which relies on manual experience and step-by-step trial and error, into a fast, accurate, and automatic root cause localization process based on data and algorithms, significantly improving the efficiency and reliability of root cause localization results.

[0055] In one embodiment, S101 may specifically include the following steps: receiving transaction data from the business system in real time; performing dimension completion and real-time aggregation processing on the transaction data to obtain aggregated result data with multiple dimension labels, each dimension label corresponding to a dimension; synchronizing the aggregated result data to a time-series database at a predetermined time granularity to form the time-series monitoring data.

[0056] Transaction data: refers to the raw data stream continuously generated by the business system during runtime, which records a single business event (such as the creation of an order or a user login). It usually includes timestamps, event types, and several key fields.

[0057] Dimension completion refers to the process of supplementing raw transaction event data with contextual attribute information for classification and analysis, based on business rules or external data sources. For example, supplementing an order transaction with its corresponding attributes such as "user level," "product type," and "payment channel."

[0058] Real-time aggregation processing refers to the process of performing statistical calculations (such as counting and summing) on ​​continuously input streaming data according to specified time windows and dimensions, and outputting the results in real time.

[0059] Time series database: refers to a database system specifically optimized for efficient storage and retrieval of time series data (i.e., data points arranged in chronological order).

[0060] In this embodiment, a high-efficiency data pipeline is constructed from raw event streams to standardized monitoring metrics. First, raw event stream data from the business system is received in real time via a message middleware (such as RocketMQ) or a data acquisition broker. Then, a streaming computing engine (such as Apache Flink) processes each event stream in real time: on one hand, by associating with external data sources such as user profile tables and product information tables, dimensions are supplemented to enrich the analytical attributes of the event stream; on the other hand, according to preset time windows (such as 1 minute) and dimension combinations (such as by province, channel, user level, etc.), the supplemented event streams are aggregated in real time to calculate business metrics (such as order count, transaction amount) under each dimension combination. The processing result is aggregated result data with complete dimension labels. Finally, through a customized data exporter (such as Prometheus Exporter), these aggregated result data are periodically (such as every minute) written to a dedicated time-series database (such as Prometheus). The time-series database efficiently stores these timestamped aggregated values ​​using time as the primary key, thereby forming standardized time-series monitoring data that can be directly used for monitoring and anomaly detection.

[0061] This embodiment transforms raw, incomplete log events into aggregated metrics rich in multidimensional contextual information in real time through real-time stream processing and dimensional completion, and stores them in a database optimized for time series analysis. This solves the problems of low data freshness (offline processing latency) and limited analytical dimensions (lack of context in raw logs) in traditional solutions, providing a low-latency, high-dimensional, and standardized data foundation for upper-level intelligent monitoring and analysis. This enables subsequent anomaly detection and root cause drill-down to be based on the latest detailed aggregated data containing dozens or hundreds of dimensions at the millisecond level, which is a prerequisite for achieving rapid and accurate localization.

[0062] See Figure 2 This is a flowchart illustrating an embodiment of another abnormal event root cause localization method provided in this application. Figure 2 The process shown above Figure 1 Based on the illustrated process, describe how to perform anomaly detection based on the time-series monitoring data to determine the time window in which anomaly events occur. For example... Figure 2 As shown, the process may include the following steps: S201. The time-series monitoring data is processed using a fusion prediction model to generate dynamic anomaly detection thresholds. S202. When the actual value of the target business indicator continuously deviates from the anomaly determination threshold at a continuously preset number of monitoring points, an anomaly event is determined to have occurred. S203. The time windows corresponding to the preset number of monitoring points are determined as the time windows for the occurrence of the abnormal event.

[0063] For ease of understanding, the following provides a unified explanation of S201-203: Fusion prediction model: refers to a composite model that combines the outputs of multiple prediction methods or sub-models to obtain more robust and accurate prediction results than a single model.

[0064] Dynamic anomaly detection threshold: refers to the alarm boundary that can be adaptively adjusted according to the real-time fluctuation characteristics, trend changes and potential anomaly patterns of the data.

[0065] Continuous deviation: refers to the actual observed value being located on the same side of the anomaly judgment threshold (such as both above or both below) and exceeding the threshold at a series of consecutive time points.

[0066] Time window: refers to the range defined by a continuous time interval.

