Abnormality diagnosis system, method, device, medium, and product

Abstract

The present disclosure relates to the technical field of communication, in particular to an abnormality diagnosis system, method, device, medium and product. The abnormality diagnosis system comprises a data processing module, a diagnosis module and an abnormality handling module. The data processing module is configured to acquire real-time index data of a diagnosis object at multiple network levels, and perform degradation determination on each index in the real-time index data based on historical index data and reference data of the diagnosis object to obtain a determination result carrying a degraded index. The diagnosis module is configured to determine a core degraded index in the real-time index data based on the determination result, and determine a target diagnosis mode from multiple preset diagnosis modes according to the type of the core degraded index. The abnormality handling module is configured to locate an abnormal root cause of the diagnosis object according to the target diagnosis mode, and execute a corresponding handling strategy based on the type of the abnormal root cause when the degradation degree of the corresponding index at each network level meets a preset degradation degree condition.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and more specifically, to an anomaly diagnosis system, method, device, medium, and product. Background Technology

[0002] With the deep integration of communication technology, cloud computing and edge computing, network content services (such as video on demand, e-commerce platforms, online office, etc.) have become the core carrier of the digital economy, and users' requirements for the real-time and stability of content transmission continue to increase.

[0003] In related technologies, a single indicator or fixed threshold is usually used for anomaly localization, which cannot adapt to the dynamic changes in the network environment. During peak business periods, normal latency will naturally increase, which can easily lead to misjudgment or missed judgment, resulting in insufficient accuracy of anomaly diagnosis. Summary of the Invention

[0004] This disclosure is made in view of the above-mentioned problems. This disclosure provides an anomaly diagnosis system, method, apparatus, medium, and product.

[0005] In a first aspect, embodiments of this disclosure provide an anomaly diagnosis system, which includes a data processing module, a diagnosis module, and an anomaly handling module, comprising: The data processing module is used to acquire real-time indicator data of the diagnostic object at multiple network layers; and based on the historical indicator data and benchmark data of the diagnostic object, to determine the degradation of each indicator in the real-time indicator data and obtain the determination result carrying the degradation indicator.

[0006] The diagnostic module is used to determine the core degradation indicators in the real-time indicator data based on the judgment results; and to determine the target diagnostic method from multiple preset diagnostic methods according to the type of the core degradation indicators.

[0007] The anomaly handling module is used to locate the root cause of the anomaly in the diagnostic object according to the target diagnostic method; and to execute the corresponding handling strategy based on the type of the anomaly root cause when the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition.

[0008] In one embodiment of the first aspect, the network layers include the Domain Name System layer, the network transport layer, and the service application layer. Locating the root cause of the abnormality of the diagnostic object according to the target diagnostic method includes: When the target diagnostic method is domain-level diagnostic, the root cause localization process is performed on the domain name associated with the diagnostic object based on the real-time indicator data corresponding to the domain name in the domain name system layer. After processing, the first diagnostic result is obtained, which includes the domain name server identified as the abnormal root cause.

[0009] When the target diagnosis method is address-level diagnosis, joint root cause localization processing is performed on the network address associated with the diagnostic object based on the real-time indicator data corresponding to the network address in the network transport layer and business application layer. After processing, a second diagnostic result including the type of abnormal problem is obtained.

[0010] In one embodiment of the first aspect, the real-time indicator data corresponding to the domain name system layer includes subdomain information of the domain name and domain name server information for resolving the domain name. The domain name server information includes the domain name resolution success rate and the number of resolution failures of multiple domain name servers. Root cause analysis is performed based on real-time metric data corresponding to the domain name at the Domain Name System (DNS) layer. The resulting analysis yields a first diagnostic result, including the domain name servers identified as the root cause of the anomaly. Domain name servers whose domain name resolution success rate and number of resolution failures both meet the preset resolution conditions are identified as potential abnormal candidate domain name servers.

[0011] Calculate the probability of anomalies in candidate domain name servers based on subdomain information.

[0012] If the anomaly probability meets the anomaly requirements, the candidate domain name server corresponding to that anomaly probability is identified as the domain name server of the root cause of the anomaly, and the first diagnostic result is output.

[0013] In one embodiment of the first aspect, the real-time indicator data corresponding to the network transport layer includes the transmission control protocol handshake delay and the transmission control protocol packet loss rate, and the real-time indicator data corresponding to the service application layer includes resource download time and resource download rate. Joint root cause analysis is performed based on real-time indicator data corresponding to the network address in the network transport layer and business application layer. The resulting second diagnostic result includes the type of abnormal problem, including: If at least one of the Transmission Control Protocol (TCP) handshake delay and TCP packet loss rate corresponding to the network address fails to meet the first transmission condition, a second diagnostic result is obtained to indicate network path anomalies.

[0014] If the Transmission Control Protocol (TCP) handshake delay and TCP packet loss rate corresponding to the network address both meet the first transmission condition, and at least one of the resource download time and resource download rate corresponding to the network address meets the second transmission condition, a second diagnostic result is obtained to indicate an anomaly in the business server.

[0015] In one embodiment of the first aspect, after obtaining a second diagnostic result including the type of abnormal problem after processing, the system is further configured to: If a second diagnostic result is obtained to indicate an anomaly in the network path, the absolute latency of the nodes in the network path indicated by the second diagnostic result is obtained.

[0016] The latency increment of the node is calculated based on the absolute latency. The contribution of each node to the total latency increment relative to the network path indicated by the second diagnostic result is calculated based on the latency increment.

[0017] If both the node's contribution and absolute latency meet the preset judgment conditions, the node is determined to be an abnormal node, and a third diagnostic result including the abnormal node is output.

[0018] In one embodiment of the first aspect, determining a target diagnostic method from a plurality of preset diagnostic methods based on the type of the core degradation indicator includes: When the core degradation indicator is a domain name resolution indicator, domain name-level diagnosis is determined as the target diagnostic method corresponding to the core degradation indicator.

[0019] When the core degradation indicator is a network transmission indicator, address-level diagnosis is determined as the target diagnostic method corresponding to the core degradation indicator.

[0020] When the core degradation indicator is a comprehensive indicator, domain-level diagnosis and address-level diagnosis are determined as the target diagnostic methods corresponding to the core degradation indicator; among them, the comprehensive indicator is used to indicate the indicator that is affected by the performance of multiple network layers.

[0021] In one embodiment of the first aspect, based on historical indicator data and baseline data of the diagnostic object, a degradation determination is made for each indicator in the real-time indicator data to obtain a determination result carrying the degradation indicator, including: For any given indicator, the degree of degradation of the indicator is calculated based on the indicator mean in historical indicator data and the indicator value in real-time indicator data.

[0022] Determine the difference between real-time indicator values ​​and baseline data.

[0023] If the degree of degradation meets the first degradation condition, a first determination result is obtained to indicate that the index is the first degradation index.

[0024] If at least one of the difference and the degree of degradation satisfies the second degradation condition, a second determination result is obtained to indicate that the index is a second degradation index; wherein the degree of degradation of the second degradation index is higher than the degree of degradation of the first degradation index.

