A processing method and device for anomaly analysis based on cloud network fusion features

Abstract

The embodiment of the present application relates to a kind of based on cloud network fusion feature carries out abnormal analysis processing method and device, the method comprises: the data item of cloud network two sides is selected and is obtained data item collection;First prediction model is constructed, and by the historical operation log of analysis information push platform, first data set is constructed, and first prediction model is trained based on first data set;According to data item collection, the real-time statistical data of cloud network two sides is collected and first database is updated based on the acquisition data;According to first database and first prediction model, the abnormal event of information push platform is analyzed and early warning processing.Based on the present application, the analysis sufficiency can be improved, the early warning loss probability can be reduced, the early warning accuracy and early warning timeliness can be improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a processing method and apparatus for anomaly analysis based on cloud-network convergence characteristics. Background Technology

[0002] Currently, most information push platforms (such as SMS push platforms and advertising push platforms) use a mechanism to analyze and warn about the effectiveness of their business during operation. This mechanism involves comparing the real-time status of a single target with a static threshold and issuing warnings based on the comparison results. For example, delivery rate is used as the target of attention, and warnings are only triggered when the real-time delivery rate is lower than a fixed threshold.

[0003] This traditional analysis and early warning method has several problems: 1) Single analysis target dimension: Traditional methods only focus on a single indicator (such as delivery rate), which cannot cover the entire link effect indicators such as feedback and unsubscription, resulting in blind spots in the assessment of the health status of push services; 2) Single data dimension reliance: Traditional methods cannot conduct multi-dimensional joint analysis of cloud business statistics and network quality statistics, which may cause problems such as lost or delayed early warnings; 3) Lack of dynamic analysis capabilities: Traditional methods only analyze based on the comparison results between real-time status and set thresholds, and cannot conduct dynamic analysis and early warning based on a sequence of status changes. Naturally, it is impossible to provide timely early warnings based on the status change trend before the status reaches the set threshold, which will also cause problems such as lost or delayed early warnings.

[0004] To address the aforementioned issues, we propose an improved solution: replacing the traditional single analysis target with four categories of end-to-end analysis targets (push, delivery, feedback, and unsubscribe), thereby achieving comprehensive coverage of core indicators across the entire platform business chain; constructing an anomaly prediction model (i.e., the first prediction model) based on a dual LSTM model, which enables joint analysis of cloud business statistical data and network quality statistical data, and dynamic analysis of the four types of abnormal events (push anomalies, delivery anomalies, feedback anomalies, and unsubscribe anomalies), thereby reducing the probability of missed alerts and improving alert accuracy and timeliness. How to implement the above improved solution is the technical problem that this invention aims to solve. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a processing method, apparatus, electronic device, and computer-readable storage medium for anomaly analysis based on cloud-network convergence characteristics. This invention selects and matches data items from both the cloud and network sides for analyzing four types of anomaly events on an information push platform to obtain a data item set; constructs a first prediction model for predicting the four types of anomalies; constructs a first dataset by analyzing historical operation and maintenance logs of the information push platform; trains the first prediction model based on the first dataset; collects real-time statistical data from both the cloud and network sides according to the data item set and updates a first database based on the collected data; and analyzes and provides early warning processing for anomaly events on the information push platform based on the first database and the first prediction model. Based on this invention, the sufficiency of analysis can be improved, the probability of missed warnings can be reduced, and the accuracy and timeliness of warnings can be improved.

[0006] To achieve the above objectives, a first aspect of the present invention provides a method for anomaly analysis based on cloud-network convergence characteristics, the method comprising: A set of data items is obtained by selecting and configuring data items from both the cloud and network sides for analyzing four types of abnormal events on the information push platform. The four types of abnormal events include push abnormal events, delivery abnormal events, feedback abnormal events, and unsubscription abnormal events. The set of data items includes a cloud-side subset and a network-side subset. The data items in the cloud-side subset include submission volume, delivery volume, delivery rate, mean delivery rate, standard deviation of delivery rate, feedback volume, feedback rate, mean feedback rate, standard deviation of feedback rate, unsubscription volume, unsubscription rate, mean unsubscription rate, standard deviation of unsubscription rate, push latency, mean push latency, and standard deviation of push latency. The data items in the network-side subset include network latency, network jitter, network packet loss rate, data retransmission rate, operator gateway connection success rate, and operator concurrent connection volume. A first prediction model for handling four types of anomaly prediction is constructed; a first dataset is constructed by analyzing the historical operation and maintenance logs of the information push platform; and the first prediction model is trained based on the first dataset; the first prediction model is used to predict cloud-side statistical sequences X input to the model. C And network side statistical sequence X N Four types of anomalies are predicted and corresponding anomaly prediction vectors Y are output; the cloud-side statistical sequence X C The sampling statistics vector at N consecutive sampling times The composition consists of a preset interval ΔT between two consecutive sampling times, where N is the preset total number of sampling points, and 1 ≤ index t ≤ N; each of the sampling statistical vectors Each consists of a set of real-time statistical data corresponding to the cloud-side subset; the network-side statistical sequence X N The temporal relationship between the cloud-side statistical sequence X C To maintain consistency, it also consists of corresponding N sampling statistical vectors. Composition; each of the sampling statistical vectors Each is composed of a set of real-time statistical data corresponding to the network-side subset; the anomaly prediction vector Y is composed of push anomaly prediction vector y1, delivery anomaly prediction vector y2, feedback anomaly prediction vector y3, and unsubscribe anomaly prediction vector y4; each type of anomaly prediction vector y s Each has a corresponding set of positive and negative prediction probabilities. , Composition, 1 ≤ index s ≤ 4; positive and negative prediction probabilities for each group. , Used to characterize the probability of occurrence or non-occurrence of type s-th abnormal events. , , ; A corresponding collection frequency is set according to the interval duration △T; and real-time statistical data from both sides of the cloud network are periodically collected based on the data item set according to the collection frequency, and the first database is updated based on the collected data; the collection frequency = 1 / △T; the first database includes multiple first collection records; the collection interval between every two adjacent first collection records matches the interval duration △T; the first collection record includes a first timestamp and a first dataset; the first dataset includes multiple first data key-value pairs, and the first data key-value pairs correspond one-to-one with the data items of the data item set; each first data key-value pair consists of a set of corresponding first data names and first data values, where the first data name is the data item name of its corresponding data item, and the first data value is the real-time statistical data of its corresponding data item; The abnormal events of the information push platform are analyzed and warned regularly based on the first database and the first prediction model.

[0007] Preferably, the information push platform is an internet and / or mobile internet service platform used to provide information to its information subscribers by pushing subscribed information in a targeted manner; All data items in the cloud-side subset are statistical data items from the business layer; The submission volume is the total number of information push requests per unit time counted by the information provider within a preset historical statistical period; the historical statistical period is a pre-specified recent duration; and the unit time is per minute. The delivery volume is the total number of messages delivered per unit time to the information subscribers within the historical statistical period; the delivery rate is calculated as follows: delivery rate = delivery volume / submission volume; the mean delivery rate and the standard deviation of the delivery rate are the sample mean µ and sample standard deviation σ calculated from the delivery rate samples within the historical statistical period. The feedback quantity is the total number of information reading feedbacks per unit time counted for information subscribers within the historical statistical period; the feedback rate is calculated as: feedback rate = feedback quantity / delivery quantity; the mean feedback rate and the standard deviation feedback rate are the sample mean µ and sample standard deviation σ counted for feedback rate samples within the historical statistical period. The unsubscription volume is the total number of unsubscribed messages per unit time counted from the information subscription user side within the historical statistical period; the unsubscription rate is calculated as: unsubscription rate = unsubscription volume / delivery volume; the mean unsubscription rate and the standard deviation of the unsubscription rate are the sample mean µ and sample standard deviation σ counted from the unsubscription rate sample within the historical statistical period. The push delay is a unit-time push delay indicator statistically calculated at the message subject level within the historical statistical period; the push delay indicator is a type of time indicator used to characterize the average delay time from submission to delivery for all message subjects. The mean push delay and the standard deviation of push delay are the sample mean µ and sample standard deviation σ statistically obtained from push delay samples within the historical statistical period. All data items in the network-side subset are statistical data items from the network communication layer; The network latency is the RTT (Resource Time To Day) metric calculated at the data packet transmission layer within the historical statistical period. The network jitter is the sample change amplitude statistically analyzed based on network latency samples within the historical statistical period; The network packet loss rate is the percentage of packets lost per unit time within the historical statistical period, calculated at the data packet transmission layer. The data retransmission rate is the retransmission rate per unit time statistically calculated at the data packet transmission layer within the historical statistical period. The operator gateway connection success rate is the percentage of successful gateway connection requests per unit time, calculated from the perspective of the operator gateway facing the Internet and / or mobile Internet within the historical statistical period. The operator's concurrent connection volume is the total number of concurrent connections per unit time counted to the Internet and / or mobile Internet operator gateway during the historical statistical period. The cloud-side statistical sequence X C Each of the sampling statistics vectors Each of these consists of a set of corresponding submission data, delivery data, delivery rate data, mean delivery rate data, standard deviation of delivery rate data, feedback data, feedback rate data, mean feedback rate data, standard deviation of feedback rate data, unsubscription data, unsubscription rate data, mean unsubscription rate data, standard deviation of unsubscription rate data, push delay data, mean push delay data, and standard deviation of push delay data. The network-side statistical sequence X N Each of the sampling statistics vectors Each of these consists of a set of corresponding network latency data, network jitter data, network packet loss rate data, data retransmission rate data, carrier gateway connection success rate data, and carrier concurrent connection volume data. The first dataset includes multiple first data records; each first data record is represented by a set of corresponding cloud-side statistical sequences X. C The network-side statistical sequence X N and label anomaly vector Y tag Composition; the label anomaly vector Y tag From push anomaly tag vector Delivery exception tag vector Feedback anomaly label vector Unsubscription exception tag vector Composition; label vector for each type of anomaly Each is determined by a set of corresponding positive and negative label probabilities. , Composition; probability of positive and negative labels in each group , One has a probability of 1, and the other has a probability of 0. ; The label anomaly vector Y in the first dataset tag The probability of 4 positive labels All are 0, part of the label anomaly vector Y tag The probability of 4 positive labels All are 1, partially representing the label anomaly vector Y. tag There is only a probability of 1, 2, or 3 positive labels. The value is 1.