[0067] In this embodiment, a fusion prediction model is first constructed or employed. This model can simultaneously capture the macroscopic deterministic patterns (such as trends and cycles) and microscopic nonlinear fluctuations of business indicators. Through processing time-series data, the model generates a prediction interval that dynamically changes with normal business fluctuations as an anomaly detection threshold. Simultaneously, to enhance sensitivity to sudden anomaly patterns, the characteristics of the time-series data (such as the rate of change) can be further analyzed to calculate an anomaly score, and the threshold tolerance can be adjusted accordingly. At each monitoring point, the system compares the real-time collected actual value of the indicator with the corresponding dynamic threshold. Only when the actual value continuously deviates from (e.g., exceeds) the threshold at multiple consecutive (e.g., three) monitoring points does the system confirm a valid anomaly event and formally define this continuous monitoring period (e.g., three minutes) as the time window for the occurrence of this anomaly event.

[0068] Figure 2 The process described firstly, by learning to adapt to normal business fluctuations through model learning, it significantly reduces false alarms caused by routine activities such as promotions and trending topics (solving the problem of high false alarm rates). Secondly, by confirming anomalies through the "continuous deviation" condition, it eliminates single-point noise interference and improves the reliability of anomaly detection (solving the problem of noise interference). Finally, the precise time window output provides a unique spatiotemporal anchor point for subsequent data acquisition and root cause analysis, allowing subsequent analysis to focus and greatly improving analysis efficiency and accuracy (solving the problem of missing analysis context). Therefore, the overall anomaly detection process achieves high accuracy, low false alarm rates, and traceability, laying a reliable foundation for subsequent automated root cause localization.

[0069] In one embodiment, S201 may specifically include the following steps: fitting the macro-level change component of the target business indicator using a trend cycle prediction sub-model; performing nonlinear fluctuation learning on the residual of the macro-level change component using a residual learning sub-model to obtain nonlinear fluctuation data; weighting and fusing the macro-level change component and the nonlinear fluctuation data to obtain a target predicted value; extracting the change characteristics of the time-series monitoring data and calculating anomaly scores based on the change characteristics; and generating the anomaly judgment threshold according to the target predicted value, the anomaly score, and preset benchmark fluctuation parameters.

[0070] Trend and cycle prediction sub-model: refers to an algorithm model specifically designed to identify and fit long-term trends, periodicity, and holiday effects in time series data. Its output can be represented as macroeconomic change components.

[0071] Macroeconomic change component: This refers to the predictive part composed of deterministic factors such as the long-term trend g(t), the periodic component s(t), and the holiday effect h(t), which can be expressed as y_prophet=g(t)+s(t)+h(t)+ t, where t represents the error term.

[0072] Residual learning sub-model: refers to an algorithmic model used to further analyze the remaining part (i.e., residuals) after the main model's prediction. It is particularly good at capturing complex, non-linear short-term dependencies in the data.

[0073] Nonlinear fluctuation data: refers to data obtained from residual y_real through a residual learning sub-model. The complex fluctuation patterns extracted from y_prophet that cannot be explained by macroscopic models can be learned, for example, by a bidirectional long short-term memory network on a sequence containing the past 180 sliding windows.

[0074] Change characteristics: These are measures derived from the original time series data to describe the dynamic characteristics of the data, such as rate of change (first-order difference), acceleration (second-order difference), variance within the sliding window, etc.

[0075] Anomaly score: refers to a numerical value that quantifies the degree to which the current data point or data segment is "out of the ordinary" relative to the historical normal pattern. It can be calculated by a multi-dimensional feature vector constructed based on the change features and by an outlier detection algorithm such as an isolated tree. It is denoted as ScoreIF.

[0076] Benchmark fluctuation parameter: refers to the reference value used to measure the normal fluctuation range of the indicator, such as the standard deviation σ obtained based on historical prediction error statistics, and can be adjusted by the coefficient k.

