A service fault rapid grading method and system based on an abnormal pattern library
By constructing an anomaly pattern library and introducing evidence strength and credibility quantification models, the problems of slow service fault classification and misjudgment in existing technologies have been solved, achieving fast and stable fault level determination and adaptive optimization.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHENZHEN LANFUYUAN TECHNOLOGY CO LTD
- Filing Date
- 2026-01-14
- Publication Date
- 2026-06-05
AI Technical Summary
Existing service fault classification technologies lack systematic utilization of known typical fault modes, resulting in slow classification speed and poor consistency. Furthermore, the classification results lack quantitative characterization of reliability, which can easily lead to level fluctuations and misjudgments.
An abnormal pattern library is constructed. Through the minimum mismatch degree, evidence strength and credibility quantification model, the current failure and historical typical failure modes can be quickly compared and stably classified. A bounded monotonic mapping model is introduced for path determination, and the level is corrected and the pattern library is adaptively evolved.
It enables fast and stable service fault level determination, reduces the risk of misjudgment and level fluctuation, and improves the real-time performance and reliability of the classification.
Smart Images
Figure CN122153520A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of big data processing technology, specifically to a method and system for rapid service fault classification based on an anomaly pattern library. Background Technology
[0002] With the widespread adoption of cloudification, microservices, and distributed architectures, the dependencies between service systems are becoming increasingly dynamic and tightly coupled. Service failures often manifest as complex anomalies involving multiple metrics, alarms, and links. Existing service failure classification technologies primarily rely on static threshold rules, single-metric alarm level mapping, or machine learning-based classification models for fault identification and classification.
[0003] However, the above technologies generally suffer from two prominent shortcomings: First, existing technologies often lack the systematic use of "known typical failure modes" and fail to solidify historically reviewed and classified failure experience into a reusable abnormal pattern library. As a result, each fault classification still needs to start from the original data, which is slow and inconsistent. Secondly, existing grading methods typically output discrete grading results directly, lacking a quantitative characterization of the reliability of the grading results. When abnormal states are at the boundary or there is insufficient evidence, grading fluctuations, over-upgrading, or misjudgments are likely to occur, which may lead to unnecessary resource scheduling or response upgrades, affecting system stability and operational efficiency. Summary of the Invention
[0004] To address the shortcomings of existing technologies, this invention provides a method and system for rapid service fault classification based on an anomaly pattern library, thereby resolving the problems mentioned in the background section.
[0005] To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, the present invention provides a method for rapid service failure classification based on an anomaly pattern library, comprising the following steps: S1. Construct a unified representation of the abnormal pattern library and the online abnormal fingerprint, and calculate the minimum mismatch degree to represent the overall difference strength between the online abnormal fingerprint and the closest pattern in the abnormal pattern library; S2. Using the minimum mismatch degree output in step S1 as input, the minimum mismatch degree is converted into evidence strength through a bounded monotonic mapping model. S3. Based on the strength of evidence output in step S2, perform a rapid grading path determination and output the initial judgment level. S4. Using the evidence strength output in step S2 and the minimum mismatch output in step S1 as input, construct a credibility quantification model and calculate the credibility index used to characterize the reliability of the initial judgment level. S5. Based on the initial judgment level output in step S3 and the credibility index output in step S4, the level is stabilized and corrected to determine the final service failure level. S6. Update the abnormal mode library post-event based on the final service failure level.
[0006] To further optimize this technical solution, in step S1, the multidimensional anomaly observations representing the fault state during service operation are mapped into a unified anomaly index vector, i.e., online anomaly fingerprint. An anomaly pattern library is constructed based on historically confirmed service failure events. The anomaly pattern library contains multiple anomaly patterns. Each anomaly pattern corresponds to a pattern baseline vector and a scale quantity and weight coefficient used for dimensional normalization. Based on the weighted normalization difference between the anomaly index vector and the baseline vector of each anomaly pattern, the mismatch degree corresponding to each anomaly pattern is calculated, and the minimum value among them is taken as the minimum mismatch degree.