[0025] In one embodiment of the first aspect, after obtaining the determination result carrying the degradation index, the method further includes: If a second degradation indicator is found in the degradation indicator carried by the judgment result, the step of determining the core degradation indicator is interrupted, and the corresponding emergency response strategy is executed based on the second degradation indicator first.

[0026] In one embodiment of the first aspect, determining the core degradation indicators in the real-time indicator data based on the judgment result includes: The mean and standard deviation of the degradation indicators carried by the judgment result are determined based on historical indicator data.

[0027] Based on historical and real-time indicator data, the degree of degradation of the degradation indicators carried by the judgment result is calculated.

[0028] The mean, standard deviation, and degree of degradation of the degradation indicators carried by the judgment result are calculated, and the degradation indicator corresponding to the maximum value after calculation is determined as the core degradation indicator.

[0029] In one embodiment of the first aspect, when the degradation degree of the corresponding indicator at each network layer meets a preset degradation degree condition, a corresponding handling strategy is executed based on the type of the abnormal root cause, including: The degradation degree of each indicator in the same network layer is aggregated to obtain the degradation degree of each network layer.

[0030] The degradation degree of each network layer is weighted and summed to obtain the quality score.

[0031] If the poor quality score exceeds the scoring threshold, the appropriate handling strategy matching the type of the abnormal root cause is retrieved from the handling strategy library and executed.

[0032] In a second aspect, embodiments of this disclosure provide an anomaly diagnosis method applied to an anomaly diagnosis system including a data processing module, a diagnosis module, and an anomaly handling module, comprising: Obtain real-time indicator data for the diagnostic target across multiple network layers.

[0033] Based on the historical and baseline data of the diagnostic subjects, the degradation of each indicator in the real-time indicator data is determined, and the determination result of the deteriorated indicator is obtained.

[0034] Based on the judgment results, the core degradation indicators in the real-time indicator data are determined, and the target diagnostic method is determined from multiple preset diagnostic methods according to the type of the core degradation indicators.

[0035] The root cause of the abnormality of the diagnostic object is located according to the target diagnostic method. If the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition, the corresponding treatment strategy is executed based on the type of abnormal root cause.

[0036] In a third aspect, embodiments of this disclosure provide an electronic device, including: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, the steps in the above-described anomaly diagnosis method are performed.

[0037] In a fourth aspect, embodiments of this disclosure provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps in the above-described anomaly diagnosis method.

[0038] In a fifth aspect, embodiments of this disclosure provide a computer program product stored in a storage medium, the program product being executed by at least one processor to implement the steps in the above-described anomaly diagnosis method.

[0039] As will be described in detail below, an anomaly diagnosis system, method, device, medium, and product according to embodiments of this disclosure are provided. In embodiments of this disclosure, a data processing module first acquires real-time indicator data of the diagnostic object at multiple network layers. Then, based on the historical indicator data and baseline data of the diagnostic object, it performs degradation judgment on each indicator in the real-time indicator data to obtain a judgment result carrying the degradation indicator. The judgment result is then sent to the diagnosis module. The diagnosis module is used to determine the core degradation indicator in the real-time indicator data based on the judgment result, and to determine the target diagnosis method from multiple preset diagnosis methods according to the type of the core degradation indicator. The target diagnosis method is then sent to the anomaly handling module. The anomaly handling module locates the root cause of the anomaly of the diagnostic object according to the target diagnosis method, and executes the corresponding handling strategy based on the type of the root cause of the anomaly when the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition. Through the above processing method, a dynamically adjustable degradation judgment standard is generated by dual judgment of historical indicator data and benchmark data. This provides a quantitative basis for the system to accurately diagnose anomalies and locate the core degradation source based on the judgment result to help determine the direction of diagnosis. Furthermore, the strategy of determining the target diagnosis method is determined through multi-layer indicator data to prevent the root cause location from being based on a single dimension. This can effectively improve the accuracy and comprehensiveness of root cause location. Then, based on the type of anomaly, the corresponding treatment strategy is accurately matched and executed, realizing a closed loop of diagnosis-location-treatment through an automated process, thereby improving diagnostic efficiency.

[0040] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0041] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0042] Figure 1 This is an architecture diagram of an anomaly diagnosis system according to an embodiment of the present disclosure.

[0043] Figure 2 This is a flowchart of an anomaly diagnosis method according to an embodiment of the present disclosure.

[0044] Figure 3 This is an overall flowchart of an abnormality diagnosis method according to an embodiment of the present disclosure.

[0045] Figure 4 This is a schematic diagram of an electronic device according to an embodiment of the present disclosure.

[0046] Figure 5 This is a schematic diagram of a computer program product according to an embodiment of the present disclosure. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0048] To facilitate understanding of this embodiment, a detailed description of an anomaly diagnosis system disclosed in this disclosure will be provided first, see [link to relevant documentation]. Figure 1 The diagram shown is an architecture diagram of an anomaly diagnosis system provided in an embodiment of this disclosure. The anomaly diagnosis system includes a data processing module, a diagnosis module, and an anomaly handling module.

[0049] The data processing module includes a data acquisition module 101 and a dynamic threshold calculation module 102; the diagnosis module includes a multi-level diagnosis engine 103; and the anomaly handling module includes a root cause localization module 104, an adaptive weight decision model 105, and a closed-loop handling engine 106.

[0050] In addition, the anomaly diagnosis system also includes a visualization interface module 107. The visualization interface module is used to render the web page access routing topology diagram, output diagnostic conclusions in stages, such as degradation degree, degradation index, root cause of anomaly and handling suggestions, and provide a corresponding anomaly details download interface.

[0051] The data acquisition module is a data entry point based on multi-level dynamic thresholds and closed-loop processing. By collecting various key data in all aspects, it provides a solid data foundation for subsequent dynamic threshold calculation, multi-level diagnosis, and intelligent decision-making.

[0052] Specifically, the data acquisition module includes a diagnostic object and time range acquisition unit, a multi-source data synchronization unit, and a data preprocessing and standardization unit.

[0053] The diagnostic object and time range acquisition unit is used to provide a standardized user input interface, allowing users to specify diagnostic objects and time ranges through a graphical interface. The diagnostic objects include objects at different levels such as business level (e.g., specific application services), address level (e.g., server network address), and domain level (e.g., website domain name). It can support the selection of a single object or a batch of objects at the same time. Different diagnostic objects can correspond to different network levels, and the real-time indicator data are also different at different network levels.

[0054] The diagnostic object and time range acquisition unit is also used to perform format validation and standardization processing on the diagnostic object and time range input by the user.

[0055] The verification process includes: verifying the legality of the diagnostic object, such as whether the address format is correct and whether the domain name exists; verifying the validity of the time range, such as whether the start time is earlier than the end time and whether the time range is within the system's data storage range. The verified inputs are then converted into a unified system data format to ensure that subsequent modules can correctly identify and process them.