[0008] Preferably, the first model input terminal of the first prediction model is used to receive the cloud-side statistical sequence X. C The second model input terminal is used to receive the network-side statistical sequence X. N The model output is used to output the anomaly prediction vector Y; The first prediction model includes a first LSTM model, a first MLP model, a second LSTM model, a second MLP model, a first fusion layer, a third MLP model, a first prediction head, a second prediction head, a third prediction head, a fourth prediction head, and an output layer; The input of the first LSTM model is connected to the input of the first model, and its output is connected to the input of the first MLP model. The output of the first MLP model is connected to the first input of the first fusion layer. The input of the second LSTM model is connected to the input of the second model, and its output is connected to the input of the second MLP model. The output of the second MLP model is connected to the second input of the first fusion layer. The output of the first fusion layer is connected to the input of the third MLP model. The output of the third MLP model is connected to the inputs of the parallel first prediction head, second prediction head, third prediction head, and fourth prediction head, respectively. The outputs of the parallel first prediction head, second prediction head, third prediction head, and fourth prediction head are connected to the corresponding first, second, third, and fourth inputs of the output layer, respectively. The output of the output layer is connected to the model output. The first LSTM model is used to process the cloud-side statistical sequence X. C Sequence feature encoding is performed to obtain the corresponding feature vector sequence. ; and the last feature vector of the sequence As the corresponding feature vector H C Send to the first MLP model; Wherein, the feature vector sequence N eigenvectors Composition, the feature vector With the sampling statistics vector One-to-one correspondence; the feature vector H C The shape is 1×D LSTM1 D LSTM1 The feature dimension corresponding to the first LSTM model; The first MLP model is used to process the feature vector H C The corresponding feature vector H1 is obtained by feature encoding and sent to the first fusion layer; The reasoning method of the first MLP model is as follows: ; W 1,1 W 1,2 Let b be the first and second weight matrices corresponding to the first MLP model. 1,1 b 1,2W represents the first and second bias vectors corresponding to the first MLP model. 1,1 The shape is D 1,1 ×D LSTM1 W 1,2 The shape is D 1,2 ×D 1,1 b 1,1 The shape is 1×D 1,1 b 1,2 The shape is 1×D 1,2 D 1,1 D 1,2 The first and second feature dimensions are the first and second feature dimensions corresponding to the first MLP model; ReLU() is the ReLU activation function; the feature vector H1 has a shape of 1×D. 1,2 ; The second LSTM model is used for the network-side statistical sequence X. N Sequence feature encoding is performed to obtain the corresponding feature vector sequence. ; and the last feature vector of the sequence As the corresponding feature vector H N Send to the second MLP model; Wherein, the feature vector sequence N eigenvectors Composition, the feature vector With the sampling statistics vector One-to-one correspondence; the feature vector H N The shape is 1×D LSTM2 D LSTM2 The feature dimension corresponding to the second LSTM model; The second MLP model is used to process the feature vector H N The corresponding feature vector H2 is obtained by feature encoding and sent to the second fusion layer; The reasoning method of the second MLP model is as follows: ; W 2,1 W 2,2 Let b be the first and second weight matrices corresponding to the second MLP model. 2,1 b 2,2 W represents the first and second bias vectors corresponding to the second MLP model. 2,1 The shape is D 2,1 ×D LSTM2 W 2,2 The shape is D 2,2 ×D 2,1 b 2,1 The shape is 1×D 2,1 b 2,2The shape is 1×D 2,2 D 2,1 D 2,2 These are the first and second feature dimensions corresponding to the second MLP model; the feature vector H2 has a shape of 1×D. 2,2 ; The first fusion layer is used to concatenate the feature vectors H1 and H2 to obtain the corresponding feature vector H3 and send it to the third MLP model; The shape of the feature vector H3 is 1×(D 1,2 +D 2,2 ); The third MLP model is used to perform feature encoding on the feature vector H3 to obtain the corresponding feature vector H4, which is then sent to the first prediction head, the second prediction head, the third prediction head, and the fourth prediction head. The reasoning method of the third MLP model is as follows: ; W 3,1 W 3,2 Let b be the first and second weight matrices corresponding to the third MLP model. 3,1 b 3,2 W represents the first and second bias vectors corresponding to the third MLP model. 3,1 The shape is D 3,1 ×(D 1,2 +D 2,2 ), W 2,2 The shape is D 3,2 ×D 3,1 b 3,1 The shape is 1×D 3,1 b 3,2 The shape is 1×D 3,2 D 3,1 D 3,2 The first and second feature dimensions correspond to the third MLP model; the feature vector H4 has a shape of 1×D. 3,2 ; The first prediction head is used to perform binary classification prediction of push abnormal events based on the feature vector H4 to obtain the corresponding push abnormal prediction vector y1 and send it to the output layer. The reasoning method of the first prediction head is as follows: ; W 4,1 b 4,1 W represents the weight matrix and bias vector corresponding to the first prediction head. 4,1 The shape is 2×D 3,2 b 4,1The shape is 1×2; softmax() is the Softmax function; The second prediction head is used to perform binary classification prediction of the delivery anomaly event based on the feature vector H4 to obtain the corresponding delivery anomaly prediction vector y2 and send it to the output layer; The reasoning method of the second prediction head is as follows: ; W 4,2 b 4,2 W represents the weight matrix and bias vector corresponding to the second prediction head. 4,2 The shape is 2×D 3,2 b 4,2 The shape is 1×2; The third prediction head is used to perform binary classification prediction of the feedback anomaly event based on the feature vector H4 to obtain the corresponding feedback anomaly prediction vector y3 and send it to the output layer. The reasoning method of the third prediction head is as follows: ; W 4,3 b 4,3 W represents the weight matrix and bias vector corresponding to the third prediction head. 4,3 The shape is 2×D 3,2 b 4,3 The shape is 1×2; The fourth prediction head is used to perform binary classification prediction of the unsubscription anomaly event based on the feature vector H4 to obtain the corresponding unsubscription anomaly prediction vector y4 and send it to the output layer. The reasoning method of the fourth prediction head is as follows: ; W 4,4 b 4,4 W represents the weight matrix and bias vector corresponding to the fourth prediction head. 4,4 The shape is 2×D 3,2 b 4,4 The shape is 1×2; The output layer is used to combine the push anomaly prediction vector y1, the delivery anomaly prediction vector y2, the feedback anomaly prediction vector y3, and the unsubscribe anomaly prediction vector y4 into a corresponding anomaly prediction vector Y and output it.

[0009] Preferably, the step of constructing the first dataset by analyzing the historical operation and maintenance logs of the information push platform specifically includes: Step 41: Filter and extract the historical operation and maintenance logs of the information push platform over the past M years to obtain the corresponding original log set; The historical operation and maintenance logs of the information push platform contain a collection of log data items that cover the data item collection. The quantity M is a preset positive integer; The original log set includes a subset of normal logs and a subset of abnormal logs; The normal log subset includes multiple normal time period log sets; each normal time period log set corresponds to an operation and maintenance period in which no abnormal events have occurred, and consists of historical operation and maintenance logs within that period; The subset of abnormal logs includes multiple sets of abnormal time period logs; each set of abnormal time period logs corresponds to an operation and maintenance period in which some or all abnormal events occurred, and consists of historical operation and maintenance logs within that period. The duration of each normal period log set and each abnormal period log set is greater than or equal to the sampling period length, where the sampling period length = △T×N; The total number of log sets in the normal log subset is less than or equal to the total number of log sets in the abnormal log subset; Step 42: Based on each of the normal time period log sets, extract the corresponding cloud-side statistical sequences from both sides of the cloud network to obtain the corresponding cloud-side statistical sequence X. C and the network-side statistical sequence X N ; and configure the corresponding label anomaly vector Y for each of the normal time period log sets. tag ; and a set of cloud-side statistical sequences X corresponding to each of the normal time period log sets. C The network-side statistical sequence X N and the label anomaly vector Y tag Form a corresponding first data record; Among them, the label anomaly vector Y corresponding to each of the normal time period log sets tag All positive label probabilities All are 0; Step 43: Based on the log sets of each abnormal period, extract the corresponding cloud-side statistical sequences from both sides of the network to obtain the corresponding cloud-side statistical sequence X. C and the network-side statistical sequence X N Based on the single or combined abnormal event types corresponding to each of the abnormal time period log sets, the corresponding label abnormal vector Y is configured for it. tag ; and a set of cloud-side statistical sequences X corresponding to each of the aforementioned abnormal time period log sets. C The network-side statistical sequence X N and the label anomaly vector Y tag Form a corresponding first data record; Among them, the label anomaly vector Y corresponding to each of the abnormal time period log sets tag Partial or all of the positive label probability =1; Step 44: The first dataset is composed of all the first data records obtained.