[0007] To further optimize this technical solution, the online abnormal fingerprint is recorded as follows: ,in For the first Online observations of the first indicator axis; the first in the anomaly pattern library. Each abnormal pattern is denoted as Its corresponding mode reference vector is ,in For this pattern in the first The baseline value on each indicator axis; each online anomaly fingerprint is associated with a scale. This is used to normalize differences of the same dimension to dimensionless; and introduces a weighting coefficient. This indicates the contribution of the indicator axis to pattern recognition, satisfying the following conditions: and ; Then, the mismatch degree corresponding to each abnormal mode is calculated, and the minimum mismatch degree is output: in, This represents the number of patterns in the exception pattern library. For online abnormal fingerprints relative abnormal patterns The degree of mismatch; This represents the minimum mismatch degree of the output.
[0008] To further optimize this technical solution, in step S2, the bounded monotonic mapping model is as follows: in, The strength of evidence is used to characterize the extent to which the current anomalous state can be explained by the anomalous pattern library; When online anomalies closely resemble a certain pattern ,but This indicates that the evidence is almost sufficient; when the anomaly differs significantly from the overall pattern library, Increase, then A value approaching 0 indicates insufficient evidence, requiring a more conservative approach in subsequent classifications or triggering more verification.
[0009] To further optimize this technical solution, in step S3, based on the evidence strength in step S2 and the predetermined evidence threshold range, a corresponding graded path is selected for the current abnormal state, and under the graded path, combined with the fixed grade label of the closest abnormal pattern, the initial judgment grade of the service failure and the corresponding graded path mark are output.
[0010] To further optimize this technical solution, in step S4, the credibility quantification model is as follows: in, This is a credibility indicator used to simultaneously reflect the degree of matching of abnormal patterns and the sufficiency of evidence; Even the strength of evidence The level is relatively high, but if the current anomaly still exhibits a significant pattern mismatch within the indicator space, that is... If the value is large, the credibility will be lowered; conversely, even if... Very small, but if the strength of evidence The credibility of the information itself is not high, and therefore its credibility is not artificially inflated.
[0011] To further optimize this technical solution, in step S5, the initial judgment level output in step S3 and the credibility index output in step S4 are used as inputs. When the credibility index meets the preset credibility threshold condition, the initial judgment level is maintained as the final service failure level. When the credibility index does not meet the preset credibility threshold condition, the initial judgment level is conservatively corrected to obtain the final service failure level, thereby suppressing level fluctuations and reducing the risk of misjudgment.
[0012] To further optimize this technical solution, the correction criterion for the final service failure level is as follows: in, The initial judgment level is output in step S3; Final service failure level; This is the confidence threshold, with a value range of (0, 1). When credibility is sufficient, maintain the efficiency of rapid grading and directly confirm the initial grade; when credibility is insufficient, adopt a conservative correction strategy and downgrade the grade by one level to avoid over-upgrading due to similar patterns but insufficient evidence.
[0013] To further optimize this technical solution, in step S6, without affecting the determined final service failure level, the pattern baseline vector and scale quantity in the abnormal pattern library are selectively updated according to the final service failure level, credibility index and corresponding abnormal mode, or the current abnormal state is marked as a potential new abnormal mode, so as to realize the continuous evolution and adaptive optimization of the abnormal pattern library.
[0014] A service failure rapid classification system based on an anomaly pattern library is constructed based on the aforementioned service failure rapid classification method. This system includes the following functional modules: The module includes fingerprint mapping, evidence quantification, path determination, credibility assessment, level correction, and pattern evolution.
[0015] In a second aspect, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein the computer program instructions, when executed by the processor, implement the steps of a service fault rapid classification method and system based on an exception pattern library as described in the first aspect of the present invention.
[0016] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, they implement the steps of a service fault rapid classification method and system based on an exception pattern library as described in the first aspect of the present invention.