[0077] In this embodiment, the fusion prediction model is implemented to accurately characterize business indicators through hierarchical modeling and feature fusion. First, a trend cycle prediction sub-model (e.g., Prophet) calculates the macro-level change component y_prophet to capture the interpretable long-term trends, periodicity, and holiday effects in the business indicators. Next, the residual between the actual observed values ​​y_real and y_prophet is input into a residual learning sub-model (e.g., LSTM (Long Short-Term Memory)). This model learns and outputs data characterizing micro-level nonlinear fluctuations by analyzing the residual sequence over a past period (e.g., 180 sliding windows). Subsequently, the macro-level change component y_prophet is dynamically weighted and fused with the learned nonlinear fluctuation data, for example, by calculating the final target predicted value y^t as y^t = αy_prophet + βy_lstm, where α and β are weighting coefficients. Simultaneously, change features such as rate of change, acceleration, and variance are extracted from the original time-series monitoring data. A multi-dimensional feature vector is constructed based on these features and input into an outlier detection algorithm (e.g., IsolationForest) to calculate an anomaly score, ScoreIF. Finally, when generating a dynamic anomaly threshold T, the target predicted value y^t, the baseline fluctuation parameter k·σ reflecting the historical normal fluctuation range, and the anomaly score ScoreIF are used for calculation. Specifically, the formula T = y^t ± k·σ·(1+ScoreIF) can be used to determine the upper and lower boundaries of the threshold. This formula allows the threshold to be positioned based on the predicted value, its basic width to be determined based on historical fluctuations, and to be adaptively adjusted according to the degree of anomaly in the current data pattern: when ScoreIF is high, the threshold boundary is automatically widened to more cautiously handle possible "new normal fluctuations"; when ScoreIF is low, a relatively tighter threshold is used to improve detection sensitivity.

[0078] This embodiment employs a three-layer structure—"macro-trend cycle fitting, micro-residual sequence learning, and data pattern outlier evaluation"—to achieve comprehensive modeling of business indicator changes, from deterministic patterns to random fluctuations and then to anomalies. Ultimately, by fusing predicted values ​​with an adaptive anomaly score threshold generation formula, the anomaly detection system can intelligently distinguish between normal complex fluctuations and genuine anomaly deviations. This significantly reduces false alarm rates caused by normal business outbreaks or new patterns while maintaining a high anomaly recall rate, providing high-confidence anomaly events and precise time windows for subsequent root cause analysis.

[0079] See Figure 3 This is a flowchart illustrating another embodiment of the abnormal event root cause localization method provided in this application. Figure 3 The process shown above Figure 1Based on the illustrated process, this paper describes how to perform causal analysis on the multi-dimensional business feature data to filter out a subset of candidate dimensions that have potential causal relationships with the abnormal event from multiple dimensions. For example... Figure 3 As shown, the process may include the following steps: S301. Obtain a predefined business causal graph, wherein the business causal graph is represented by a directed acyclic graph to represent the causal dependencies between dimensions; S302. Select multiple analysis objects from the multiple dimensions, wherein each analysis object is a combination of one dimension or multiple dimensions; S303. For each analysis object, based on the business cause-effect graph, calculate the conditional probability of the abnormal event occurring when the analysis object is intervened; S304. Based on the conditional probability and the probability of the occurrence of the abnormal event without intervention, determine whether there is a causal relationship between the analysis object and the abnormal event; S305. Add the analysis objects that have been determined to have a causal relationship to the candidate dimension subset.

[0080] For ease of understanding, S301-S305 are explained uniformly below: Business causal graph: refers to a graphical model that represents the hypothetical or known causal directions and dependencies between different dimensions (variables) in a business domain. It is usually represented by DAG (Directed Acyclic Graph), where nodes represent dimensions and directed edges represent the directions of causal influence.

[0081] Analysis object: refers to the target that is examined separately in the process of causal analysis. It can be a single dimension or a specific combination of multiple dimensions.

[0082] Intervention: In causal inference, it refers to artificially setting or changing the value of a variable in order to observe its effect on other variables (such as abnormal events), thereby simulating the effect of "cause" on "effect".

[0083] Conditional probability: refers to the probability of another event occurring given that certain conditions or events have occurred.

[0084] Causal correlation: refers to the causal relationship between an analytical object (such as a dimension) and an anomalous event, that is, the change of the analytical object is the cause of the anomalous event, rather than just a related phenomenon that occurs along with it.

[0085] In this embodiment, the causal analysis process aims to filter out dimensions with genuine causal effects from numerous relevant dimensions. First, the system loads a pre-defined business causal graph based on business knowledge, which provides a priori structure of causal relationships between dimensions. Then, the system needs to identify a series of analysis objects to be examined; these objects can be a single dimension or a combination of dimensions such as "Android user using Alipay payment." For each analysis object, based on the business causal graph, the system uses intervention computation theory (such as Pearl's do-calculus) in causal inference to calculate the conditional probability of an abnormal event occurring when human intervention (do-operation) is applied to the analysis object, denoted as P(abnormal event | do(analytical object))P(abnormal event | do(analytical object)). Simultaneously, the baseline probability of the abnormal event occurring without any intervention is calculated. By comparing the conditional probability under intervention with the baseline probability, it is determined whether the analysis object has a significant causal impact on the abnormal event. For example, if P(abnormal event|do(analyzed object)) differs significantly from the baseline probability, then the analyzed object is determined to have a causal relationship with the abnormal event. Finally, all analyzed objects that pass the determination are aggregated to form a subset of candidate dimensions.