[0056] The diagnostic object and time range acquisition unit is also used to prioritize multiple concurrent data acquisition tasks based on factors such as the importance of the diagnostic object and the urgency of the time range. This enables real-time diagnostic tasks for important business operations to be processed first, while non-urgent historical data analysis tasks are processed in queue order, ensuring the reasonable allocation of system resources and timely response to critical tasks.

[0057] The multi-source data synchronization unit is used to design a flexible interface adaptation layer to establish connections with various probing systems. It supports different protocols, such as Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS), and Transmission Control Protocol (TCP), as well as data formats such as JSON, XML, and CSV for probing data access. This can be achieved through configuration to quickly connect with probing systems from different vendors, improving system compatibility and scalability.

[0058] Furthermore, various real-time indicator data can be synchronized from the testing system according to the diagnostic objects and time ranges specified by the user, including data corresponding to the Domain Name System layer, network transport layer and business application layer respectively.

[0059] The real-time metrics data in the Domain Name System layer include domain name resolution success rate, resolution latency, domain name server response time, number of resolution failures, and subdomain information; the real-time metrics data in the network transport layer include TCP connection success rate, TCP handshake latency, TCP transmission rate, and TCP packet loss rate; and the real-time metrics data in the business application layer include first packet latency, resource download time, resource download rate, first screen homepage loading time, and access success rate.

[0060] The multi-source data synchronization unit can also adopt an incremental data synchronization strategy to obtain data that has been added or changed since the last synchronization, reducing data transmission volume and system resource consumption. It also marks the update status of data through timestamps, data version numbers, etc., to ensure the accuracy and integrity of data synchronization.

[0061] The data preprocessing and standardization unit is used for data cleaning, data transformation and standardization, data association and fusion, and data caching and storage.

[0062] In data cleaning, it can be used to clean the collected raw data (i.e., real-time indicator data), remove invalid data (e.g., null values, outliers), duplicate data and noisy data, and then use statistical methods to identify outliers (e.g., data that exceeds the normal range by 3 times the standard deviation) and correct or remove them according to preset rules to ensure the accuracy of the data.

[0063] In data conversion and standardization, data from different sources and in different formats are converted into a unified data format and indicator definition, and numerical indicators are normalized and mapped to a unified numerical range. Categorical data is also encoded (e.g., one-hot encoding) to facilitate subsequent algorithm analysis and processing.

[0064] In data association and fusion, it is used to establish the relationship between different types of data and realize the fusion of multi-source data. For example, the data corresponding to the domain name system layer, network transmission layer and business application layer of the same diagnostic object are associated according to the time dimension to form a complete business access data chain. In addition, the data of different levels of diagnostic objects (e.g., domain name and address) are associated to realize cross-level data traceability.

[0065] In data caching and storage, preprocessed standardized data can be temporarily stored in the local cache to improve data access speed. At the same time, the data is persisted to the database according to the preset storage strategy, supporting historical data query and trend analysis. This data storage adopts a distributed architecture to ensure storage performance and reliability under large data volumes.

[0066] This disclosure provides a detailed description of the workflow of the data acquisition module, which includes an initialization phase, a diagnostic object and time range acquisition phase, a data synchronization phase, a data preprocessing phase, and a data provision phase.

[0067] During the initialization phase, after the data acquisition module starts up, it first completes the initialization of its own hardware and software, such as network interface configuration, database connection initialization, and interface adaptation layer loading; then it loads the system's preset configuration information such as diagnostic object types, indicator definitions, and data acquisition strategies, and initializes the data cache and storage structure; finally, it establishes a connection with the dial-up testing system, negotiates communication protocols and performs identity authentication to ensure the security of data transmission.

[0068] Following this, in the diagnostic object and time range acquisition phase, the system can receive diagnostic requests submitted by users through a graphical interface or API, parse the diagnostic object and time range information in the request, and perform verification and standardization processing on the diagnostic object and time range. If verification fails, an error message is returned; if verification passes, a standardized diagnostic task is generated, and then it can be added to the task queue for processing according to the priority of the diagnostic task.

[0069] Furthermore, during the data synchronization phase, diagnostic tasks can be retrieved from the task queue, and data collection requests can be generated based on the diagnostic objects and time ranges within the tasks. Then, the data collection request is sent to the corresponding testing system via the interface adaptation layer to request the acquisition of specified real-time indicator data. It can also receive real-time indicator data returned by the testing system, perform integrity verification on the data, and ensure that the data has not been tampered with and is complete and error-free.

[0070] For incremental synchronization scenarios, only data that has been added or changed since the last synchronization is processed, which can improve processing efficiency.

[0071] In the data preprocessing stage, the collected real-time indicator data can be cleaned to remove invalid, duplicate, and noisy data. Then, the cleaned data is transformed and standardized to unify the data format and indicator definitions, resulting in standardized results. Furthermore, the correlation between different types of data in the standardized results is established to achieve the fusion of multi-source data and obtain data fusion results. Finally, the preprocessed data fusion results are stored in local cache and database to provide data support for subsequent modules.

[0072] During the data provision phase, the system responds to data query requests from other modules in the anomaly diagnosis system, extracts relevant data from the cache or database based on the request parameters, encapsulates the extracted data in a specified format, and records data query logs, including query time, query parameters, and the amount of data returned, to provide a basis for system performance analysis and optimization.

[0073] When the diagnostic task is completed or a stop command is received, the data acquisition module stops data synchronization and preprocessing operations, saves the system's operating status and configuration parameters, and releases system resources.

[0074] The dynamic threshold calculation module is a benchmark based on multi-level dynamic thresholds and closed-loop processing. By integrating historical indicator data and benchmark data of the diagnostic object, it generates dynamically adjustable degradation judgment criteria, providing a quantitative basis for the system to accurately identify content quality problems.

[0075] Specifically, the dynamic threshold calculation module includes a historical data statistical analysis unit, a competitive operator benchmark value management unit, and a dynamic degradation calculation and judgment unit.

[0076] The historical data statistical analysis unit connects to the data acquisition module and stores the corresponding historical indicator data according to multiple network levels of the diagnostic object. It can support data extraction at multiple time granularities and establish a data index to ensure that the query response time for historical indicator data meets the standard, for example, ≤100ms.

[0077] The historical data statistical analysis unit can also use the sliding window algorithm to calculate the indicator mean, as well as simultaneously calculate the deviation between the 7-day and 15-day short-term mean and the 30-day long-term mean of the indicator, and reduce the weight of the historical mean in subsequent processing to avoid threshold bias caused by the lag of historical data.

[0078] The competitor operator benchmark management unit periodically collects the best values ​​of similar indicators from operators through industry monitoring interfaces or third-party data service providers. The collection dimensions include geographic, business, and time-period dimensions. Geographic dimensions can be divided by province or city; business dimensions by business type; and time-period dimensions can be divided by peak or off-peak periods.

[0079] To address this, corresponding benchmark data can be selected based on the attributes of the diagnostic object. During the selection process, benchmarks from the same region and the same service type can be prioritized. If benchmarks from the same region and the same service type are missing, benchmarks from the same region and similar service types, or benchmarks from the same service type and neighboring regions, can be selected. The selected benchmark data should be validated for reasonableness, for example, by excluding abnormally low benchmark values ​​caused by temporary operator failures, to ensure that base station data reflects the industry's optimal level.