[0017] Compared with existing technologies, this invention provides a method and system for rapid service fault classification based on an anomaly pattern library, which has the following beneficial effects: This method and system for rapid service failure classification based on an anomaly pattern library constructs an anomaly pattern library and maps online anomaly states to unified anomaly fingerprints, enabling rapid comparison of current failures with historical typical failure patterns. It introduces continuous quantitative indicators such as minimum mismatch, evidence strength, and credibility, forming a closed-loop classification system consisting of "pattern matching—evidence quantification—path determination—level stabilization—pattern evolution," thereby significantly reducing the risk of misjudgment and level fluctuations while ensuring classification speed. This technical solution can quickly provide stable, interpretable, and reliable service failure levels in the early stages of a failure, and continuously improves the adaptability of the anomaly pattern library through a post-failure evolution mechanism, thus improving the overall real-time performance, consistency, and engineering reliability of service failure classification. Attached Figure Description
[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0019] Figure 1 This is a flowchart illustrating a method for rapid service fault classification based on an anomaly pattern library proposed in this invention. Figure 2 This is a schematic diagram of the functional modules of a service fault rapid classification system based on an anomaly pattern library proposed in this invention. Detailed Implementation
[0020] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.
[0021] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.
[0022] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places throughout this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.
[0023] Example 1: Reference Figure 1 This is the first embodiment of the present invention, which provides a method for rapid service failure classification based on an anomaly pattern library, including the following steps: S1. Construct a unified representation of the abnormal pattern library and the online abnormal fingerprint, and calculate the minimum mismatch degree to represent the overall difference strength between the online abnormal fingerprint and the closest pattern in the abnormal pattern library.
[0024] Based on the rapid classification goal of the anomaly pattern library, the fault phenomena are first transformed from natural language descriptions and fragmented alarms into quantifiable and reusable online anomaly fingerprints that can be directly compared with the pattern library. Observations from different sources (such as interface latency, error rate, retry storm characteristics, queue backlog patterns, resource contention patterns, changes in the health of dependent services, critical span time of link tracing, etc.) are mapped to the same set of anomaly indicator axes, and it is ensured that the physical dimensions of each indicator axis are fixed in definition, measurable, and consistent within the library.
[0025] Specifically, multi-dimensional anomaly observations representing fault states during service operation are mapped into a unified anomaly index vector, i.e., an online anomaly fingerprint. An anomaly pattern library is constructed based on historically confirmed service fault events. The anomaly pattern library contains multiple anomaly patterns, each corresponding to a pattern baseline vector and a scale quantity and weight coefficient for dimensional normalization. Based on the weighted normalized difference between the anomaly index vector and the baseline vectors of each anomaly pattern, the mismatch degree corresponding to each anomaly pattern is calculated, and the minimum value is taken as the minimum mismatch degree.
[0026] The online observation vector (online anomaly fingerprint) is denoted as... ,in For the first Online observations of each indicator axis; the acquisition method is directly provided by the running observation system (e.g., latency in milliseconds, throughput in req / s, error rate as a percentage, CPU usage as a percentage, queue length as the number of entries, etc.). The first [axis] in the anomaly pattern library... Each abnormal pattern is denoted as Its corresponding mode reference vector is ,in For this pattern in the first The baseline value on each indicator axis; "Retrospective solidification" of historically identified faults involves projecting observations within each confirmed fault window onto the same indicator axis and then solidifying them as the baseline for the pattern using robust statistics (such as the median or quantile center). Each online anomaly fingerprint is paired with a scaling measure. Used to normalize differences of the same dimension into dimensionless; The data is obtained from the "scale of change" of the indicator axis within the normal and abnormal windows. This can be taken as the robust fluctuation range of the indicator axis over a recent period (such as the interquartile range) or the step size of the indicator's upper limit change. Weighting coefficients are introduced. This indicates the contribution of the indicator axis to pattern recognition, satisfying the following conditions: and .
[0027] Then, the mismatch degree corresponding to each abnormal mode is calculated, and the minimum mismatch degree is output: in, This represents the number of patterns in the exception pattern library. For online abnormal fingerprints relative abnormal patterns The degree of mismatch; The minimum mismatch is the output. The smaller the value, the closer it is to a known abnormal pattern, and the more suitable it is for rapid classification rather than entering long-link troubleshooting.
[0028] When an online anomaly triggers a tiered response, the system does not perform "full log retrieval + offline analysis," but instead directly calculates the metric axis space. It can quickly locate the closest pattern and its mismatch intensity.