[0086] Figure 3 The illustrated process, by introducing a pre-defined business cause-effect graph and performing intervention-based causal inference, can identify whether a certain dimension (e.g., "WeChat Pay interface delay") directly caused the order loss, or whether the dimension and the order loss were simultaneously affected by a common cause (e.g., "data center network failure"), thus exhibiting a false correlation. This avoids misjudging dimensions with only correlation as root causes, thereby significantly improving the accuracy and relevance of subsequent root cause localization, allowing the analysis path to directly focus on the true causal chain.

[0087] In one embodiment, S302 may specifically include the following steps: dividing multiple dimensions into multiple dimension groups, wherein each dimension group contains one or more dimensions; calculating the information gain of the dimension group with respect to the abnormal event for each dimension group; sorting the multiple dimension groups in descending order of information gain to obtain a dimension group sequence; selecting a predetermined number of dimension groups from the beginning of the dimension group sequence as target groups, wherein each target group is one of the analysis objects.

[0088] Dimension grouping: refers to a set of basic analytical units formed by dividing or combining multiple original dimensions based on business logic, data correlation, or analytical needs.

[0089] Information gain: refers to the reduction in uncertainty in predicting or determining the occurrence of an anomalous event after knowing information about a certain dimension group. The higher the value, the more important that dimension group is for identifying anomalous events.

[0090] Dimension grouping sequence: refers to the sequential list formed by grouping dimensions in descending order of information gain value.

[0091] In this embodiment, the process of selecting analysis objects aims to intelligently prioritize the combination of dimensions most likely to contain key information for in-depth causal analysis from numerous dimensions. Specifically, firstly, based on business understanding or data characteristics, all original dimensions are initially organized into multiple dimension groups. Each group can be an independent dimension (e.g., "payment channel") or a combination of multiple related dimensions (e.g., "client is Android and version 3.0"). Then, for each dimension group, its information gain regarding the abnormal event is calculated based on historical or current window data. The information gain calculation reflects how much the uncertainty of judging the occurrence of the abnormal event is reduced when the value of the dimension group is known. Subsequently, all dimension groups are sorted from largest to smallest according to their calculated information gain values, forming an ordered dimension group sequence. Finally, a pre-set number of dimension groups are selected from the front of this sequence (i.e., the part with the highest information gain), and these selected groups are established as the "analysis objects" that need to be focused on in subsequent causal analysis. This process simulates the decision-making process of data analysis experts when faced with multidimensional problems, prioritizing the direction with the most information and the most likely to reveal the problem (i.e., the "drill-down starting point").

[0092] This solution achieves intelligent planning of the analysis path by introducing information gain as a quantitative indicator and sorting and filtering dimension groups. It can automatically identify and prioritize the examination of dimension combinations most closely related to anomalous events and that best reduce uncertainty, thus avoiding blind and time-consuming traversal analysis of irrelevant or weakly related dimensions. This significantly improves the efficiency and focus of the causal analysis phase, enabling the system to quickly focus on the most suspicious dimensions, laying an efficient data screening foundation for subsequent accurate causal inference and quantitative attribution.

[0093] In one embodiment, S105 may specifically include the following steps: for each target dimension in the candidate dimension subset, enumerate all possible subsets in the candidate dimension subset that do not contain the target dimension; for each subset, calculate the marginal effect of adding the target dimension to the subset on the abnormal event; based on all the marginal effects calculated for the target dimension, calculate the contribution value of the target dimension to the occurrence of the abnormal event in the target business indicator within the time window.

[0094] Target dimension: refers to the single dimension whose specific contribution is being evaluated during the contribution analysis process.

[0095] Subset: refers to a set of partial dimensions selected from the candidate dimension subset, excluding the current target dimension.

[0096] Marginal effect: refers to the change in a metric used to measure abnormal events (such as order loss) caused by adding a new target dimension to an existing combination (subset) of dimensions. It measures the incremental contribution of the target dimension in a specific "cooperation scenario".

[0097] Contribution value: refers to the final value calculated after considering the marginal effects of the overall objective dimension under all possible "cooperation scenarios," and is used to fairly quantify the overall impact of that dimension on the abnormal event.