[0080] The dynamic degradation calculation and judgment unit can determine the degradation of indicators in real-time indicator data based on the historical indicator data and benchmark data of the diagnostic object, generate degradation degree and judgment results carrying degradation indicators, and provide trigger signals for subsequent diagnostic processes.

[0081] Based on this, a visual configuration interface can also be provided, allowing operation and maintenance personnel to adjust the threshold calculation parameters according to business needs. These threshold calculation parameters include historical average period, degradation threshold, and additional thresholds for latency indicators. Configuration changes take effect in real time without requiring module restarts, enabling on-demand adjustment and flexible adaptation.

[0082] This disclosure provides a detailed description of the workflow of the dynamic threshold calculation module, which includes an initialization phase, a baseline value calculation phase, and a real-time degradation determination phase.

[0083] During the initialization phase of the dynamic threshold calculation module, after the module starts, it loads the historical data statistics template and the initial data of the competitive operator benchmark library, establishes a data subscription relationship with the data acquisition module, and sets the interface parameters of real-time indicators, such as data format and update frequency.

[0084] In the benchmark calculation stage, the mean values ​​of each indicator are calculated, and appropriate benchmark data is generated based on the attributes of the diagnostic object, and then updated and stored in real time.

[0085] In the real-time degradation assessment stage, the real-time index values ​​and diagnostic object identifiers of each index in the real-time index data can be obtained, and the degradation degree of each index can be calculated based on these values, ultimately generating a assessment result carrying the degradation index.

[0086] When the system stops running, the dynamic threshold calculation module saves the current baseline value, degradation calculation record and configuration parameters, closes the data interface and releases memory resources.

[0087] The multi-level diagnostic engine is a core analysis hub based on multi-level dynamic thresholds and closed-loop processing. Based on the judgment results, it accurately locks the core degradation indicators through progressive diagnosis at each level. It avoids the waste of resources caused by traditional indiscriminate diagnosis and provides a clear problem direction for the root cause localization module. It is the core bridge to achieve a seamless connection between efficient diagnosis and accurate localization.

[0088] The multi-level diagnostic engine includes a business-level diagnostic submodule, an address-level diagnostic submodule, and a domain-level diagnostic submodule.

[0089] The business-level diagnostic submodule is used to integrate the degradation degree of the corresponding indicators of each network layer and trigger address-level or domain-level diagnostics to ensure rapid response to core anomalies; or to start basic indicator scanning at a specified frequency, such as focusing on monitoring domain name resolution success rate, TCP connection success rate, etc., to avoid hidden omissions of local indicator degradation.

[0090] The business-level diagnostic submodule is also used to locate core degradation indicators and accurately allocate lower-level diagnostic tasks according to the type of core degradation indicators to avoid resource mismatch. This will be described in detail later, and no further examples will be given here.

[0091] The core of the address-level diagnostic submodule is to distinguish between network-side and resource-side anomalies, while the core of the domain-level diagnostic submodule is to perform domain name resolution and associated link anomaly analysis, which can be extended to the entire link of resolution-connection-loading, ensuring that there are no blind spots in domain name-related quality issues. Specific processing procedures will be described in detail later.

[0092] This disclosure provides a detailed description of the workflow of a multi-level diagnostic engine, which includes a startup phase, a business-level diagnostic phase, a lower-level diagnostic phase, and a priority interruption handling phase.

[0093] After the multi-level diagnostic engine starts, that is, after entering the startup phase, it establishes a real-time data connection with the data acquisition module and the dynamic threshold calculation module, and loads the initial configuration parameters so that the business-level diagnostic submodule, address-level diagnostic submodule, and domain-level diagnostic submodule can cache their respective data.

[0094] In the business-level diagnostic phase, the core degradation indicators in the real-time indicator data are determined based on the judgment results obtained by the data processing module. Then, according to the type of the core degradation indicator, the corresponding target diagnostic method is triggered to enter the next level of diagnostic phase.

[0095] The next-level diagnostic phase is divided into address-level diagnostics and domain-level diagnostics. During the diagnostic process, it is possible to detect in real time whether there are severely degraded indicators, so that severely degraded indicators are bound to high priority. If a severely degraded indicator is abnormal, the current diagnostic process is stopped, and the severely degraded indicator is processed first, releasing the resources occupied by low-priority diagnostics.

[0096] After the diagnosis is completed, all diagnostic results are integrated, and the diagnostic log is saved to the system log repository for subsequent review and optimization. This diagnostic log includes the diagnostic time, the object being diagnosed, the triggering conditions, and the diagnostic conclusion. Finally, the caches of each submodule are reset, temporary resources are released, and the system awaits the next business-level diagnostic trigger.

[0097] The root cause localization module is the core of problem tracing based on multi-level dynamic thresholds and closed-loop processing. It is used to extract various abnormal root causes from complex network data, providing precise targeted treatment targets for the closed-loop processing engine. It is a key link to achieve effective connection between diagnosis and treatment.

[0098] The root cause localization module includes a data association and integration unit, an Internet Data Center (IDC) ownership change identification unit, an ultra-long latency node localization unit, and an abnormal domain name server localization unit.

[0099] The data association and integration unit is used to receive two types of core data in real time: Diagnostic data: Diagnostic conclusions output by multi-level diagnostic engines, such as latency degradation, high domain name S resolution failure rate, and a list of abnormal indicators.

[0100] Basic data: The system's pre-built failure code database includes explanations of the meanings of failure codes, such as 9001 corresponding to no response from the domain name server; it also includes node levels and link relationships, such as network topology diagrams of core layer nodes and edge layer nodes, and domain name server configuration information, such as server addresses and the range of subdomains they are responsible for resolving.

[0101] After that, data cleaning and standardization are performed first, and then duplicate data is removed to remove noise. For example, duplicate delay records and abnormal data for the same address are removed. Missing key fields (e.g., diagnosis conclusions lacking timestamps) are filled in by associating with other data. Then, addresses, timestamps, indicator units, etc. are converted into system unified standards. Finally, the mapping relationship between multiple data is established with addresses, timestamps, and subdomains as the core association identifiers.

[0102] For example, the diagnostic conclusion of Internet Protocol (IP) latency degradation can be associated with the historical location of the IP and the corresponding network path node to form an IP-location-path association chain.

[0103] The diagnostic conclusion of domain name resolution failure is associated with the domain name server responsible for resolving the domain name and the trigger record of failure code -9001, forming a relationship chain of domain name-domain name server-failure record. The associated data is stored in a structured table format to support quick access by subsequent algorithms.

[0104] The IDC attribution change identification unit can obtain the current attribution information of all IPs in the diagnostic object through the industry IP attribution query interface, such as the name of the IDC data center, the province of the data center, and the type of carrier.

[0105] On the other hand, the location records of the IP for the past 3 months can be retrieved from the IP location history database. The current information is compared with the historical information by province. If the current province is inconsistent with the historical province in the past month, it is determined to be an inter-provincial change of IDC location; if only the data center is changed but the province remains the same, it is determined to be an intra-provincial migration of IDC.