[0029] S2. Using the minimum mismatch degree output in step S1 as input, the minimum mismatch degree is converted into evidence strength through a bounded monotonic mapping model.
[0030] In step S1, the unified representation of the "online anomaly fingerprint - anomaly pattern library" is completed and obtained. After that, a key question remains: It is about the “strength of difference”, but the grading decision requires more evidence strength. That is, the system needs to know: whether the current anomaly is similar enough to a known failure mode, thus allowing the grading to be completed using the shortest path; or whether it is not similar enough, requiring a more conservative grading strategy (e.g., tentatively classifying it as medium risk and triggering a deeper diagnosis). Therefore, a bounded monotonic mapping model is constructed to calculate the evidence strength.
[0031] The bounded monotonic mapping model is shown below: in, Evidence strength is used to characterize the sufficiency of the current anomalous state to be explained by the anomalous pattern library.
[0032] When online anomalies closely resemble a certain pattern ,but This indicates that the evidence is almost sufficient; when the anomaly differs significantly from the overall pattern library, Increase, then A value approaching 0 indicates insufficient evidence, requiring a more conservative approach in subsequent classifications or triggering more verification.
[0033] To ensure that the strength of evidence is controllable by engineering procedures, this step will also... Binding to the anomaly mode library maintenance strategy: When the anomaly mode library is continuously updated and the same type of fault drifts in different environments, the scale quantity in step S1... It will update over time, thus making The distribution remains relatively stable, indirectly ensuring The threshold can be reused for a long time and will not become invalid due to changes in the unit or fluctuation scale of a single indicator.
[0034] S3. Based on the strength of evidence output in step S2, perform a rapid grading path determination and output the initial judgment level.
[0035] Based on the evidence strength in step S2 and the predetermined evidence threshold range, a corresponding graded path is selected for the current abnormal state. Under the graded path, the fixed grade label of the closest abnormal pattern is combined to output the initial judgment grade of the service failure and the corresponding graded path mark.
[0036] In obtaining Subsequently, rapid grading needs to address two mutually constraining objectives: speed, meaning assigning a grade early in the service failure process to trigger the corresponding response mechanism; and stability, meaning avoiding over-grading due to insufficient evidence, which could lead to mis-scheduling or incorrect escalation of resources. Based on this contradiction, this step employs a tiered path triage system instead of a single threshold judgment: using... First, decide which hierarchical path to take, and then give an initial level assessment within the path.
[0037] In terms of specific implementation, this step provides a deterministic triage structure: setting two evidence thresholds. and ,satisfy The threshold was obtained from historical statistics in the pattern library: among the reviewed samples, the number of samples that achieved "correct and rapid rating" was statistically analyzed. The distribution of samples that "require secondary verification" Distribution, selecting quantiles that control the false positive rate as and (For example, if the primary goal is to reduce serious misjudgments, the time when a serious misjudgment occurs can be taken as an example.) Upper half as (Lower bound). The splitting rule is: when When entering the "Direct Access to Grading Path," a preliminary grading level can be directly given based on the fixed grading labels of the candidate modes; when When entering the "conservative grading path", the initial grade is not directly equivalent to the candidate mode label, but is first output as an intermediate grade and triggers subsequent verification; when At this point, the "gradual hierarchical path" is entered, which allows for a compromise between direct and conservative approaches (for example, giving a candidate mode level but with a higher uncertainty label, requiring subsequent steps to upgrade / downgrade for verification).
[0038] The output of this step includes at least two types: the first is the initial ranking – this ranking can come from the ranking labels of the candidate patterns in the library (e.g., assigning each candidate pattern a ranking label to the candidate pattern's ranking label in the library). When solidifying, a level label is bound (derived from the established grading specifications for dimensions such as impact scope, recovery time, and business loss in the incident review). When the direct path is taken, it can be directly output. The second is the "triage mark" - used to determine whether to conduct stronger verification, whether to allow automatic escalation, and under what conditions to trigger cross-team response in subsequent steps. Define the semantics of the output interface: for example, output the three-state mark of "direct / gradual / conservative", as well as explanatory clues related to the candidate pattern (several indicator axes that are closest to the pattern index and have the greatest contribution).