[0010] Preferably, training the first prediction model based on the first dataset specifically includes: Step 51: Based on a preset first segmentation ratio, the first dataset is randomly divided into two subsets, denoted as the first training set and the first evaluation set. Both the first training set and the first evaluation set consist of multiple first data records; The total number of records in the first training set is denoted as N. tr The total number of records in the first evaluation set is denoted as N. av The ratio N of the total number of records in the first training set to the total number of records in the first evaluation set. tr :N av The first segmentation ratio is satisfied; Each of the label anomaly vectors Y in the first training set tag Record as the corresponding Each of the labeled anomaly vectors Y tag The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; 1 ≤ index i ≤ N tr ; The label anomaly vectors Y of the first evaluation set tag Record as the corresponding Each of the labeled anomaly vectors Y tag The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; 1 ≤ index j ≤ N av ; Step 52, take the cloud-side statistical sequence X of each of the first data records in the first training set. C and the network-side statistical sequence X N The first prediction model is input for processing, and the anomaly prediction vector Y output by the model in this processing is denoted as the corresponding... and the current anomaly prediction vector The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; and by each of the aforementioned anomaly prediction vectors and its corresponding label anomaly vector Form a corresponding first prediction-label pair; Step 53, obtain N tr Substituting the first prediction-label pair into the preset first model loss function L M The corresponding first loss value is obtained through calculation; Wherein, the first model loss function L M for: ; Step 54: Identify whether the first loss value meets the preset first loss value range; if it does, proceed to step 55; if not, based on the preset first model optimizer, move towards making the first model loss function L... M The direction that reaches the minimum value modulates the model parameters of the first prediction model in one round, and returns to step 52 when the modulation ends; The first model optimizer includes the Adam optimizer and the SGD optimizer. Step 55, the cloud-side statistical sequence X of each of the first data records in the first evaluation set. C and the network-side statistical sequence X N The first prediction model is input for processing, and the anomaly prediction vector Y output by the model in this processing is denoted as the corresponding... and the current anomaly prediction vector The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; and by each of the aforementioned anomaly prediction vectors and its corresponding label anomaly vector Form a corresponding second prediction-label pair; and based on the obtained N av The accuracy, precision, recall, and F1 score of the second prediction-label pair are statistically analyzed to obtain the corresponding first accuracy, first precision, first recall, and first F1 score; Step 56: Identify whether the first accuracy, first precision, first recall, and first F1 score all satisfy their respective first accuracy range, first precision range, first recall range, and first F1 score range; if not, return to step 51; if yes, stop training and confirm that the model training is complete.

[0011] Preferably, the step of periodically analyzing and issuing early warnings for abnormal events on the information push platform based on the first database and the first prediction model specifically includes: According to the preset anomaly analysis frequency, the N most recently collected records from the first database are periodically extracted to form the corresponding current record set; And based on the first dataset of each of the first collected records in the current record set, set the corresponding sampling statistics vector. and the sampling statistics vector ; and consisting of the N sampling statistical vectors corresponding to the current record set. The corresponding cloud-side statistical sequence X is formed. C The N sampling statistical vectors corresponding to the current record set The corresponding network-side statistical sequence X is formed. N ; And the current cloud-side statistical sequence X C and the network-side statistical sequence X N The first prediction model is input and processed to obtain the corresponding anomaly prediction vector Y; And the various anomaly prediction vectors y of the current anomaly prediction vector Y s As the current prediction vector; and for the positive prediction probability of the current prediction vector. If the anomaly probability exceeds a preset threshold, an identification process is initiated; if so, the corresponding subsequent action A is set. s If not, then set the corresponding subsequent action A. s None; the subsequent action A s The action types include two categories: warning and none; And in all the subsequent actions A obtained s When not all are zero, perform the subsequent action A for each non-zero value. s As the current action; and activate the pre-set abnormal event warning and handling process corresponding to the current action on the information push platform.

[0012] A second aspect of the present invention provides an apparatus for implementing the processing method for anomaly analysis based on cloud-network convergence features as described in the first aspect above. The apparatus includes: a cloud-network side data selection module, a model building and training module, a cloud-network side data acquisition module, and an anomaly analysis and early warning module. The cloud-network side data selection module selects and matches data items from both sides of the cloud and network for analyzing four types of abnormal events on the information push platform to obtain a set of data items. The four types of abnormal events include push abnormal events, delivery abnormal events, feedback abnormal events, and unsubscribe abnormal events. The set of data items includes a cloud-side subset and a network-side subset. The data items in the cloud-side subset include submission volume, delivery volume, delivery rate, mean delivery rate, standard deviation of delivery rate, feedback volume, feedback rate, mean feedback rate, standard deviation of feedback rate, unsubscribe volume, unsubscribe rate, mean unsubscribe rate, standard deviation of unsubscribe rate, push latency, mean push latency, and standard deviation of push latency. The data items in the network-side subset include network latency, network jitter, network packet loss rate, data retransmission rate, operator gateway connection success rate, and operator concurrent connection volume. The model building and training module constructs a first prediction model for handling four types of anomaly predictions; constructs a first dataset by analyzing the historical operation and maintenance logs of the information push platform; and trains the first prediction model based on the first dataset. The first prediction model is used to calculate the cloud-side statistical sequence X input to the model. C And network side statistical sequence X N Four types of anomalies are predicted and corresponding anomaly prediction vectors Y are output; the cloud-side statistical sequence X C The sampling statistics vector at N consecutive sampling times The composition consists of a preset interval ΔT between two consecutive sampling times, where N is the preset total number of sampling points, and 1 ≤ index t ≤ N; each of the sampling statistical vectors Each consists of a set of real-time statistical data corresponding to the cloud-side subset; the network-side statistical sequence X N The temporal relationship between the cloud-side statistical sequence X C To maintain consistency, it also consists of corresponding N sampling statistical vectors. Composition; each of the sampling statistical vectors Each is composed of a set of real-time statistical data corresponding to the network-side subset; the anomaly prediction vector Y is composed of push anomaly prediction vector y1, delivery anomaly prediction vector y2, feedback anomaly prediction vector y3, and unsubscribe anomaly prediction vector y4; each type of anomaly prediction vector y s Each has a corresponding set of positive and negative prediction probabilities. , Composition, 1 ≤ index s ≤ 4; positive and negative prediction probabilities for each group. , Used to characterize the probability of occurrence or non-occurrence of type s-th abnormal events. , , ; The data acquisition modules on both sides of the cloud network are used to set the corresponding acquisition frequency according to the interval duration △T; and periodically collect real-time statistical data from both sides of the cloud network based on the acquisition frequency and update the first database based on the collected data; acquisition frequency = 1 / △T; the first database includes multiple first acquisition records; the acquisition interval between every two adjacent first acquisition records matches the interval duration △T; the first acquisition record includes a first timestamp and a first dataset; the first dataset includes multiple first data key-value pairs, and the first data key-value pairs correspond one-to-one with the data items in the data item set; each first data key-value pair consists of a set of corresponding first data names and first data values, where the first data name is the data item name of its corresponding data item, and the first data value is the real-time statistical data of its corresponding data item; The anomaly analysis and early warning module is used to periodically analyze and issue early warnings for abnormal events on the information push platform based on the first database and the first prediction model.

[0013] A third aspect of the present invention provides an electronic device, including: a memory, a processor, and a transceiver; The processor is used to couple with the memory, read and execute instructions in the memory to implement the steps of the method described in the first aspect above; The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

[0014] A fourth aspect of the present invention provides a computer-readable storage medium storing computer instructions that, when executed by a computer, cause the computer to perform the instructions described in the first aspect.

[0015] This invention provides a processing method, apparatus, electronic device, and computer-readable storage medium for anomaly analysis based on cloud-network convergence characteristics. As described above, this invention selects and matches data items from both the cloud and network sides for analyzing four types of anomaly events on an information push platform to obtain a data item set; constructs a first prediction model for predicting the four types of anomalies; constructs a first dataset by analyzing historical operation and maintenance logs of the information push platform; trains the first prediction model based on the first dataset; collects real-time statistical data from both the cloud and network sides according to the data item set and updates a first database based on the collected data; and analyzes and issues early warnings for anomaly events on the information push platform based on the first database and the first prediction model. This invention improves the sufficiency of analysis, reduces the probability of missed warnings, and improves the accuracy and timeliness of warnings. Attached Figure Description

[0016] Figure 1This is a schematic diagram of an anomaly analysis method based on cloud-network convergence features provided in Embodiment 1 of the present invention; Figure 2 This is a block diagram of the first prediction model provided in Embodiment 1 of the present invention; Figure 3 This is a module structure diagram of a processing device for anomaly analysis based on cloud-network convergence features provided in Embodiment 2 of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0018] Embodiment 1 of the present invention provides a method for anomaly analysis based on cloud-network convergence characteristics, such as... Figure 1 The diagram illustrates a method for anomaly analysis based on cloud-network convergence features provided in Embodiment 1 of the present invention. This method mainly includes the following steps: Step 1: Select and match data items from both sides of the cloud network for analyzing four types of abnormal events on the information push platform to obtain a data item set.

[0019] Here, the information push platform in this embodiment of the invention is a type of Internet and / or mobile Internet service platform used to push subscribed information to its information subscribers.

[0020] The four types of abnormal events in this invention include push abnormal events, delivery abnormal events, feedback abnormal events, and unsubscribe abnormal events.

[0021] The data item set in this embodiment of the invention includes a cloud-side subset and a network-side subset. All data items in the cloud-side subset are statistical data items at the service level, while all data items in the network-side subset are statistical data items at the network communication level.

[0022] The data items in the cloud-side subset include submission volume, delivery volume, delivery rate, mean delivery rate, standard deviation of delivery rate, feedback volume, feedback rate, mean feedback rate, standard deviation of feedback rate, unsubscription volume, unsubscription rate, mean unsubscription rate, standard deviation of unsubscription rate, push delay, mean push delay, and standard deviation of push delay.

[0023] The submission volume refers to the total number of information push requests per unit time counted by the information provider within a preset historical statistical period. Here, the historical statistical period in this embodiment of the invention is a pre-specified recent duration, such as the most recent month, the most recent week, the most recent day, the most recent hour, the most recent 30 minutes, etc. In this embodiment of the invention, the "unit time" of each "unit time..." specifically refers to one minute.

[0024] The delivery volume is the total number of messages delivered per unit time to subscribers within the historical statistical period. The delivery rate is calculated as: Delivery Rate = Delivery Volume / Submission Volume. The mean and standard deviation of the delivery rate are the sample mean µ and sample standard deviation σ, respectively, calculated from the delivery rate sample within the historical statistical period.

[0025] Feedback volume refers to the total number of information read responses per unit time from the perspective of information subscribers within the historical statistical period. The feedback rate is calculated as: Feedback Rate = Feedback Volume / Delivery Volume. The mean and standard deviation of the feedback rate are the sample mean µ and sample standard deviation σ, respectively, calculated from the feedback rate sample within the historical statistical period.

[0026] Unsubscription volume refers to the total number of unsubscribed messages per unit time from the perspective of message subscribers within the historical statistical period. The unsubscription rate is calculated as: Unsubscription Rate = Unsubscription Volume / Delivery Volume. The mean and standard deviation of the unsubscription rate are the sample mean µ and sample standard deviation σ, respectively, calculated from the sample of unsubscription rates within the historical statistical period.