[0106] Furthermore, the impact on quality can be further assessed for IPs identified as having undergone cross-provincial changes in IDC ownership.

[0107] Specifically, the difference in TCP latency before and after the change can be calculated. If the TCP latency after the change increases by more than 100ms compared to before the change, and the dynamic threshold calculation module determines that it is severely degraded, then it is confirmed that the cross-province change of the IDC is the root cause of the current poor quality.

[0108] If the IP address corresponds to core business and has more than 5 associated subdomains, it should be marked as a high-impact root cause and prioritized for handling. In this case, an IDC (Internet Data Center) attribution change report can be generated. This report can include information such as IP address, original location, new location, change time, and latency degradation level, serving as the core content of the root cause report.

[0109] The ultra-long latency node localization unit is used to calculate the contribution of path degradation based on the network topology and degradation degree, and to quantify the contribution ratio of each node to the overall latency degradation. The specific processing procedure will be described in the following example.

[0110] The abnormal domain name server location unit is used to subsequently filter candidate domain name servers with potential abnormalities, as well as domain name servers with abnormal root causes.

[0111] This disclosure provides a detailed description of the workflow of the root cause localization module, which includes an initialization phase, a data reception and association phase, and a root cause analysis and localization phase.

[0112] The initialization phase of the root cause localization module is used to complete hardware self-test and software initialization, load basic network topology data and initial data from the IP location history database, establish interface connections with the multi-level diagnostic engine, data acquisition module, and dynamic threshold calculation module, set the data receiving frequency, and initialize relevant parameters such as path degradation contribution algorithm and anomaly threshold.

[0113] In the data receiving and association stage, basic data such as diagnostic conclusions, failure codes, IP attribution history, and domain name configurations are received and pushed. Data cleaning and standardization are performed to remove abnormal data, fill in missing fields, and unify the format. Finally, using IP, timestamp, and subdomain as association identifiers, the multi-source data is merged into a structured dataset and stored in a temporary analysis library.

[0114] The root cause analysis and localization phase is mainly divided into root cause localization for TCP latency degradation and root cause localization for domain name resolution anomalies.

[0115] Finally, the location results of each unit can be integrated to generate a standardized root cause report. This root cause report includes the root cause type (e.g., cross-provincial change of IDC ownership, key abnormal nodes, abnormal domain name servers), specific location, scope of impact (e.g., related businesses, number of subdomains, user coverage provinces), and related data (e.g., latency degradation, failure probability, contribution). The root cause report is then synchronized to the visualization interface module for operation and maintenance to view.

[0116] After execution, the root cause localization process data (e.g., raw data, calculation results, reports) is saved to the system log library for subsequent review and algorithm optimization. Temporary data connections are closed, analysis cache is released, and the process awaits the next diagnostic conclusion to trigger a new localization process.

[0117] The core function of the closed-loop handling engine is to automatically match the preset handling strategy according to the identified problem type, generate standardized work orders and push them to the corresponding processing nodes, and monitor the recovery of indicators after handling in real time to confirm whether the problem has been resolved. By automating the process, the cycle from problem discovery to resolution is greatly shortened, ensuring the continuous and stable operation of the business.

[0118] The closed-loop processing engine includes a strategy matching unit, a work order generation and dispatch unit, and a processing effect verification unit.

[0119] The strategy matching unit is used to parse the problem type and, based on the parsed problem type, to match a unique corresponding solution, i.e., a handling strategy, from the system's pre-set handling strategy library.

[0120] The work order generation and dispatch unit automatically generates standardized work orders based on the matching handling strategy. The work order includes a problem description (e.g., IP1 experiences latency degradation due to cross-province IDC relocation), handling objectives (e.g., relocate resources to the local IDC within 24 hours to restore TCP latency to within 100 milliseconds), execution steps (e.g., broken down according to the pre-set operation process in the strategy library, which may include steps such as applying for local node resources, data synchronization, domain name resolution switching, and origin verification), priority information, responsible department (e.g., IDC relocation issues are dispatched to the Content Cooperation Department, and server optimization issues are dispatched to the Origin Site Operation and Maintenance Group), and synchronizes the work order to the enterprise OA system and operation and maintenance management platform to ensure that relevant personnel receive it in real time.

[0121] The effect verification unit is used to automatically subscribe to relevant indicators of the data collection module (e.g., the location of the migrated IDC, server latency, network difference value, etc.) after the work order is dispatched.

[0122] When the monitored indicators meet the following conditions, the handling is deemed successful and the closed loop is completed: IDC attribution change issue: The resource migration is complete, the IP address is updated to the target province, and the TCP latency is ≤120% of the historical average.

[0123] Business server latency issue: Response latency ≤ 200 milliseconds, and stable for 30 consecutive minutes.

[0124] Network differences: The latency difference between mobile and telecommunications networks is ≤30%.

[0125] Domain Name Server Issues: The failure rate of the new server after switching is ≤1%, and the abnormal server has been taken offline.

[0126] Secondary handling trigger: If the indicator is not met (for example, resources are not migrated within 24 hours), the work order priority will be automatically upgraded, an additional reminder will be added and pushed to a higher level of person in charge until the problem is resolved.

[0127] This disclosure provides a detailed description of the workflow of a closed-loop processing engine, which includes an initialization phase, a strategy matching and work order generation phase, a processing execution and effect verification phase, and an archiving phase.

[0128] During the initialization phase of the closed-loop processing engine, a pre-set strategy library (including the latest updated processing steps and thresholds) can be loaded, work order templates (associated with responsible departments and priority rules) can be initialized, and interface connections with the root cause localization module and data acquisition module can be established to ensure that root cause reports and indicator data can be received in real time.

[0129] In the strategy matching and work order generation stage, the problem type and key parameters are analyzed, the corresponding handling strategy is matched from the strategy library, a standard work order containing objectives, steps and priorities is generated, and the work order is dispatched to the responsible department and responsible person through multiple channels.

[0130] During the execution and effectiveness verification phase, the indicator data during the disposal process are monitored in real time. The monitored data is compared with the disposal targets in the standardized work order. If the targets are met, a problem resolution report is generated, and the loop ends. If the targets are not met, the work order priority is upgraded, a second disposal reminder is pushed, and monitoring is repeated until the targets are met.

[0131] During the archiving phase, after the work order is completed, the execution record is archived to the system log library. This record includes the handling steps, execution time, responsible person, and effect data, which serves as the basis for subsequent strategy optimization and operation and maintenance review.

[0132] The adaptive weight decision model is an intelligent scoring hub based on multi-level dynamic thresholds and closed-loop processing. It dynamically calculates the weight coefficients of each network level and integrates the degradation degree of each network level indicator to provide a quantitative decision basis for the system to trigger closed-loop processing. It breaks through the limitations of traditional fixed weights and enables the scoring results to adapt to changes in network status in real time, accurately reflecting the core influencing factors of poor quality problems.