[0039] S4. Using the evidence strength output in step S2 and the minimum mismatch output in step S1 as inputs, construct a credibility quantification model and calculate the credibility index used to characterize the reliability of the initial judgment level.
[0040] Even after the rapid grading path selection and initial grade output are completed in step S3, a problem remains: the credibility of grades that are classified as the same does not vary. Especially under progressive or conservative grading paths, the initial grade plays more of a temporary decision-making role, requiring a quantifiable credibility index to support subsequent decisions such as whether to automatically upgrade, whether manual intervention is needed, and whether cross-system linkage is allowed.
[0041] In this step, the constructed credibility metric model is shown below: in, This is a credibility indicator used to simultaneously reflect the degree of matching of abnormal patterns and the sufficiency of evidence; Even the strength of evidence The level is relatively high, but if the current anomaly still exhibits a significant pattern mismatch within the indicator space, that is... If the value is large, the credibility will be lowered; conversely, even if... Very small, but if the strength of evidence Even if the value itself is not high (e.g., it is at the boundary of an asymptotic path), the credibility will not be artificially inflated.
[0042] S5. Based on the initial judgment level output in step S3 and the credibility index output in step S4, the level is stabilized and corrected to determine the final service failure level.
[0043] Using the initial judgment level output in step S3 and the credibility index output in step S4 as inputs, when the credibility index meets the preset credibility threshold condition, the initial judgment level is maintained as the final service failure level; when the credibility index does not meet the preset credibility threshold condition, the initial judgment level is conservatively corrected to obtain the final service failure level, thereby suppressing level fluctuations and reducing the risk of misjudgment.
[0044] The criteria for revising the final service failure level are as follows: in, The initial judgment level is output by step S3. The level system can be numbered according to engineering specifications (e.g., 1 is the lowest and L is the highest). Final service failure level; The confidence threshold, ranging from (0, 1), is obtained from historical statistics in the abnormal pattern library: the proportion of "initial judgment level consistent with final manual confirmation level" within different confidence intervals is counted, and the critical point where the consistency significantly decreases is selected as the confidence threshold. .
[0045] When credibility is sufficient, maintain the efficiency of rapid grading and directly confirm the initial grade; when credibility is insufficient, adopt a conservative correction strategy and downgrade the grade by one level to avoid over-upgrading due to similar patterns but insufficient evidence.
[0046] To further suppress timing jitter, this step can be implemented at the implementation level. Short-window smoothing is introduced (e.g., taking the minimum or weighted average over the most recent evaluation periods). Ultimately, the final service failure level output by the steps can be directly used for alarm escalation, resource scheduling, or response strategy matching. At the same time, this level naturally carries an explanatory basis from the abnormal pattern library (candidate patterns, key indicator axes), which facilitates subsequent auditing and review.
[0047] S6. Update the abnormal mode library post-event based on the final service failure level.
[0048] Without affecting the determined final service failure level, the pattern baseline vector and scale quantity in the anomaly pattern library are selectively updated according to the final service failure level, credibility index and corresponding anomaly pattern, or the current anomaly state is marked as a potential new anomaly pattern, so as to achieve continuous evolution and adaptive optimization of the anomaly pattern library.
[0049] Specifically, this step is based on Candidate pattern index and Depending on the level of influence, a differentiated evolution strategy will be adopted for the pattern library: when... Long-term high value range and final level When the pattern solidification level is highly consistent, the online observation vector (online anomaly fingerprint) within the current anomaly window will be used. Include in the corresponding mode Statistics update; when If an anomaly is initially classified as low but is later confirmed to be high, it is marked as a "potential new pattern candidate" and added to the review pool, rather than being forcibly merged into an existing pattern. In this way, the anomaly pattern library can gradually adapt to environmental changes without becoming structurally distorted due to noisy events.