[0098] In this embodiment, the contribution analysis is based on the Shapley value concept in cooperative game theory, aiming to fairly allocate the "responsibility" when multiple dimensions jointly cause an anomalous event. The analysis is performed independently for each target dimension in the candidate dimension subset. For a single target dimension, it is first necessary to construct all possible analysis scenarios: that is, to enumerate all subsets in the candidate dimension subset that do not contain the target dimension. These subsets represent all possible situations of the "existing team" that the target dimension might join. Then, for each such subset, a key indicator is calculated: the marginal effect. Specifically, it is to calculate the change in the business indicators used to quantify the anomalous event (e.g., the number of orders damaged within the anomalous time window) after adding the current target dimension to the subset. This change is the marginal contribution of the target dimension in that specific subset scenario. After obtaining the marginal effect of the target dimension in all possible subsets, these marginal effects need to be combined in a fair manner to obtain the final contribution value of the target dimension.

[0099] Specifically, the Shapley value can be calculated using the Shapley formula. Let N represent a subset of candidate dimensions (containing n dimensions), i represent the target dimension whose contribution value is to be calculated, and v(S) represent the measure of outliers that the subset of dimensions S can explain. Then the contribution value Φ_i(v) of the target dimension i can be calculated using the following formula:

[0100] Where, the summation symbol ∑ represents traversing all subsets S that do not contain i. That is, the aforementioned marginal effect, This is a weighting factor that ensures the fairness of the contribution value allocation. This calculation ensures that the allocation of contribution values ​​satisfies the fairness axiom of cooperative game theory.

[0101] This embodiment systematically enumerates all collaborative scenarios and calculates marginal effects, then performs fair aggregation based on cooperative game theory. This achieves precise and unbiased quantification of the independent contribution of each dimension in scenarios with multiple dimensions working together. This overcomes the shortcomings of simple linear regression or correlation analysis in handling complex interactions between dimensions, and avoids the unfairness of subjective weight allocation. It clearly answers the question, "How much would anomalies decrease if a certain dimension were removed?" Thus, it directly indicates the magnitude of responsibility for each dimension with objective numerical values, providing solid and interpretable data for ultimately identifying the core root cause, enabling root cause localization to move from qualitative speculation to quantitative judgment.

[0102] In one embodiment, after S106, the following steps may be included: generating a root cause analysis report, the report including at least the core root cause dimensions, scope of impact, and recommended measures; and pushing the root cause analysis report to the target terminal.

[0103] Root cause analysis report: refers to a formatted document or message automatically generated by the system to summarize the conclusions of abnormal event analysis.

[0104] Scope of impact: This refers to a quantitative description of the business scope affected by the core root cause dimension, such as the number of affected orders, users, geographical regions, or time intervals.

[0105] Recommended actions: These refer to recommended action plans that are automatically generated or matched based on the core root cause dimensions and business knowledge, for the purpose of fixing problems or mitigating their impact.

[0106] Target terminal: refers to the system or user interface that receives the report, such as the alarm platform for maintenance personnel, the work group of business managers, or the related work order system.

[0107] In this embodiment, after completing automated root cause localization, the analysis results are further transformed into actionable decision support information. Specifically, based on the core root cause dimensions determined in S106, and combined with data acquired during the analysis process (such as contribution percentage and dimension distribution data within the abnormal time window), the system automatically generates a structured root cause analysis report. This report not only clearly indicates which (or which) core root cause dimensions (such as "payment channel: Alipay") caused the anomaly, but also quantifies its impact scope (e.g., "resulting in a decrease of approximately 8 million orders, primarily affecting Android users"), and may generate preliminary recommended measures based on a pre-set knowledge base or rules (e.g., "check the Alipay gateway status and contact the payment service provider for investigation"). After the report is generated, the system automatically pushes the report to the target terminal through an integrated messaging channel (such as an internal enterprise communication tool, email, or SMS gateway), for example, delivering it to the alarm screen of the on-duty operations engineer or the mobile terminal of the relevant business manager.

[0108] This solution automates the entire operational loop from "anomaly detection" to "action recommendations" by adding report generation and push steps. It overcomes the delays inherent in traditional solutions where root cause analysis results still require manual interpretation, organization, and distribution. Instead, it directly transforms machine intelligence analysis conclusions into readable and executable task instructions, proactively delivering them to the responsible parties. This significantly shortens the average time from problem detection to initiation of action, improves emergency response efficiency, and ensures that analysis conclusions accurately and promptly guide subsequent remediation operations, thereby minimizing business losses.