[0133] The adaptive weight decision model includes a weight coefficient calculation unit, a comprehensive quality and performance scoring unit, and a feedback adjustment unit. The weight coefficient calculation unit dynamically calculates the weight coefficient for each network layer, the comprehensive quality and performance scoring unit normalizes and merges the degradation degree of each network layer, and the feedback adjustment unit dynamically adjusts the weight size based on the anomaly probability.

[0134] This disclosure provides a detailed description of the workflow of an adaptive weighted decision model, which includes an initialization phase, a real-time calculation phase, a triggering and output phase, and a reset phase.

[0135] The initialization phase of the adaptive weight decision model is used to obtain the degradation degree of the corresponding index for each network layer, and to initialize parameters such as threshold and weight.

[0136] In the real-time calculation phase, the weight parameters are dynamically updated according to a preset time, and the quality score is calculated in combination with the degree of degradation.

[0137] During the triggering and output phase, if the poor quality score is greater than or equal to the specified score threshold, closed-loop processing is triggered, carrying the weight and degradation degree of each network layer. If the poor quality score is less than the specified score threshold, the real-time score is updated to the system status panel for monitoring purposes.

[0138] During the reset phase, the degradation level of each network layer is reduced to a normal range, and the weight coefficients are reset to their initial state, awaiting the next round of calculation. Whether it is a domain name server cluster failure, a sudden increase in cross-network TCP latency, or slow application layer interface response, the model can ensure that the comprehensive score accurately reflects the main problems of the current network through dynamic weight allocation, providing a unified and adaptable quantitative standard for handling poor quality in different scenarios.

[0139] The visualization interface module mentioned in this disclosure is used to render the web page access routing topology map, output diagnostic conclusions at each stage (e.g., degradation index values, root cause location results and handling suggestion codes), and provide an interface for downloading anomaly details.

[0140] In this embodiment, the data processing module first acquires real-time indicator data of the diagnostic object at multiple network layers. Then, based on the historical indicator data and benchmark data of the diagnostic object, it performs degradation judgment on each indicator in the real-time indicator data to obtain a judgment result carrying the degradation indicator. The judgment result is then sent to the diagnostic module. The diagnostic module is used to determine the core degradation indicator in the real-time indicator data based on the judgment result, and to determine the target diagnostic method from multiple preset diagnostic methods according to the type of the core degradation indicator. The target diagnostic method is then sent to the anomaly handling module. The anomaly handling module locates the root cause of the anomaly of the diagnostic object according to the target diagnostic method. When the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition, the module executes the corresponding handling strategy based on the type of the root cause of the anomaly.

[0141] In the above implementation, a dynamically adjustable degradation judgment standard is generated through dual judgment of historical indicator data and benchmark data, providing a quantitative basis for the system to accurately diagnose anomalies. Based on the judgment result, the core degradation source is located to assist in determining the diagnostic direction. Furthermore, the strategy of determining the target diagnostic method is determined through multi-layer indicator data to prevent the root cause location from being based on a single dimension, thereby effectively improving the accuracy and comprehensiveness of root cause location. Then, the corresponding treatment strategy is accurately matched and executed according to the type of anomaly, realizing the formation of a closed loop of diagnosis-location-treatment through an automated process, thereby improving diagnostic efficiency.

[0142] In an optional implementation, the aforementioned network layers include the Domain Name System layer, the network transport layer, and the service application layer. Locating the root cause of the anomaly in the diagnostic object according to the target diagnostic method includes: When the target diagnostic method is domain-level diagnostic, for the domain name associated with the diagnostic object, root cause localization processing is performed based on the real-time indicator data corresponding to the domain name in the domain name system layer, and the first diagnostic result including the domain name server identified as the abnormal root cause is obtained after processing. When the target diagnosis method is address-level diagnosis, joint root cause localization processing is performed on the network address associated with the diagnostic object based on the real-time indicator data corresponding to the network address in the network transport layer and the service application layer. After processing, a second diagnostic result including the type of abnormal problem is obtained.

[0143] As mentioned above, the network layers disclosed herein include the Domain Name System layer, the network transport layer, and the business application layer, and the corresponding preset diagnostic methods include domain name-level diagnostics and address-level diagnostics.

[0144] The data foundation for domain-level diagnostics is the corresponding real-time indicator data in the domain name system layer, such as the domain name resolution success rate, resolution latency, domain name server response time, number of resolution failures, and subdomain information of the domain name server. The results of domain-level diagnostics include the first diagnostic results of the domain name server that has been identified as the root cause of the anomaly.

[0145] The data foundation for address-level diagnostics is the corresponding real-time metric data in the network transport layer and business application layer, such as TCP connection success rate, TCP handshake latency, TCP transmission rate, and TCP packet loss rate; first packet latency, resource download time, resource download rate, first screen homepage loading time, and access success rate.

[0146] In the above implementation, domain name resolution failure data is deeply mined through domain name-level diagnostics to accurately locate specific abnormal domain name servers. Address-level diagnostics accurately distinguish whether the problem type is a network path abnormality or a business server abnormality, which facilitates further precise identification of key abnormal nodes and provides clear targets for network optimization. Thus, these two diagnostic mechanisms improve the efficiency of anomaly diagnosis and the accuracy of locating poor network quality problems.

[0147] In an optional implementation, the real-time indicator data corresponding to the above-mentioned domain name system layer includes subdomain information of the domain name and domain name server information that resolves the domain name. The domain name server information includes the domain name resolution success rate and the number of resolution failures of multiple domain name servers. The root cause localization process is performed based on the real-time indicator data corresponding to the domain name in the domain name system layer. After processing, a first diagnostic result is obtained, including the domain name server identified as the abnormal root cause, which includes: Domain name servers whose domain name resolution success rate and number of resolution failures both meet preset resolution conditions are identified as potential abnormal candidate domain name servers. Calculate the probability of anomalies of the candidate domain name servers based on the subdomain information; If the anomaly probability is determined to meet the anomaly requirements, the candidate domain name server corresponding to the anomaly probability is determined as the domain name server of the root cause of the anomaly, so as to output the first diagnostic result.

[0148] As mentioned above, this disclosure is divided into basic indicator diagnosis, failure code in-depth analysis, extended indicator linkage diagnosis, TCP latency linkage diagnosis, and first packet latency linkage diagnosis.

[0149] Basic indicator diagnosis: When the domain name resolution success rate is lower than 99.78%, or the domain name resolution latency deteriorates by more than 200% of the daily average (i.e., the current domain name resolution latency is greater than the historical daily average by 3), an abnormal subdomain list (including abnormal subdomains, associated IP addresses, and the number of resolution failures) will be automatically output.

[0150] In-depth analysis of failure codes: Focus on statistics of the number of times failure code -9001 (a typical domain name resolution timeout or server no response error code) is triggered and the associated IPs; if a single IP address triggers this failure code more than 5 times / hour, it is marked as a high-risk associated IP and further investigation is required.

[0151] Extended indicator linkage diagnosis: Not limited to the domain name resolution stage, it also diagnoses the TCP layer and application layer indicators associated with the domain name, avoiding missed detections of normal resolution but abnormal connection or loading.