[0050] Example 2: Reference Figure 2 This is the second embodiment of the present invention. This embodiment provides a service failure rapid classification system based on an anomaly pattern library. It is constructed based on the service failure rapid classification method described in Embodiment 1. The system includes the following functional modules: The fingerprint mapping module maps multi-source anomaly observations during service operation into online anomaly fingerprints. Simultaneously, this module includes an anomaly pattern library index unit, used to read the pattern baseline vector, scale, and weight coefficients of each anomaly pattern in the library, and calculate the mismatch degree corresponding to each anomaly pattern. and output the minimum mismatch degree. And its corresponding closest anomaly pattern identifier.
[0051] The evidence quantification module minimizes the mismatch. The evidence strength is obtained by using a bounded monotonic mapping as input. This transforms "pattern similarity" into a thresholdable, combinable, and interpretable measure of evidence.
[0052] The path determination module uses the strength of evidence. As input, combined with pre-fixed evidence threshold ranges, output graded path labels and generate preliminary judgment levels under the corresponding paths; among them, direct paths can directly reference the fixed level label closest to the abnormal mode, progressive paths output the preliminary judgment level along with the uncertainty attribute, and conservative paths output conservative preliminary judgment levels based on robust principles and leave an interface for subsequent verification.
[0053] The credibility assessment module receives the strength of evidence. with minimum mismatch The credibility index is calculated based on the credibility metric model. This indicator is then linked to the initial assessment level and output.
[0054] The rating correction module receives the initial rating and credibility index. The final service failure level is output based on the preset confidence threshold. When the credibility meets the conditions, the initial judgment level is confirmed. When the credibility is insufficient, a conservative correction is performed to suppress excessive escalation. In terms of implementation, short-window stabilization processing of the credibility index is supported to reduce level fluctuations.
[0055] The pattern evolution module receives the final service failure level. Credibility Indicators And the closest anomaly pattern identifier, and post-update the anomaly pattern library according to a preset evolution strategy: when the confidence level is high and the level is consistent, the pattern baseline vector and scale of the corresponding anomaly pattern are selectively updated; when the confidence level is low but the final level is confirmed to be severe, the event is marked as a potential new anomaly pattern candidate and enters the solidification process; at the same time, this module ensures that the evolution update only affects subsequent events and does not have a reverse impact on the currently output events. .
[0056] Example 3: This embodiment also provides a computer device applicable to a service fault rapid classification method and system based on an anomaly pattern library, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the service fault rapid classification method and system based on an anomaly pattern library as proposed in the above embodiment.
[0057] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements a service fault rapid classification method and system based on an anomaly pattern library as proposed in the above embodiments.
[0058] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.
[0059] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0060] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.
[0061] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.
[0062] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0063] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.
Claims
1. A method for rapid service fault classification based on an anomaly pattern library, characterized in that, Includes the following steps: S1. Construct a unified representation of the abnormal pattern library and the online abnormal fingerprint, and calculate the minimum mismatch degree to represent the overall difference strength between the online abnormal fingerprint and the closest pattern in the abnormal pattern library; S2. Using the minimum mismatch degree output in step S1 as input, the minimum mismatch degree is converted into evidence strength through a bounded monotonic mapping model. S3. Based on the strength of evidence output in step S2, perform a rapid grading path determination and output the initial judgment level. S4. Using the evidence strength output in step S2 and the minimum mismatch output in step S1 as input, construct a credibility quantification model and calculate the credibility index used to characterize the reliability of the initial judgment level. S5. Based on the initial judgment level output in step S3 and the credibility index output in step S4, the level is stabilized and corrected to determine the final service failure level. S6. Update the abnormal mode library post-event based on the final service failure level.
2. The method for rapid service fault classification based on an anomaly pattern library according to claim 1, characterized in that, In step S1, the multidimensional anomaly observations representing the fault state during service operation are mapped into a unified anomaly index vector, i.e., online anomaly fingerprint. An anomaly pattern library is constructed based on historically confirmed service failure events. The anomaly pattern library contains multiple anomaly patterns. Each anomaly pattern corresponds to a pattern baseline vector and a scale quantity and weight coefficient used for dimensional normalization. Based on the weighted normalization difference between the anomaly index vector and the baseline vector of each anomaly pattern, the mismatch degree corresponding to each anomaly pattern is calculated, and the minimum value among them is taken as the minimum mismatch degree.