[0109] To facilitate understanding of the technical solution of this application, the following will be combined with Figure 4 and Figure 5 This application provides a detailed description of an abnormal event root cause localization method provided in one embodiment.

[0110] This embodiment uses abnormal order volume monitoring in an internet membership subscription service as an example to illustrate the complete implementation process of the method. The system architecture of the method can be found in [reference needed]. Figure 4 It comprises major modules such as a data processing layer, a time-series monitoring layer, an intelligent analysis engine, and an alarm distribution system.

[0111] First, in such Figure 4 In the data processing layer shown, order transaction data generated by the business system is sent to a message queue in real time (e.g., Figure 4 Orders in RocketMQ). Stream processing engines (such as...) Figure 4 Flink's real-time ETL (Extract, Transform, Load) process consumes these pipelines in real time, performs dimension completion and real-time processing, and writes the processed aggregation results with rich dimension labels to a high-performance online analytical processing database (e.g., Flink Real-time ETL). Figure 4 (The StarRocks vectorization library in [the library]). Also, such as... Figure 4 As shown, the aggregation results are synchronized to the time series database (Prometheus TSDB) through the custom exporter (PrometheusExporter) of the time series monitoring layer with a fixed granularity of 1 minute, forming the core monitoring metrics.

[0112] Secondly, in such Figure 4 In the fusion prediction module of the intelligent analytics engine shown, the system obtains time-series data of target business metrics (such as total orders per minute) from Prometheus for anomaly detection. Specifically, as... Figure 4 As shown, this module uses a fusion prediction of the Prophet periodic model and the LSTM micro-model, and combines it with the Isolation Forest outlier filtering algorithm to dynamically generate prediction confidence intervals as anomaly detection thresholds. Figure 5As shown, when the actual indicator value deviates from this range for 3 consecutive minutes, the system determines that an anomaly has occurred and locks the anomaly time window T_anomaly.

[0113] Subsequently, the system enters the root cause localization phase. For example... Figure 4 As shown, the attribution analysis module begins operation. The system first extracts the multidimensional feature data corresponding to the T_anomaly window from StarRocks. For example... Figure 5 As shown in the flowchart, the system first calculates the information gain for each dimension and then performs information gain drill-down planning accordingly. Next, it loads a pre-defined Bayesian causal graph (such as...). Figure 4 As shown in the figure, causal link verification is performed.

[0114] Next, an improved Shapley value algorithm (such as...) is used. Figure 4 (As shown) Perform precise contribution quantification. For example... Figure 5 As shown, this method iterates through the subset of dimension combinations, calculates the marginal contribution of each dimension to order fluctuations, and performs normalization to obtain the contribution percentage.

[0115] Finally, the system determines the core root cause dimensions based on the contribution percentage and generates a report with root causes. For example... Figure 5 As shown, the report is automatically organized into a chain of "root cause dimension -> scope of impact -> recommended actions". The report ultimately passes through... Figure 4 The alarm distribution system shown automatically pushes alerts, completing a fully automated closed loop from anomaly detection to root cause localization and action recommendations.

[0116] As can be seen from the above embodiments, this application... Figure 4 The system architecture shown is coordinated Figure 5 The analysis process shown enables real-time anomaly detection and automated, accurate, and interpretable root cause localization of high-dimensional, nonlinear fluctuating business indicators.

[0117] Based on the same technical concept, embodiments of this application also provide an abnormal event root cause localization device, such as... Figure 6 As shown, the device includes: The first acquisition module 61 is used to acquire time-series monitoring data of the target business indicators; Detection module 62 is used to perform anomaly detection based on the time-series monitoring data in order to determine the time window in which the abnormal event occurs; The second acquisition module 63 is used to acquire multi-dimensional business feature data corresponding to the time window; The filtering module 64 is used to perform causal analysis on the multi-dimensional business feature data to filter out a subset of candidate dimensions that have potential causal relationships with the abnormal event from multiple dimensions. The quantification module 65 is used to perform contribution analysis on the dimensions in the candidate dimension subset to quantify the contribution value of each dimension to the occurrence of the abnormal event of the target business indicator within the time window. The determination module 66 is used to determine the core root cause dimension that leads to the abnormal event based on the contribution value.