[0027] Push latency is a unit-time metric calculated at the message subject level within a historical statistical period. Push latency is a time-based indicator used to characterize the average delay from message submission to delivery for all message subjects. The push latency mean and standard deviation are the sample mean µ and sample standard deviation σ calculated from the push latency sample within the historical statistical period.

[0028] The network-side subset of data items includes network latency, network jitter, network packet loss rate, data retransmission rate, carrier gateway connection success rate, and carrier concurrent connections. Specifically, network latency is the RTT (Round-Trip Time) per unit time, calculated at the data packet transmission level within the historical statistical period. Network jitter is the sample variation amplitude of network latency samples within the historical statistical period. Network packet loss rate is the percentage of packets lost per unit time, calculated at the data packet transmission level within the historical statistical period. Data retransmission rate is the percentage of retransmissions per unit time, calculated at the data packet transmission level within the historical statistical period. Carrier gateway connection success rate is the percentage of successful gateway connection requests per unit time, calculated at the internet and / or mobile internet carrier gateway side within the historical statistical period. Carrier concurrent connections are the total number of concurrent connections per unit time, calculated at the internet and / or mobile internet carrier gateway side within the historical statistical period.

[0029] Step 2: Construct the first prediction model for handling the prediction of four types of anomalies; construct the first dataset by analyzing the historical operation and maintenance logs of the information push platform; and train the first prediction model based on the first dataset.

[0030] Specifically, it includes: Step 21: Construct the first prediction model for handling the prediction of four types of anomalies.

[0031] Here, the first prediction model in this embodiment of the invention is used to predict based on the cloud-side statistical sequence X input to the model. C And network side statistical sequence X N Predict four types of anomalies and output the corresponding anomaly prediction vector Y.

[0032] Cloud-side statistical sequence X of this invention embodiment C The sampling statistics vector at N consecutive sampling times The system consists of a preset interval ΔT between two consecutive sampling times, where N is the preset total number of sampling points, and 1 ≤ index t ≤ N. Each sampling statistical vector... Each consists of a set of real-time statistical data corresponding to a subset of cloud-based data. It should be noted that the interval duration ΔT is a pre-set time length parameter, and the total number of sampling points N is a pre-set positive integer.

[0033] Network-side statistical sequence X of this invention embodiment N The temporal relationship and cloud-side statistical sequence X C To maintain consistency, it also consists of corresponding N sampling statistical vectors. Composition; each sampled statistical vector Each consists of a set of real-time statistical data corresponding to a subset of network-side data.

[0034] Cloud-based statistical sequence X C Each sampling statistical vector Each of these consists of a set of corresponding submission data, delivery data, delivery rate data, mean delivery rate data, standard deviation of delivery rate data, feedback data, feedback rate data, mean feedback rate data, standard deviation of feedback rate data, unsubscription data, unsubscription rate data, mean unsubscription rate data, standard deviation of unsubscription rate data, push delay data, mean push delay data, and standard deviation of push delay data.

[0035] The anomaly prediction vector Y in this embodiment of the invention consists of push anomaly prediction vector y1, delivery anomaly prediction vector y2, feedback anomaly prediction vector y3, and unsubscribe anomaly prediction vector y4. Each type of anomaly prediction vector y... s Each has a corresponding set of positive and negative prediction probabilities. , Composition, 1 ≤ index s ≤ 4. Positive and negative prediction probabilities for each group. , Used to characterize the probability of occurrence or non-occurrence of type s-th abnormal events. , , .

[0036] Network-side statistical sequence X N Each sampling statistical vector Each of these consists of a set of corresponding network latency data, network jitter data, network packet loss rate data, data retransmission rate data, carrier gateway connection success rate data, and carrier concurrent connection volume data.

[0037] like Figure 2 As shown in the module structure diagram of the first prediction model provided in Embodiment 1 of the present invention, the first model input terminal of the first prediction model is used to receive the cloud-side statistical sequence X. C The second model input is used to receive the network-side statistical sequence X. N The model output is used to output the anomaly prediction vector Y.

[0038] like Figure 2 As shown, the model components of the first prediction model include: a first LSTM model, a first MLP model, a second LSTM model, a second MLP model, a first fusion layer, a third MLP model, a first prediction head, a second prediction head, a third prediction head, a fourth prediction head, and an output layer.

[0039] like Figure 2As shown, the model component connections of the first prediction model are as follows: the input of the first LSTM model is connected to the input of the first model, and its output is connected to the input of the first MLP model; the output of the first MLP model is connected to the first input of the first fusion layer; the input of the second LSTM model is connected to the input of the second model, and its output is connected to the input of the second MLP model; the output of the second MLP model is connected to the second input of the first fusion layer; the output of the first fusion layer is connected to the input of the third MLP model; the output of the third MLP model is connected to the inputs of the parallel first, second, third, and fourth prediction heads respectively; the outputs of the parallel first, second, third, and fourth prediction heads are connected to the corresponding first, second, third, and fourth inputs of the output layer respectively; and the output of the output layer is connected to the model output.

[0040] The model component functions of the first prediction model are shown below.

[0041] 1) First LSTM model: The first LSTM model in this embodiment of the invention is used to process the cloud-side statistical sequence X. C Sequence feature encoding is performed to obtain the corresponding feature vector sequence. ; and the last feature vector of the sequence As the corresponding feature vector H C Send to the first MLP model.

[0042] Here, the feature vector sequence of the embodiment of the present invention. N eigenvectors Composition, eigenvectors With sampling statistical vector One-to-one correspondence; eigenvector H C The shape is 1×D LSTM1 D LSTM1 This represents the feature dimension corresponding to the first LSTM model.

[0043] 2) First MLP model: The first MLP model in this embodiment of the invention is used to process the feature vector H C The corresponding feature vector H1 is obtained by feature encoding and sent to the first fusion layer.

[0044] Here, the inference method of the first MLP model is as follows: .

[0045] Among them, W 1,1 W 1,2 Let b be the first and second weight matrices corresponding to the first MLP model. 1,1 b1,2 W represents the first and second bias vectors corresponding to the first MLP model. 1,1 The shape is D 1,1 ×D LSTM1 W 1,2 The shape is D 1,2 ×D 1,1 b 1,1 The shape is 1×D 1,1 b 1,2 The shape is 1×D 1,2 D 1,1 D 1,2 The first and second feature dimensions are the first and second features corresponding to the first MLP model; ReLU() is the ReLU activation function; the shape of the feature vector H1 is 1×D. 1,2 .

[0046] 3) Second LSTM model: The second LSTM model in this embodiment of the invention is used for network-side statistical sequences X. N Sequence feature encoding is performed to obtain the corresponding feature vector sequence. ; and the last feature vector of the sequence As the corresponding feature vector H N Send to the second MLP model.

[0047] Here, the feature vector sequence of the embodiment of the present invention. N eigenvectors Composition, eigenvectors With sampling statistical vector One-to-one correspondence; eigenvector H N The shape is 1×D LSTM2 D LSTM2 This represents the feature dimension corresponding to the second LSTM model.

[0048] 4) Second MLP model: The second MLP model in this embodiment of the invention is used to process the feature vector H N The corresponding feature vector H2 is obtained by feature encoding and sent to the second fusion layer.

[0049] Here, the inference method of the second MLP model is as follows: .

[0050] Among them, W 2,1 W 2,2 Let b be the first and second weight matrices corresponding to the second MLP model. 2,1 b 2,2 W represents the first and second bias vectors corresponding to the second MLP model. 2,1 The shape is D 2,1×D LSTM2 W 2,2 The shape is D 2,2 ×D 2,1 b 2,1 The shape is 1×D 2,1 b 2,2 The shape is 1×D 2,2 D 2,1 D 2,2 These represent the first and second feature dimensions corresponding to the second MLP model; the feature vector H2 has a shape of 1×D. 2,2 .

[0051] 5) First Fusion Layer: The first fusion layer in this embodiment of the invention is used to concatenate feature vectors H1 and H2 to obtain the corresponding feature vector H3, which is then sent to the third MLP model.

[0052] Here, the shape of the feature vector H3 in this embodiment of the invention is 1×(D 1,2 +D 2,2 ).

[0053] 6) Third MLP model: The third MLP model in this embodiment of the invention is used to perform feature encoding on feature vector H3 to obtain the corresponding feature vector H4, which is then sent to the first prediction head, the second prediction head, the third prediction head, and the fourth prediction head.

[0054] Here, the inference method of the third MLP model is as follows: .

[0055] Among them, W 3,1 W 3,2 For the first and second weight matrices corresponding to the third MLP model, b 3,1 b 3,2 W represents the first and second bias vectors corresponding to the third MLP model. 3,1 The shape is D 3,1 ×(D 1,2 +D 2,2 ), W 2,2 The shape is D 3,2 ×D 3,1 b 3,1 The shape is 1×D 3,1 b 3,2 The shape is 1×D 3,2 D 3,1 D 3,2 These represent the first and second feature dimensions corresponding to the third MLP model; the feature vector H4 has a shape of 1×D. 3,2 .

[0056] 7) First prediction head: In this embodiment of the invention, the first prediction head is used to perform binary classification prediction of push anomaly events based on feature vector H4 to obtain the corresponding push anomaly prediction vector y1 and send it to the output layer.

[0057] Here, the reasoning method of the first predictor is as follows: .

[0058] Among them, W 4,1 b 4,1 W represents the weight matrix and bias vector corresponding to the first prediction head. 4,1 The shape is 2×D 3,2 b 4,1 The shape is 1×2; softmax() is the Softmax function.

[0059] 8) Second prediction head: The second prediction head in this embodiment of the invention is used to perform binary classification prediction of delivery anomaly events based on feature vector H4 to obtain the corresponding delivery anomaly prediction vector y2 and send it to the output layer.

[0060] Here, the reasoning method of the second predictor is as follows: .

[0061] Among them, W 4,2 b 4,2 W represents the weight matrix and bias vector corresponding to the second prediction head. 4,2 The shape is 2×D 3,2 b 4,2 The shape is 1×2.

[0062] 9) Third prediction head: The third prediction head in this embodiment of the invention is used to perform binary classification prediction on the feedback anomaly event based on the feature vector H4 to obtain the corresponding feedback anomaly prediction vector y3 and send it to the output layer.