3. The method for rapid service fault classification based on an anomaly pattern library according to claim 2, characterized in that, The online abnormal fingerprint is recorded as ,in For the first Online observations of the first indicator axis; the first in the anomaly pattern library. Each abnormal pattern is denoted as Its corresponding mode reference vector is ,in For this pattern in the first The baseline value on each indicator axis; each online anomaly fingerprint is associated with a scale. Used to normalize differences of the same dimension into dimensionless; And introduce weighting coefficients This indicates the contribution of the indicator axis to pattern recognition, satisfying the following conditions: and ; Then, the mismatch degree corresponding to each abnormal mode is calculated, and the minimum mismatch degree is output: in, This represents the number of patterns in the exception pattern library. For online abnormal fingerprints relative abnormal patterns The degree of mismatch; This represents the minimum mismatch degree of the output.
4. The method for rapid service fault classification based on an anomaly pattern library according to claim 1, characterized in that, In step S2, the bounded monotonic mapping model is as follows: in, The strength of evidence is used to characterize the extent to which the current anomalous state can be explained by the anomalous pattern library; When online anomalies closely resemble a certain pattern ,but This indicates that the evidence is almost sufficient; when the anomaly differs significantly from the overall pattern library, Increase, then A value approaching 0 indicates insufficient evidence, requiring a more conservative approach in subsequent classifications or triggering more verification.
5. The method for rapid service fault classification based on an anomaly pattern library according to claim 1, characterized in that, In step S3, based on the strength of evidence in step S2 and the predetermined evidence threshold range, a corresponding graded path is selected for the current abnormal state. Under the graded path, combined with the fixed grade label of the closest abnormal pattern, the initial judgment grade of the service failure and the corresponding graded path mark are output.
6. The method for rapid service fault classification based on an anomaly pattern library according to claim 1, characterized in that, In step S4, the credibility quantification model is as follows: in, It is a credibility indicator used to simultaneously reflect the degree of matching of abnormal patterns and the sufficiency of evidence; Even the strength of evidence The level is relatively high, but if the current anomaly still exhibits a significant pattern mismatch within the indicator space, that is... If the value is large, the credibility will be lowered; conversely, even if... Very small, but if the strength of evidence The credibility of the information itself is not high, and therefore its credibility is not artificially inflated.
7. The method for rapid service fault classification based on an anomaly pattern library according to claim 1, characterized in that, In step S5, the initial judgment level output in step S3 and the credibility index output in step S4 are used as inputs. When the credibility index meets the preset credibility threshold condition, the initial judgment level is maintained as the final service failure level. When the credibility index does not meet the preset credibility threshold condition, the initial judgment level is conservatively corrected to obtain the final service failure level, thereby suppressing level fluctuations and reducing the risk of misjudgment.
8. The method for rapid service fault classification based on an anomaly pattern library according to claim 7, characterized in that, The criteria for revising the final service failure level are as follows: in, The initial judgment level is output in step S3; Final service failure level; This is the confidence threshold, with a value range of (0, 1). When credibility is sufficient, maintain the efficiency of rapid grading and directly confirm the initial grade; when credibility is insufficient, adopt a conservative correction strategy and downgrade the grade by one level to avoid over-upgrading due to similar patterns but insufficient evidence.
9. The method for rapid service fault classification based on an anomaly pattern library according to claim 1, characterized in that, In step S6, without affecting the determined final service failure level, the pattern baseline vector and scale quantity in the abnormal pattern library are selectively updated according to the final service failure level, credibility index and corresponding abnormal pattern, or the current abnormal state is marked as a potential new abnormal pattern, so as to realize the continuous evolution and adaptive optimization of the abnormal pattern library.
10. A service failure rapid classification system based on an anomaly pattern library, constructed based on the service failure rapid classification method according to any one of claims 1-9, characterized in that, The system includes the following functional modules: The module includes fingerprint mapping, evidence quantification, path determination, credibility assessment, level correction, and pattern evolution.