[0118] In one possible implementation, the detection module is specifically used for: The time-series monitoring data is processed using a fusion prediction model to generate dynamic anomaly detection thresholds; When the actual value of the target business indicator continuously deviates from the anomaly determination threshold at a preset number of consecutive monitoring points, an anomaly event is determined to have occurred. The time windows corresponding to the preset number of monitoring points are determined as the time windows in which the abnormal event occurs.

[0119] In one possible implementation, the detection module is further configured to: The macroeconomic change components of the target business indicator are fitted using a trend cycle prediction sub-model. By using a residual learning sub-model, nonlinear fluctuation learning is performed on the residuals of the macroscopic change components to obtain nonlinear fluctuation data; The macroscopic change component and the nonlinear fluctuation data are weighted and fused to obtain the target predicted value; Extract the change features of the time-series monitoring data, and calculate the anomaly score based on the change features; The anomaly determination threshold is generated based on the target predicted value, the anomaly score, and the preset benchmark fluctuation parameters.

[0120] In one possible implementation, the filtering module is specifically used for: Obtain a predefined business causal graph, which represents the causal dependencies between dimensions as a directed acyclic graph; Multiple analysis objects are selected from the multiple dimensions, wherein each analysis object is a combination of one or more dimensions; For each analysis object, based on the business cause-effect graph, calculate the conditional probability of the abnormal event occurring when the analysis object is intervened; Based on the conditional probability and the probability of the occurrence of the abnormal event without intervention, determine whether there is a causal relationship between the analysis object and the abnormal event; The analysis objects that are determined to have a causal relationship are added to the candidate dimension subset.

[0121] In one possible implementation, the filtering module is further configured to: Divide multiple dimensions into multiple dimension groups, where each dimension group contains one or more dimensions; For each dimension group, calculate the information gain of the dimension group with respect to the anomalous event; According to the information gain from largest to smallest, the multiple dimensions are grouped and sorted to obtain the dimension grouping sequence; A predetermined number of dimension groups are selected from the beginning of the dimension grouping sequence as target groups, wherein each target group is an analysis object.

[0122] In one possible implementation, the quantization module is specifically used for: For each target dimension in the candidate dimension subset, enumerate all possible subsets in the candidate dimension subset that do not contain the target dimension; For each subset, calculate the marginal effect on the anomalous event when the target dimension is added to the subset; Based on all the marginal effects calculated for the target dimension, calculate the contribution of the target dimension to the occurrence of the anomalous event in the target business indicator within the time window.

[0123] In one possible implementation, the first acquisition module is specifically used for: Receive real-time transaction data from the business system; The flow data is subjected to dimension completion and real-time aggregation processing to obtain aggregated result data with multiple dimension labels, each dimension label corresponding to one dimension; The aggregated data is synchronized to the time-series database at a predetermined time granularity to form the time-series monitoring data.

[0124] Based on the same technical concept, embodiments of this application also provide an electronic device, such as... Figure 7 As shown, it includes a processor 111, a communication interface 112, a memory 113, and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114. Memory 113 is used to store computer programs; When processor 111 executes a program stored in memory 113, it performs the following steps: Obtain time-series monitoring data of target business metrics; Anomaly detection is performed based on the time-series monitoring data to determine the time window in which anomalies occur. Obtain multi-dimensional business feature data corresponding to the time window; Causal analysis is performed on the multi-dimensional business feature data to select a subset of candidate dimensions that have potential causal relationships with the abnormal event from multiple dimensions; Contribution analysis is performed on the dimensions in the candidate dimension subset to quantify the contribution of each dimension to the occurrence of the abnormal event of the target business indicator within the time window; Based on the contribution value, the core root cause dimension leading to the abnormal event is determined.

[0125] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0126] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0127] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0128] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0129] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the above-described methods for locating the root cause of abnormal events.

[0130] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the abnormal event root cause localization methods in the above embodiments.

[0131] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software plus a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0133] It should be understood that the terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in a particular order described or illustrated unless the order of performance is explicitly indicated. It should also be understood that additional or alternative steps may be used.

[0134] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for locating the root cause of an abnormal event, characterized in that, The method includes: Obtain time-series monitoring data of target business metrics; Anomaly detection is performed based on the time-series monitoring data to determine the time window in which anomalies occur. Obtain multi-dimensional business feature data corresponding to the time window; Causal analysis is performed on the multi-dimensional business feature data to select a subset of candidate dimensions that have potential causal relationships with the abnormal event from multiple dimensions; Contribution analysis is performed on the dimensions in the candidate dimension subset to quantify the contribution of each dimension to the occurrence of the abnormal event of the target business indicator within the time window; Based on the contribution value, the core root cause dimension leading to the abnormal event is determined.