[0063] Here, the reasoning method of the third predictor is as follows: .

[0064] Among them, W 4,3 b 4,3 W represents the weight matrix and bias vector corresponding to the third prediction head. 4,3 The shape is 2×D 3,2 b 4,3 The shape is 1×2.

[0065] 10) Fourth prediction head: The fourth prediction head in this embodiment of the invention is used to perform binary classification prediction of the unsubscription anomaly event based on the feature vector H4 to obtain the corresponding unsubscription anomaly prediction vector y4 and send it to the output layer.

[0066] Here, the reasoning method of the fourth predictor is as follows: .

[0067] Among them, W 4,4 b 4,4 Here are the weight matrix and bias vector corresponding to the fourth prediction head; W 4,4 The shape is 2×D 3,2 b 4,4 The shape is 1×2.

[0068] 11) Output layer: The output layer of this embodiment of the invention is used to combine the push anomaly prediction vector y1, the delivery anomaly prediction vector y2, the feedback anomaly prediction vector y3, and the unsubscribe anomaly prediction vector y4 into a corresponding anomaly prediction vector Y and output it.

[0069] Step 22: Construct the first dataset by analyzing the historical operation and maintenance logs of the information push platform.

[0070] Here, the first dataset in this embodiment of the invention includes multiple first data records. Each first data record is represented by a corresponding cloud-side statistical sequence X. C Network-side statistical sequence X N and label anomaly vector Y tag Composition. Among them, the label anomaly vector Y tag From push anomaly tag vector Delivery exception tag vector Feedback anomaly label vector Unsubscription exception tag vector Composition. Anomaly label vector for each type. Each is determined by a set of corresponding positive and negative label probabilities. , Composition. Probability of positive and negative labels in each group. , One has a probability of 1, and the other has a probability of 0. It should be noted that some of the label anomaly vectors Y in the first dataset... tag The probability of 4 positive labels All are 0, indicating partial label anomaly vector Y tag The probability of 4 positive labels All values ​​are 1, indicating partial label anomaly vector Y. tag There is only a probability of 1, 2, or 3 positive labels. The value is 1.

[0071] The current step 22 specifically includes: Step 221: Filter and extract the historical operation and maintenance logs of the information push platform over the past M years to obtain the corresponding original log set.

[0072] Here, the historical operation and maintenance log records of the information push platform in this embodiment of the invention represent a collection of overlay data items. The quantity M is a preset positive integer.

[0073] The original log set in this embodiment of the invention includes a normal log subset and an abnormal log subset. The normal log subset includes multiple normal time period log sets; each normal time period log set corresponds to an operation and maintenance period in which no abnormal events occurred, and is composed of historical operation and maintenance logs within that period. The abnormal log subset includes multiple abnormal time period log sets; each abnormal time period log set corresponds to an operation and maintenance period in which some or all abnormal events occurred, and is composed of historical operation and maintenance logs within that period.

[0074] It should be noted that the duration of each log set for a normal period and each log set for an abnormal period is greater than or equal to the sampling duration, where the sampling duration is ΔT × N. The total number of log sets in the normal log subset is less than or equal to the total number of log sets in the abnormal log subset.

[0075] Step 222: Based on the log sets of each normal time period, extract the corresponding cloud-side statistical sequences from both sides of the network to obtain the corresponding cloud-side statistical sequence X. C And network side statistical sequence X N ; and configure corresponding label anomaly vector Y for each normal time period log set. tag ; and a set of cloud-side statistical sequences X corresponding to the log sets of each normal time period. C Network-side statistical sequence X N and label anomaly vector Y tag This forms a corresponding first data record.

[0076] Here, in the embodiments of the present invention, the label anomaly vector Y corresponds to the log sets of each normal time period. tag All positive label probabilities All are 0.

[0077] Step 223: Based on the log sets of each abnormal period, extract the corresponding cloud-side statistical sequences from both sides of the network to obtain the corresponding cloud-side statistical sequence X. C And network side statistical sequence X N Based on the single or combined abnormal event types corresponding to the log sets of each abnormal time period, a corresponding label abnormal vector Y is configured for it. tag ; and a set of cloud-side statistical sequences X corresponding to the log sets of each abnormal period. C Network-side statistical sequence X Nand label anomaly vector Y tag This forms a corresponding first data record.

[0078] Here, the label anomaly vector Y corresponding to each abnormal time period log set in the embodiments of the present invention. tag Partial or all of the positive label probability The value is 1.

[0079] Step 224: The first dataset is composed of all the first data records obtained.

[0080] Step 23: Train the first prediction model based on the first dataset.

[0081] Specifically, it includes: Step 231: Based on the preset first segmentation ratio, the first dataset is randomly divided into two subsets, denoted as the first training set and the first evaluation set.

[0082] Here, the first segmentation ratio in this embodiment of the invention is a pre-set ratio parameter, such as 8:2. Both the first training set and the first evaluation set consist of multiple first data records. The total number of records in the first training set is denoted as N. tr The total number of records in the first evaluation set is denoted as N. av The ratio N of the total number of records in the first training set to the total number of records in the first evaluation set. tr :N av It satisfies the first segmentation ratio.

[0083] It should be noted that the anomaly vectors Y of each label in the first training set tag Record as the corresponding Each label anomaly vector Y tag The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; 1 ≤ index i ≤ N tr The label anomaly vectors Y of the first evaluation set tag Record as the corresponding Each label anomaly vector Y tag The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; 1 ≤ index j ≤ N av .

[0084] Step 232: Obtain the cloud-side statistical sequence X of each first data record in the first training set. C And network side statistical sequence X N The input is processed by the first prediction model, and the anomaly prediction vector Y output by the model in this processing is denoted as the corresponding... and the current anomaly prediction vector The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; and by each anomaly prediction vector and its corresponding label anomaly vector Form a corresponding first prediction-label pair.

[0085] Step 233, obtain N tr Each first prediction-label pair is substituted into the preset first model loss function L. M The corresponding first loss value is obtained through calculation.

[0086] Here, the first model loss function L in this embodiment of the invention M for: .

[0087] Step 234: Identify whether the first loss value meets the preset first loss value range; if it does, proceed to step 235; if not, based on the preset first model optimizer, move towards making the first model loss function L... M The direction that reaches the minimum value modulates the model parameters of the first prediction model in one round, and returns to step 232 when the modulation ends.

[0088] Here, the first loss value range in this embodiment of the invention is a pre-set numerical range. The first model optimizer includes the Adam optimizer and the SGD optimizer; Step 235: Obtain the cloud-side statistical sequence X of each first data record in the first evaluation set. C And network side statistical sequence X N The input is processed by the first prediction model, and the anomaly prediction vector Y output by the model in this processing is denoted as the corresponding... and the current anomaly prediction vector The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; and by each anomaly prediction vector and its corresponding label anomaly vector Form a corresponding second prediction-label pair; and based on the obtained N av The accuracy, precision, recall, and F1 score of the second prediction-label pair are statistically analyzed to obtain the corresponding first accuracy, first precision, first recall, and first F1 score.

[0089] Step 236: Identify whether the first accuracy, first precision, first recall, and first F1 score all satisfy their respective first accuracy range, first precision range, first recall range, and first F1 score range; if not, return to step 231; if yes, stop training and confirm that the model training is complete.

[0090] Here, the first accuracy range, the first precision range, the first recall range, and the first F1 score range in this embodiment of the invention are four preset numerical ranges.

[0091] Step 3: Set the corresponding collection frequency with an interval duration △T; and periodically collect real-time statistical data from both sides of the cloud network based on the data item set according to the collection frequency, and update the first database based on the collected data.

[0092] Here, the sampling frequency in this embodiment of the invention is 1 / ΔT.

[0093] The first database in this embodiment of the invention includes multiple first acquisition records. The acquisition interval between any two adjacent first acquisition records matches the interval duration ΔT. Each first acquisition record includes a first timestamp and a first dataset. The first dataset includes multiple first data key-value pairs, each corresponding one-to-one with a data item in the data item set. Each first data key-value pair consists of a corresponding first data name and a first data value; the first data name is the name of the corresponding data item, and the first data value is the real-time statistical data of the corresponding data item.

[0094] Step 4: Regularly analyze and issue early warnings for abnormal events on the information push platform based on the first database and the first prediction model.

[0095] Specifically, it includes: Step 41: According to the preset anomaly analysis frequency, periodically extract the N most recently collected first collection records from the first database to form the corresponding current record set.

[0096] Step 42: Set the corresponding sampling statistics vector based on the first dataset of each first acquisition record in the current record set. and sampling statistical vector ; and consists of N sampling statistical vectors corresponding to the current record set. The corresponding cloud-side statistical sequence X is formed. C N sampling statistical vectors corresponding to the current record set The corresponding network-side statistical sequence X is formed. N .

[0097] Step 43, convert the current cloud-side statistical sequence X C And network side statistical sequence X NThe first prediction model is input and processed to obtain the corresponding anomaly prediction vector Y.

[0098] Step 44, convert the current anomaly prediction vector Y into various anomaly prediction vectors y s As the current prediction vector; and the positive prediction probability of the current prediction vector. If the anomaly probability exceeds a preset threshold, an identification process is initiated; if so, the corresponding subsequent action A is set. s If an alert is issued, then the corresponding follow-up action A is set. s It is none.

[0099] Here, the subsequent action A of the present invention embodiment s The action types include two categories: warning and no action.

[0100] Step 45, in all subsequent actions A obtained s When not all are zero, perform the subsequent actions A for each non-zero value. s As the current action, the pre-set abnormal event warning and handling process corresponding to the current action on the information push platform is activated.

[0101] Here, the information push platform of this invention pre-designs automated abnormal event warning and handling processes for four types of abnormal events (push abnormal events, delivery abnormal events, feedback abnormal events, and unsubscribe abnormal events), and reserves a status or switch flag for activating the current process in each process. This invention embodiment, through subsequent action A... s When it is confirmed that the abnormal event warning and handling process corresponding to the current action needs to be activated, it is only necessary to set the status or switch flag corresponding to the current process.