[0152] TCP latency linkage diagnosis: Diagnoses the TCP handshake latency of the target IP corresponding to the domain name resolution. If the TCP handshake latency exceeds 300ms, a domain-IP association transmission abnormality label is attached, prompting further analysis of the network path of this IP.

[0153] First packet delay linkage diagnosis: Statistically calculate the time from the completion of domain name resolution to the arrival of the first data packet (first packet delay); if the first packet delay exceeds 500ms and the domain name resolution delay is <100ms, it is initially judged to be a delay in the forwarding of the first packet on the IP side, and further location of the network node corresponding to the IP is required.

[0154] The settings of the above values ​​can be adjusted as needed, and this disclosure does not require them to be adjusted accordingly.

[0155] In this regard, this disclosure can initially screen potential abnormal candidate domain name servers based on the domain name resolution success rate and the number of resolution failures. That is, domain name servers whose domain name resolution success rate and the number of resolution failures both meet the preset resolution conditions are identified as potential abnormal candidate domain name servers.

[0156] The preset resolution conditions can be set to ensure that a single domain name server fails to resolve more than 3 times and that the success rate of the resolution requests handled by that domain name server is less than or equal to 5%.

[0157] Based on this, the probability of anomalies for each candidate domain name server can be calculated using subdomain information: , Let be the probability of an anomaly in candidate domain name server j. This represents the number of times subdomain i failed to resolve on candidate domain name server j. Let represent the total number of requests to subdomain i, and n represent the total number of subdomains associated with candidate domain name server j.

[0158] The number of failed subdomain resolutions, the total number of requests to the subdomain, and the total number of associated subdomains mentioned above were obtained from the subdomain information.

[0159] If the probability of an anomaly is greater than the anomaly threshold (e.g., 0.6), the candidate domain name server corresponding to that probability is determined as the domain name server of the root cause of the anomaly. The anomaly threshold is the set anomaly requirement, and the setting of the anomaly requirement can be adjusted as needed.

[0160] In this embodiment of the disclosure, by combining preliminary screening and anomaly probability verification, the domain name server of the root cause of the anomaly can be accurately identified, ensuring the comprehensiveness of the domain name-level diagnostic process and providing a stable data foundation for subsequent matching of corresponding handling strategies.

[0161] In an optional implementation, the real-time indicator data corresponding to the above-mentioned network transport layer includes the transmission control protocol handshake delay and the transmission control protocol packet loss rate, and the real-time indicator data corresponding to the service application layer includes resource download time and resource download rate. The joint root cause localization process, based on real-time indicator data corresponding to the network address in the network transport layer and the service application layer, yields a second diagnostic result that includes the type of abnormal problem, including: If at least one of the Transmission Control Protocol (TCP) handshake delay and the TCP packet loss rate corresponding to the network address fails to meet the first transmission condition, a second diagnostic result is obtained to indicate a network path anomaly. If the Transmission Control Protocol (TCP) handshake delay and TCP packet loss rate corresponding to the network address both meet the first transmission condition, and at least one of the resource download time and resource download rate corresponding to the network address meets the second transmission condition, a second diagnostic result for indicating an abnormality of the service server is obtained.

[0162] Address-level diagnostics are primarily used to distinguish between network-side anomalies and resource-side anomalies. To this end, this disclosure identifies network-side anomalies from two dimensions: connection efficiency and transmission quality, and identifies resource-side anomalies through two core indicators: resource download time and resource download rate.

[0163] Regarding connection efficiency, TCP handshake latency (normal range <100ms) and TCP connection success rate (normal range >99.5%) can be monitored. If the TCP handshake latency degradation exceeds 30% of the normal range, or the TCP connection success rate is less than 99.5%, it is initially judged to be due to network path congestion or insufficient connection pool resources of the business server.

[0164] Regarding transmission quality, TCP transmission rate and TCP packet loss rate can be calculated. If the TCP transmission rate is 50% lower than the benchmark value of competing operators, or the TCP packet loss rate exceeds 1%, it is marked as insufficient bandwidth or poor stability of the network path.

[0165] In this regard, the first transmission condition mentioned in this disclosure can be set to the transmission control protocol handshake delay being within the normal delay range (e.g., within 30% of the normal delay range) and the transmission control protocol packet loss rate being less than the packet loss rate threshold (e.g., 1%).

[0166] Furthermore, regarding resource download speed, the current download speed can be compared with the historical average (e.g., normal download speed for image resources > 2Mbps, normal download speed for video resources > 5Mbps). If the speed degradation exceeds 40%, further judgment should be made based on the TCP transmission rate. If the TCP transmission rate is normal, the initial judgment is that the resource size is abnormal (e.g., uncompressed images, excessively high video bitrate), the server CPU is fully loaded, the application code is inefficient, the storage I / O is slow, or the resource size is too large. If the TCP transmission rate is abnormal, it is attributed to a network transmission problem.

[0167] Regarding resource download time, the download completion time of a single core business resource (e.g., homepage main image, key business interface data) can be statistically analyzed. If the download time exceeds 1.5 seconds and the TCP latency is less than 200ms (network transmission is normal), it is determined that the resource itself is abnormal (e.g., slow generation of resources on the server side, or remote storage location of resources).

[0168] In this regard, the second transmission condition of this disclosure can be set to a resource download time greater than a time threshold (e.g., 1.5 seconds) or a resource download rate exceeding a speed threshold (e.g., 40% of the historical average rate).

[0169] Therefore, in this embodiment of the present disclosure, if at least one of the Transmission Control Protocol (TCP) handshake delay and TCP packet loss rate fails to meet the first transmission condition, it is initially determined that the network path is abnormal; if both the TCP handshake delay and TCP packet loss rate meet the first transmission condition, and at least one of the resource download time and resource download rate corresponding to the network address meets the second transmission condition, it is initially determined that the resource or service server is abnormal.

[0170] The above implementation focuses on the quality issues at the IP level. Through precise analysis of network transmission and resource anomalies, the core function is to distinguish between network-side faults and resource-side faults, thereby improving the comprehensiveness of address-level diagnosis and providing stable data support.

[0171] In an optional implementation, after obtaining a second diagnostic result including the type of abnormal problem after processing, the system is further configured to: If a second diagnostic result is obtained to indicate an anomaly in a network path, the absolute latency of the nodes in the network path indicated by the second diagnostic result is obtained. The latency increment of the node is calculated based on the absolute latency; The contribution of the node to the total latency increment relative to the network path indicated by the second diagnostic result is calculated based on the latency increment. If both the contribution and absolute delay of a node meet the preset judgment conditions, the node is determined to be an abnormal node, and a third diagnostic result including the abnormal node is output.

[0172] To further pinpoint the location of anomalies, after identifying the network path with anomalies, it is possible to further identify the network nodes with anomalies within that network path.

[0173] To address this, you can first obtain the absolute latency value of each network node in the abnormal network path. For example, the latency of network node 1 is 80ms and the latency of network node 2 is 150ms.