2. The method according to claim 1, characterized in that, The anomaly detection based on the time-series monitoring data to determine the time window in which the anomaly event occurs includes: The time-series monitoring data is processed using a fusion prediction model to generate dynamic anomaly detection thresholds; When the actual value of the target business indicator continuously deviates from the anomaly determination threshold at a preset number of consecutive monitoring points, an anomaly event is determined to have occurred. The time windows corresponding to the preset number of monitoring points are determined as the time windows in which the abnormal event occurs.

3. The method according to claim 2, characterized in that, The process of using a fusion prediction model to process the time-series monitoring data to generate dynamic anomaly detection thresholds includes: The macroeconomic change components of the target business indicator are fitted using a trend cycle prediction sub-model. By using a residual learning sub-model, nonlinear fluctuation learning is performed on the residuals of the macroscopic change components to obtain nonlinear fluctuation data; The macroscopic change component and the nonlinear fluctuation data are weighted and fused to obtain the target predicted value; Extract the change features of the time-series monitoring data, and calculate the anomaly score based on the change features; The anomaly determination threshold is generated based on the target predicted value, the anomaly score, and the preset benchmark fluctuation parameters.

4. The method according to claim 1, characterized in that, The step of performing causal analysis on the multi-dimensional business feature data to filter out a subset of candidate dimensions that have a potential causal relationship with the abnormal event includes: Obtain a predefined business causal graph, which represents the causal dependencies between dimensions as a directed acyclic graph; Multiple analysis objects are selected from the multiple dimensions, wherein each analysis object is a combination of one or more dimensions; For each analysis object, based on the business cause-effect graph, calculate the conditional probability of the abnormal event occurring when the analysis object is intervened; Based on the conditional probability and the probability of the occurrence of the abnormal event without intervention, determine whether there is a causal relationship between the analysis object and the abnormal event; The analysis objects that are determined to have a causal relationship are added to the candidate dimension subset.

5. The method according to claim 4, characterized in that, The step of selecting multiple analysis objects from multiple dimensions, wherein each analysis object is a combination of one or more dimensions, includes: Divide multiple dimensions into multiple dimension groups, where each dimension group contains one or more dimensions; For each dimension group, calculate the information gain of the dimension group with respect to the anomalous event; According to the information gain from largest to smallest, the multiple dimensions are grouped and sorted to obtain the dimension grouping sequence; A predetermined number of dimension groups are selected from the beginning of the dimension grouping sequence as target groups, wherein each target group is an analysis object.

6. The method according to claim 1, characterized in that, The contribution analysis of the dimensions in the candidate dimension subset, to quantify the contribution of each dimension to the occurrence of the abnormal event of the target business indicator within the time window, includes: For each target dimension in the candidate dimension subset, enumerate all possible subsets in the candidate dimension subset that do not contain the target dimension; For each subset, calculate the marginal effect on the anomalous event when the target dimension is added to the subset; Based on all the marginal effects calculated for the target dimension, calculate the contribution of the target dimension to the occurrence of the anomalous event in the target business indicator within the time window.

7. The method according to claim 1, characterized in that, The acquisition of time-series monitoring data for target business metrics includes: Receive real-time transaction data from the business system; The flow data is subjected to dimension completion and real-time aggregation processing to obtain aggregated result data with multiple dimension labels, each dimension label corresponding to one dimension; The aggregated data is synchronized to the time-series database at a predetermined time granularity to form the time-series monitoring data.

8. A root cause localization device for abnormal events, characterized in that, The device includes: The first acquisition module is used to acquire time-series monitoring data of the target business metrics; The detection module is used to perform anomaly detection based on the time-series monitoring data in order to determine the time window in which the abnormal event occurs; The second acquisition module is used to acquire multi-dimensional business feature data corresponding to the time window; The filtering module is used to perform causal analysis on the multi-dimensional business feature data to filter out a subset of candidate dimensions that have potential causal relationships with the abnormal event from multiple dimensions. The quantification module is used to perform contribution analysis on the dimensions in the candidate dimension subset, so as to quantify the contribution value of each dimension to the occurrence of the abnormal event of the target business indicator within the time window. The determination module is used to determine the core root cause dimension that leads to the abnormal event based on the contribution value.

9. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the abnormal event root cause localization method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the abnormal event root cause localization method according to any one of claims 1-7.

Images