[0102] Figure 3 This is a module structure diagram of a processing device for anomaly analysis based on cloud-network convergence features provided in Embodiment 2 of the present invention. This device can be a terminal device or server implementing the aforementioned method embodiments, or it can be a device that enables the aforementioned terminal device or server to implement the aforementioned method embodiments. For example, the device can be a device or chip system of the aforementioned terminal device or server. Figure 3 As shown, the device includes: a cloud network data selection module 201, a model building and training module 202, a cloud network data acquisition module 203, and an anomaly analysis and early warning module 204.

[0103] The cloud-network data selection module 201 selects and matches data items from both sides of the cloud and network for analyzing four types of abnormal events on the information push platform to obtain a set of data items. The four types of abnormal events include push abnormal events, delivery abnormal events, feedback abnormal events, and unsubscription abnormal events. The set of data items includes a cloud-side subset and a network-side subset. The data items in the cloud-side subset include submission volume, delivery volume, delivery rate, mean delivery rate, standard deviation of delivery rate, feedback volume, feedback rate, mean feedback rate, standard deviation of feedback rate, unsubscription volume, unsubscription rate, mean unsubscription rate, standard deviation of unsubscription rate, push latency, mean push latency, and standard deviation of push latency. The data items in the network-side subset include network latency, network jitter, network packet loss rate, data retransmission rate, operator gateway connection success rate, and operator concurrent connection volume.

[0104] The model building and training module 202 constructs a first prediction model for handling four types of anomaly prediction; it also constructs a first dataset by analyzing historical operation and maintenance logs from the information push platform; and trains the first prediction model based on the first dataset. The first prediction model is used to predict cloud-side statistical sequences X input to the model. C And network side statistical sequence X N Predict four types of anomalies and output the corresponding anomaly prediction vector Y; cloud-side statistical sequence X. C The sampling statistics vector at N consecutive sampling times Composition: The interval between two consecutive sampling times is a preset interval length ΔT, N is the preset total number of sampling points, 1 ≤ index t ≤ N; each sampling statistical vector Each consists of a set of real-time statistical data corresponding to a subset of cloud-side data; network-side statistical sequence X N The temporal relationship and cloud-side statistical sequence X C To maintain consistency, it also consists of corresponding N sampling statistical vectors. Composition; each sampled statistical vector Each consists of a set of real-time statistical data corresponding to a subset of network-side data; the anomaly prediction vector Y is composed of push anomaly prediction vector y1, delivery anomaly prediction vector y2, feedback anomaly prediction vector y3, and unsubscribe anomaly prediction vector y4; each type of anomaly prediction vector y s Each has a corresponding set of positive and negative prediction probabilities. , Composition, 1 ≤ index s ≤ 4; positive and negative prediction probabilities for each group. , Used to characterize the probability of occurrence or non-occurrence of type s-th abnormal events. , , .

[0105] The cloud network data acquisition module 203 is used to set the corresponding acquisition frequency with an interval duration △T; and periodically collect real-time statistical data from both sides of the cloud network based on the acquisition frequency and the data collection set, and update the first database based on the collected data; acquisition frequency = 1 / △T; the first database includes multiple first acquisition records; the acquisition interval between every two adjacent first acquisition records matches the interval duration △T; the first acquisition record includes a first timestamp and a first dataset; the first dataset includes multiple first data key-value pairs, and the first data key-value pairs correspond one-to-one with the data items in the data item collection; each first data key-value pair consists of a set of corresponding first data names and first data values, where the first data name is the data item name of its corresponding data item, and the first data value is the real-time statistical data of its corresponding data item.

[0106] The anomaly analysis and early warning module 204 is used to periodically analyze and issue early warnings for abnormal events on the information push platform based on the first database and the first prediction model.

[0107] The present invention provides a processing device for anomaly analysis based on cloud-network convergence features, which can execute the method steps in the above method embodiments. Its implementation principle and technical effect are similar, and will not be repeated here.

[0108] It should be noted that the division of the various modules in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, these modules can be implemented entirely in software via processing element calls; they can be fully implemented in hardware; or some modules can be implemented by processing element calls to software, while others are implemented in hardware. For example, the data matching module on both sides of the cloud network can be a separate processing element, or it can be integrated into a chip in the above device. Alternatively, it can be stored as program code in the memory of the above device, and called and executed by a processing element of the device. The implementation of other modules is similar. Moreover, these modules can be fully or partially integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each of the above modules can be completed through integrated logic circuits in the hardware of the processor element or through software instructions.

[0109] For example, these modules can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). As another example, when a module is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these modules can be integrated together as a System-on-a-Chip (SOC).

[0110] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. This computer program product includes one or more computer instructions. When these computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the foregoing method embodiments are generated. The computer described above can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The aforementioned computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the aforementioned computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, Bluetooth, microwave, etc.) means. The aforementioned computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The aforementioned available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks (SSDs)).

[0111] Figure 4 This is a schematic diagram of an electronic device provided in Embodiment 3 of the present invention. This electronic device can be a terminal device or server implementing the methods of the aforementioned embodiments, or it can be a terminal device or server connected to the aforementioned terminal device or server implementing the methods of the aforementioned embodiments. Figure 4As shown, the electronic device may include: a processor 301 (e.g., CPU), a memory 302, and a transceiver 303; the transceiver 303 is coupled to the processor 301, and the processor 301 controls the transmission and reception operations of the transceiver 303. The memory 302 may store various instructions for performing various processing functions and implementing the processing steps described in the foregoing embodiments. Preferably, the electronic device involved in the embodiments of the present invention further includes: a power supply 304, a system bus 305, and a communication port 306. The system bus 305 is used to realize communication connections between components. The communication port 306 is used for communication between the electronic device and other peripherals.

[0112] exist Figure 4 The system bus 305 mentioned can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, it is represented by only one thick line in the figure, but this does not indicate that there is only one bus or one type of bus. The communication interface is used to enable communication between the database access device and other devices (e.g., clients, read-write libraries, and read-only libraries). Memory may include Random Access Memory (RAM) and may also include Non-Volatile Memory, such as at least one disk storage device.

[0113] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), graphics processing units (GPUs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0114] It should be noted that the embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when run on a computer, cause the computer to perform the methods and processes provided in the above embodiments.

[0115] This invention provides a processing method, apparatus, electronic device, and computer-readable storage medium for anomaly analysis based on cloud-network convergence characteristics. As described above, this invention selects and matches data items from both the cloud and network sides for analyzing four types of anomaly events on an information push platform to obtain a data item set; constructs a first prediction model for predicting the four types of anomalies; constructs a first dataset by analyzing historical operation and maintenance logs of the information push platform; trains the first prediction model based on the first dataset; collects real-time statistical data from both the cloud and network sides according to the data item set and updates a first database based on the collected data; and analyzes and issues early warnings for anomaly events on the information push platform based on the first database and the first prediction model. This invention improves the sufficiency of analysis, reduces the probability of missed warnings, and improves the accuracy and timeliness of warnings.

[0116] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0117] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for anomaly analysis based on cloud-network convergence characteristics, characterized in that, The method includes: A set of data items is obtained by selecting and configuring data items from both the cloud and network sides for analyzing four types of abnormal events on the information push platform. The four types of abnormal events include push abnormal events, delivery abnormal events, feedback abnormal events, and unsubscription abnormal events. The set of data items includes a cloud-side subset and a network-side subset. The data items in the cloud-side subset include submission volume, delivery volume, delivery rate, mean delivery rate, standard deviation of delivery rate, feedback volume, feedback rate, mean feedback rate, standard deviation of feedback rate, unsubscription volume, unsubscription rate, mean unsubscription rate, standard deviation of unsubscription rate, push latency, mean push latency, and standard deviation of push latency. The data items in the network-side subset include network latency, network jitter, network packet loss rate, data retransmission rate, operator gateway connection success rate, and operator concurrent connection volume. A first prediction model for handling four types of anomaly prediction is constructed; a first dataset is constructed by analyzing the historical operation and maintenance logs of the information push platform; and the first prediction model is trained based on the first dataset; the first prediction model is used to predict cloud-side statistical sequences X input to the model. C And network side statistical sequence X N Four types of anomalies are predicted and corresponding anomaly prediction vectors Y are output; the cloud-side statistical sequence X C The sampling statistics vector at N consecutive sampling times The composition consists of a preset interval ΔT between two consecutive sampling times, where N is the preset total number of sampling points, and 1 ≤ index t ≤ N; each of the sampling statistical vectors Each consists of a set of real-time statistical data corresponding to the cloud-side subset; the network-side statistical sequence X N The temporal relationship between the cloud-side statistical sequence X C To maintain consistency, it also consists of corresponding N sampling statistical vectors. Composition; each of the sampling statistical vectors Each is composed of a set of real-time statistical data corresponding to the network-side subset; the anomaly prediction vector Y is composed of push anomaly prediction vector y1, delivery anomaly prediction vector y2, feedback anomaly prediction vector y3, and unsubscribe anomaly prediction vector y4; each type of anomaly prediction vector y s Each has a corresponding set of positive and negative prediction probabilities. , Composition, 1 ≤ index s ≤ 4; positive and negative prediction probabilities for each group. , Used to characterize the probability of occurrence or non-occurrence of type s-th abnormal events. , , ; A corresponding collection frequency is set according to the interval duration △T; and real-time statistical data from both sides of the cloud network are periodically collected based on the data item set according to the collection frequency, and the first database is updated based on the collected data; the collection frequency = 1 / △T; the first database includes multiple first collection records; the collection interval between every two adjacent first collection records matches the interval duration △T; the first collection record includes a first timestamp and a first dataset; the first dataset includes multiple first data key-value pairs, and the first data key-value pairs correspond one-to-one with the data items of the data item set; each first data key-value pair consists of a set of corresponding first data names and first data values, where the first data name is the data item name of its corresponding data item, and the first data value is the real-time statistical data of its corresponding data item; The abnormal events of the information push platform are analyzed and warned regularly based on the first database and the first prediction model.

2. The processing method for anomaly analysis based on cloud-network convergence characteristics according to claim 1, characterized in that, The information push platform is a type of internet and / or mobile internet service platform used to provide information to its information subscribers by pushing subscribed information in a targeted manner. All data items in the cloud-side subset are statistical data items from the business layer; The submission volume is the total number of information push requests per unit time counted by the information provider within a preset historical statistical period; the historical statistical period is a pre-specified recent duration; and the unit time is per minute. The delivery volume is the total number of messages delivered per unit time to the information subscribers within the historical statistical period; the delivery rate is calculated as follows: delivery rate = delivery volume / submission volume; the mean delivery rate and the standard deviation of the delivery rate are the sample mean and sample standard deviation calculated from the delivery rate samples within the historical statistical period. The feedback volume is the total number of information reading feedbacks per unit time counted from the information subscription user side within the historical statistical period; the feedback rate is calculated as: feedback rate = feedback volume / delivery volume; the mean feedback rate and the standard deviation feedback rate are the sample mean and sample standard deviation counted from the feedback rate sample within the historical statistical period. The unsubscription volume is the total number of unsubscribed messages per unit time counted from the information subscription user side within the historical statistical period; the unsubscription rate is calculated as: unsubscription rate = unsubscription volume / delivery volume; the mean unsubscription rate and the standard deviation of the unsubscription rate are the sample mean and sample standard deviation counted from the unsubscription rate sample within the historical statistical period. The push delay is a unit-time push delay indicator statistically calculated at the message subject level within the historical statistical period; the push delay indicator is a type of time indicator used to characterize the average delay time from submission to delivery for all message subjects. The mean push delay and the standard deviation of push delay are the sample mean and sample standard deviation statistically obtained from push delay samples within the historical statistical period. All data items in the network-side subset are statistical data items from the network communication layer; The network latency is the RTT (Resource Time To Day) metric calculated at the data packet transmission layer within the historical statistical period. The network jitter is the sample change amplitude statistically analyzed based on network latency samples within the historical statistical period; The network packet loss rate is the percentage of packets lost per unit time within the historical statistical period, calculated at the data packet transmission layer. The data retransmission rate is the retransmission rate per unit time statistically calculated at the data packet transmission layer within the historical statistical period. The operator gateway connection success rate is the percentage of successful gateway connection requests per unit time, calculated from the perspective of the operator gateway facing the Internet and / or mobile Internet within the historical statistical period. The operator's concurrent connection volume is the total number of concurrent connections per unit time counted to the Internet and / or mobile Internet operator gateway during the historical statistical period. The cloud-side statistical sequence X C Each of the sampling statistics vectors Each of these consists of a set of corresponding submission data, delivery data, delivery rate data, mean delivery rate data, standard deviation of delivery rate data, feedback data, feedback rate data, mean feedback rate data, standard deviation of feedback rate data, unsubscription data, unsubscription rate data, mean unsubscription rate data, standard deviation of unsubscription rate data, push delay data, mean push delay data, and standard deviation of push delay data. The network-side statistical sequence X N Each of the sampling statistics vectors Each of these consists of a set of corresponding network latency data, network jitter data, network packet loss rate data, data retransmission rate data, carrier gateway connection success rate data, and carrier concurrent connection volume data. The first dataset includes multiple first data records; each first data record is represented by a set of corresponding cloud-side statistical sequences X. C The network-side statistical sequence X N and label anomaly vector Y tag Composition; the label anomaly vector Y tag From push anomaly tag vector Delivery exception tag vector Feedback anomaly label vector Unsubscription exception tag vector Composition; label vector for each type of anomaly Each is determined by a set of corresponding positive and negative label probabilities. , Composition; probability of positive and negative labels in each group , One has a probability of 1, and the other has a probability of 0. ; The label anomaly vector Y in the first dataset tag The probability of 4 positive labels All are 0, part of the label anomaly vector Y tag The probability of 4 positive labels All are 1, partially representing the label anomaly vector Y. tag There is only a probability of 1, 2, or 3 positive labels. The value is 1.

3. The processing method for anomaly analysis based on cloud-network convergence characteristics according to claim 1, characterized in that, The first model input of the first prediction model is used to receive the cloud-side statistical sequence X. C The second model input terminal is used to receive the network-side statistical sequence X. N The model output is used to output the anomaly prediction vector Y; The first prediction model includes a first LSTM model, a first MLP model, a second LSTM model, a second MLP model, a first fusion layer, a third MLP model, a first prediction head, a second prediction head, a third prediction head, a fourth prediction head, and an output layer; The input of the first LSTM model is connected to the input of the first model, and the output is connected to the input of the first MLP model. The output of the first MLP model is connected to the first input of the first fusion layer; The input of the second LSTM model is connected to the input of the second model, and the output is connected to the input of the second MLP model. The output of the second MLP model is connected to the second input of the first fusion layer; the output of the first fusion layer is connected to the input of the third MLP model. The output of the third MLP model is connected to the inputs of the parallel first prediction head, second prediction head, third prediction head, and fourth prediction head, respectively; the outputs of the parallel first prediction head, second prediction head, third prediction head, and fourth prediction head are connected to the corresponding first input, second input, third input, and fourth input of the output layer, respectively; the output of the output layer is connected to the model output. The first LSTM model is used to process the cloud-side statistical sequence X. C Sequence feature encoding is performed to obtain the corresponding feature vector sequence. ; and the last feature vector of the sequence As the corresponding feature vector H C Send to the first MLP model; Wherein, the feature vector sequence N eigenvectors Composition, the feature vector With the sampling statistics vector One-to-one correspondence; the feature vector H C The shape is 1×D LSTM1 D LSTM1 The feature dimension corresponding to the first LSTM model; The first MLP model is used to process the feature vector H C The corresponding feature vector H1 is obtained by feature encoding and sent to the first fusion layer; The reasoning method of the first MLP model is as follows: ； W 1,1 W 1,2 Let b be the first and second weight matrices corresponding to the first MLP model. 1,1 b 1,2 W represents the first and second bias vectors corresponding to the first MLP model. 1,1 The shape is D 1,1 ×D LSTM1 W 1,2 The shape is D 1,2 ×D 1,1 b 1,1 The shape is 1×D 1,1 b 1,2 The shape is 1×D 1,2 D 1,1 D 1,2 The first and second feature dimensions are the first and second feature dimensions corresponding to the first MLP model; ReLU() is the ReLU activation function; the feature vector H1 has a shape of 1×D. 1,2 ; The second LSTM model is used for the network-side statistical sequence X. N Sequence feature encoding is performed to obtain the corresponding feature vector sequence. ; and the last feature vector of the sequence As the corresponding feature vector H N Send to the second MLP model; Wherein, the feature vector sequence N eigenvectors Composition, the feature vector With the sampling statistics vector One-to-one correspondence; the feature vector H N The shape is 1×D LSTM2 D LSTM2 The feature dimension corresponding to the second LSTM model; The second MLP model is used to process the feature vector H N The corresponding feature vector H2 is obtained by feature encoding and sent to the first fusion layer; The reasoning method of the second MLP model is as follows: ； W 2,1 W 2,2 Let b be the first and second weight matrices corresponding to the second MLP model. 2,1 b 2,2 W represents the first and second bias vectors corresponding to the second MLP model. 2,1 The shape is D 2,1 ×D LSTM2 W 2,2 The shape is D 2,2 ×D 2,1 b 2,1 The shape is 1×D 2,1 b 2,2 The shape is 1×D 2,2 D 2,1 D 2,2 These are the first and second feature dimensions corresponding to the second MLP model; the feature vector H2 has a shape of 1×D. 2,2 ; The first fusion layer is used to concatenate the feature vectors H1 and H2 to obtain the corresponding feature vector H3 and send it to the third MLP model; The shape of the feature vector H3 is 1×(D 1,2 +D 2,2 ); The third MLP model is used to perform feature encoding on the feature vector H3 to obtain the corresponding feature vector H4, which is then sent to the first prediction head, the second prediction head, the third prediction head, and the fourth prediction head. The reasoning method of the third MLP model is as follows: ； W 3,1 W 3,2 Let b be the first and second weight matrices corresponding to the third MLP model. 3,1 b 3,2 W represents the first and second bias vectors corresponding to the third MLP model. 3,1 The shape is D 3,1 ×(D 1,2 +D 2,2 ), W 3,2 The shape is D 3,2 ×D 3,1 b 3,1 The shape is 1×D 3,1 b 3,2 The shape is 1×D 3,2 D 3,1 D 3,2 The first and second feature dimensions correspond to the third MLP model; the feature vector H4 has a shape of 1×D. 3,2 ; The first prediction head is used to perform binary classification prediction of push abnormal events based on the feature vector H4 to obtain the corresponding push abnormal prediction vector y1 and send it to the output layer. The reasoning method of the first prediction head is as follows: ； W 4,1 b 4,1 W represents the weight matrix and bias vector corresponding to the first prediction head. 4,1 The shape is 2×D 3,2 b 4,1 The shape is 1×2; softmax() is the Softmax function; The second prediction head is used to perform binary classification prediction of the delivery anomaly event based on the feature vector H4 to obtain the corresponding delivery anomaly prediction vector y2 and send it to the output layer; The reasoning method of the second prediction head is as follows: ； W 4,2 b 4,2 W represents the weight matrix and bias vector corresponding to the second prediction head. 4,2 The shape is 2×D 3,2 b 4,2 The shape is 1×2; The third prediction head is used to perform binary classification prediction of the feedback anomaly event based on the feature vector H4 to obtain the corresponding feedback anomaly prediction vector y3 and send it to the output layer. The reasoning method of the third prediction head is as follows: ； W 4,3 b 4,3 W represents the weight matrix and bias vector corresponding to the third prediction head. 4,3 The shape is 2×D 3,2 b 4,3 The shape is 1×2; The fourth prediction head is used to perform binary classification prediction of the unsubscription anomaly event based on the feature vector H4 to obtain the corresponding unsubscription anomaly prediction vector y4 and send it to the output layer. The reasoning method of the fourth prediction head is as follows: ； W 4,4 b 4,4 W represents the weight matrix and bias vector corresponding to the fourth prediction head. 4,4 The shape is 2×D 3,2 b 4,4 The shape is 1×2; The output layer is used to combine the push anomaly prediction vector y1, the delivery anomaly prediction vector y2, the feedback anomaly prediction vector y3, and the unsubscribe anomaly prediction vector y4 into a corresponding anomaly prediction vector Y and output it.

4. The processing method for anomaly analysis based on cloud-network convergence characteristics according to claim 2, characterized in that, The construction of the first dataset by analyzing the historical operation and maintenance logs of the information push platform specifically includes: Step 41: Filter and extract the historical operation and maintenance logs of the information push platform over the past M years to obtain the corresponding original log set; The historical operation and maintenance logs of the information push platform contain a collection of log data items that cover the data item collection. The quantity M is a preset positive integer; The original log set includes a subset of normal logs and a subset of abnormal logs; The normal log subset includes multiple normal time period log sets; each normal time period log set corresponds to an operation and maintenance period in which no abnormal events have occurred, and consists of historical operation and maintenance logs within that period; The subset of abnormal logs includes multiple sets of abnormal time period logs; each set of abnormal time period logs corresponds to an operation and maintenance period in which some or all abnormal events occurred, and consists of historical operation and maintenance logs within that period. The duration of each normal period log set and each abnormal period log set is greater than or equal to the sampling period length, where the sampling period length = △T×N; The total number of log sets in the normal log subset is less than or equal to the total number of log sets in the abnormal log subset; Step 42: Based on each of the normal time period log sets, extract the corresponding cloud-side statistical sequences from both sides of the cloud network to obtain the corresponding cloud-side statistical sequence X. C and the network-side statistical sequence X N ; and configure the corresponding label anomaly vector Y for each of the normal time period log sets. tag ; and a set of cloud-side statistical sequences X corresponding to each of the normal time period log sets. C The network-side statistical sequence X N and the label anomaly vector Y tag Form a corresponding first data record; Among them, the label anomaly vector Y corresponding to each of the normal time period log sets tag All positive label probabilities All are 0; Step 43: Based on the log sets of each abnormal period, extract the corresponding cloud-side statistical sequences from both sides of the network to obtain the corresponding cloud-side statistical sequence X. C and the network-side statistical sequence X N Based on the single or combined abnormal event types corresponding to each of the abnormal time period log sets, the corresponding label abnormal vector Y is configured for it. tag ; and a set of cloud-side statistical sequences X corresponding to each of the aforementioned abnormal time period log sets. C The network-side statistical sequence X N and the label anomaly vector Y tag Form a corresponding first data record; Among them, the label anomaly vector Y corresponding to each of the abnormal time period log sets tag Partial or all of the positive label probability =1; Step 44: The first dataset is composed of all the first data records obtained.

5. The processing method for anomaly analysis based on cloud-network convergence characteristics according to claim 2, characterized in that, Training the first prediction model based on the first dataset specifically includes: Step 51: Based on a preset first segmentation ratio, the first dataset is randomly divided into two subsets, denoted as the first training set and the first evaluation set. Both the first training set and the first evaluation set consist of multiple first data records; The total number of records in the first training set is denoted as N. tr The total number of records in the first evaluation set is denoted as N. av The ratio N of the total number of records in the first training set to the total number of records in the first evaluation set. tr :N av The first segmentation ratio is satisfied; Each of the label anomaly vectors Y in the first training set tag Record as the corresponding Each of the labeled anomaly vectors Y tag The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; 1 ≤ index i ≤ N tr ; The label anomaly vectors Y of the first evaluation set tag Record as the corresponding Each of the labeled anomaly vectors Y tag The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; 1 ≤ index j ≤ N av ; Step 52, take the cloud-side statistical sequence X of each of the first data records in the first training set. C and the network-side statistical sequence X N The first prediction model is input for processing, and the anomaly prediction vector Y output by the model in this processing is denoted as the corresponding... and the current anomaly prediction vector The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; and by each of the aforementioned anomaly prediction vectors and its corresponding label anomaly vector Form a corresponding first prediction-label pair; Step 53, obtain N tr Substituting the first prediction-label pair into the preset first model loss function L M The corresponding first loss value is obtained through calculation; Wherein, the first model loss function L M for: ； Step 54: Identify whether the first loss value meets the preset first loss value range; if it does, proceed to step 55; if not, based on the preset first model optimizer, move towards making the first model loss function L... M The direction that reaches the minimum value modulates the model parameters of the first prediction model in one round, and returns to step 52 when the modulation ends; The first model optimizer includes the Adam optimizer and the SGD optimizer. Step 55, the cloud-side statistical sequence X of each of the first data records in the first evaluation set. C and the network-side statistical sequence X N The first prediction model is input for processing, and the anomaly prediction vector Y output by the model in this processing is denoted as the corresponding... and the current anomaly prediction vector The corresponding probabilities of all positive and negative labels , Record as the corresponding , ; and by each of the aforementioned anomaly prediction vectors and its corresponding label anomaly vector Form a corresponding second prediction-label pair; and based on the obtained N av The accuracy, precision, recall, and F1 score of the second prediction-label pair are statistically analyzed to obtain the corresponding first accuracy, first precision, first recall, and first F1 score; Step 56: Identify whether the first accuracy, first precision, first recall, and first F1 score all satisfy their respective first accuracy range, first precision range, first recall range, and first F1 score range; if not, return to step 51; if yes, stop training and confirm that the model training is complete.

6. The processing method for anomaly analysis based on cloud-network convergence characteristics according to claim 1, characterized in that, The periodic analysis and early warning processing of abnormal events on the information push platform based on the first database and the first prediction model specifically includes: According to the preset anomaly analysis frequency, the N most recently collected records from the first database are periodically extracted to form the corresponding current record set; And based on the first dataset of each of the first collected records in the current record set, set the corresponding sampling statistics vector. and the sampling statistics vector ; and consisting of the N sampling statistical vectors corresponding to the current record set. The corresponding cloud-side statistical sequence X is formed. C The N sampling statistical vectors corresponding to the current record set The corresponding network-side statistical sequence X is formed. N ; And the current cloud-side statistical sequence X C and the network-side statistical sequence X N The first prediction model is input and processed to obtain the corresponding anomaly prediction vector Y; And the various anomaly prediction vectors y of the current anomaly prediction vector Y s As the current prediction vector; and the positive prediction probability of the current prediction vector. If the anomaly probability exceeds a preset threshold, an identification process is initiated; if so, the corresponding subsequent action A is set. s For warning purposes; otherwise, set the corresponding subsequent action A. s None; the subsequent action A s The action types include two categories: warning and none; And in all the subsequent actions A obtained s When not all are zero, perform the subsequent action A for each non-zero value. s As the current action; and activate the pre-set abnormal event warning and handling process corresponding to the current action on the information push platform.

7. An apparatus for performing the processing method for anomaly analysis based on cloud-network convergence features as described in any one of claims 1-6, characterized in that, The device includes: a cloud network data selection module, a model building and training module, a cloud network data acquisition module, and an anomaly analysis and early warning module; The cloud-network side data selection module selects and matches data items from both sides of the cloud and network for analyzing four types of abnormal events on the information push platform to obtain a set of data items. The four types of abnormal events include push abnormal events, delivery abnormal events, feedback abnormal events, and unsubscribe abnormal events. The set of data items includes a cloud-side subset and a network-side subset. The data items in the cloud-side subset include submission volume, delivery volume, delivery rate, mean delivery rate, standard deviation of delivery rate, feedback volume, feedback rate, mean feedback rate, standard deviation of feedback rate, unsubscribe volume, unsubscribe rate, mean unsubscribe rate, standard deviation of unsubscribe rate, push latency, mean push latency, and standard deviation of push latency. The data items in the network-side subset include network latency, network jitter, network packet loss rate, data retransmission rate, operator gateway connection success rate, and operator concurrent connection volume. The model building and training module constructs a first prediction model for handling four types of anomaly predictions; constructs a first dataset by analyzing the historical operation and maintenance logs of the information push platform; and trains the first prediction model based on the first dataset. The first prediction model is used to calculate the cloud-side statistical sequence X input to the model. C And network side statistical sequence X N Four types of anomalies are predicted and corresponding anomaly prediction vectors Y are output; the cloud-side statistical sequence X C The sampling statistics vector at N consecutive sampling times The composition consists of a preset interval ΔT between two consecutive sampling times, where N is the preset total number of sampling points, and 1 ≤ index t ≤ N; each of the sampling statistical vectors Each consists of a set of real-time statistical data corresponding to the cloud-side subset; the network-side statistical sequence X N The temporal relationship between the cloud-side statistical sequence X C To maintain consistency, it also consists of corresponding N sampling statistical vectors. Composition; each of the sampling statistical vectors Each is composed of a set of real-time statistical data corresponding to the network-side subset; the anomaly prediction vector Y is composed of push anomaly prediction vector y1, delivery anomaly prediction vector y2, feedback anomaly prediction vector y3, and unsubscribe anomaly prediction vector y4; each type of anomaly prediction vector y s Each has a corresponding set of positive and negative prediction probabilities. , Composition, 1 ≤ index s ≤ 4; positive and negative prediction probabilities for each group. , Used to characterize the probability of occurrence or non-occurrence of type s-th abnormal events. , , ; The data acquisition modules on both sides of the cloud network are used to set the corresponding acquisition frequency according to the interval duration △T; and periodically collect real-time statistical data from both sides of the cloud network based on the acquisition frequency and update the first database based on the collected data; acquisition frequency = 1 / △T; the first database includes multiple first acquisition records; the acquisition interval between every two adjacent first acquisition records matches the interval duration △T; the first acquisition record includes a first timestamp and a first dataset; the first dataset includes multiple first data key-value pairs, and the first data key-value pairs correspond one-to-one with the data items in the data item set; each first data key-value pair consists of a set of corresponding first data names and first data values, where the first data name is the data item name of its corresponding data item, and the first data value is the real-time statistical data of its corresponding data item; The anomaly analysis and early warning module is used to periodically analyze and issue early warnings for abnormal events on the information push platform based on the first database and the first prediction model.

8. An electronic device, characterized in that, include: Memory, processor, and transceiver; The processor is configured to be coupled to the memory, read and execute instructions in the memory to implement the method according to any one of claims 1-6; The transceiver is coupled to the processor, and the processor controls the transceiver to send and receive messages.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a computer, cause the computer to perform the method according to any one of claims 1-6.

Images