[0174] Then, the degradation degree of the indicators associated with each network node calculated by the dynamic threshold calculation module is obtained, and combined with the historical average of TCP latency (e.g., within 30 days), the latency increment of each network node is calculated, that is, the latency part exceeding the baseline.

[0175] ,in, Let k be the latency increment of network node k. Let k be the absolute delay value of network node k. The degradation degree of the index associated with network node k. This represents the historical average TCP latency; 30 days is used as an example here.

[0176] Based on this, this disclosure adopts a path degradation contribution algorithm to quantify the contribution ratio of each network node to the overall latency degradation, that is, the contribution of the latency increment of each network node to the total latency increment of the entire network path.

[0177] ,in, The contribution of network node k. This represents the sum of delay increments for all network nodes k in the network path. K represents the network node topology hierarchy, with a value of 1 for the core layer and a value of 3 for the edge layer. K is the total number of hops in the path.

[0178] Finally, based on the calculated contribution and absolute latency, it can be determined whether the network node is an abnormal node. Specifically, this disclosure sets the preset judgment conditions as follows: the contribution is greater than the contribution threshold (e.g., 0.4), and the absolute latency is greater than the latency threshold (e.g., 200ms).

[0179] When the preset judgment conditions are met, the network node is determined to be an abnormal node, and a third diagnostic result including the abnormal node is output. Furthermore, an abnormal node report can also be output, which includes information such as node IP, topology level, absolute latency value, latency increment, degradation contribution, and associated path (e.g., network node A → network node B → network node C), to identify the target network node for subsequent link optimization.

[0180] In the above implementation, after identifying the abnormal path, the contribution algorithm is used to accurately locate the abnormal node from multiple nodes along the abnormal path, thereby narrowing the fault location range from the entire link to a single node, which greatly shortens the fault repair time, improves network operation and maintenance efficiency, and enables operation and maintenance personnel to repair the abnormal node in a timely manner.

[0181] In an optional implementation, the determination of the target diagnostic method from multiple preset diagnostic methods based on the type of the core degradation indicator includes: When the core degradation indicator is a domain name resolution indicator, domain name-level diagnosis is determined as the target diagnosis method corresponding to the core degradation indicator. When the core degradation indicator is a network transmission indicator, address-level diagnosis is determined as the target diagnosis method corresponding to the core degradation indicator. When the core degradation indicator is a comprehensive indicator, domain-level diagnosis and address-level diagnosis are determined as the target diagnostic methods corresponding to the core degradation indicator; wherein, the comprehensive indicator is used to indicate an indicator that is affected by the performance of multiple network layers.

[0182] In this embodiment of the disclosure, different diagnostic methods are adopted for different types of core degradation indicators. If the core degradation indicator is a domain name resolution indicator, domain name-level diagnosis is triggered. If the core degradation indicator is a network transmission indicator, address-level diagnosis is triggered. If the core degradation indicator is a comprehensive indicator, both domain name-level diagnosis and address-level diagnosis are triggered.

[0183] Among them, domain name resolution indicators include domain name resolution success rate and resolution latency, network transmission indicators include TCP handshake latency, TCP connection success rate, resource download time and resource download rate, and comprehensive indicators include indicators that are affected by the domain name system layer, network transmission layer and business application layer, that is, indicators that are affected by the performance of multiple network layers.

[0184] For comprehensive indicators, the diagnostic order of domain-level diagnosis and address-level diagnosis can be determined based on the correlation strength between the indicator and each network layer.

[0185] By using the above processing method, lower-level diagnostic tasks can be accurately allocated according to the type of core degradation indicators, avoiding resource misallocation, thereby effectively improving diagnostic efficiency while ensuring the accuracy of the diagnostic direction.

[0186] In an optional implementation, the above-mentioned method of determining the degradation of each indicator in the real-time indicator data based on the historical indicator data and baseline data of the diagnostic object to obtain a determination result carrying the degradation indicator includes: For any given indicator, the degree of degradation of the indicator is calculated based on the mean value of the indicator in the historical indicator data and the real-time indicator value of the indicator in the real-time indicator data. Determine the difference between the real-time indicator value and the benchmark data; When the degree of degradation meets the first degradation condition, a first determination result is obtained to indicate that the index is the first degradation index; If at least one of the difference and the degree of degradation satisfies the second degradation condition, a second determination result is obtained to indicate that the index is a second degradation index; wherein the degree of degradation of the second degradation index is higher than the degree of degradation of the first degradation index.

[0187] As mentioned above, this disclosure uses the index mean and real-time index values ​​to calculate the degree of degradation of each index.

[0188] ,in, This represents the historical average TCP latency; we'll use 30 days as an example. This refers to the real-time value of the indicator. The degree of degradation of the indicator.

[0189] This disclosure calculates the degree of degradation by relative deviation. When the indicator is a positive indicator (e.g., domain name resolution success rate), the smaller the real-time indicator value, the more severe the degradation. When the indicator is a negative indicator (e.g., resolution latency), the larger the real-time indicator value, the more severe the degradation.

[0190] If the degree of degradation meets the first degradation condition, then the index corresponding to the degree of degradation is determined as the first degradation index. The first degradation condition can be set to the degree of degradation being greater than a first threshold (e.g., 0.1).

[0191] Then, the difference between the real-time indicator value and the baseline data is determined, and based on the difference and the degree of degradation, it is further determined whether the indicator is a severely degraded indicator, that is, a second degradation indicator with a degree of degradation higher than the first degradation indicator.

[0192] In this regard, the second degradation condition can be set to a degradation degree greater than a second threshold (e.g., 0.3) and a difference greater than a difference threshold (e.g., 200).

[0193] Among them, the condition that the second threshold is greater than the first threshold and the degradation degree is greater than the second threshold applies to all types of indicators, while the condition that the difference is greater than the difference threshold applies only to latency-related indicators, such as parsing latency and TCP latency.

[0194] In this embodiment of the disclosure, if at least one of the difference and the degree of degradation meets the second degradation condition, the indicator is determined to be a severely degraded indicator to obtain a second judgment result. This realizes the setting of dual judgment conditions by combining the degradation range of the indicator itself and the gap with industry benchmarks, and supports the subsequent triggering of high-priority diagnosis.

[0195] In an optional implementation, after obtaining the determination result carrying the degradation index, the method further includes: If the second degradation indicator is present in the degradation indicator carried by the determination result, the step of determining the core degradation indicator is interrupted, and the corresponding emergency response strategy is executed based on the second degradation indicator first.

[0196] In this embodiment of the disclosure, if a second degradation index exists, a priority interruption process is executed, that is, the current diagnostic process is interrupted and the second degradation index is processed first.

[0197] For example, the domain name resolution success rate is a high-priority indicator. If the domain name resolution success rate becomes abnormal during the diagnosis of the first screen loading time, the diagnosis of the first screen loading time and the steps to determine the core degradation indicators will be interrupted. The corresponding emergency handling strategy will be called from the strategy library based on the domain name resolution success rate.

[0198] Emergency response strategies can be set to switch domain name resolution requests to backup domain name servers, backup paths, backup nodes, etc.

[0199] In the above implementation, when a high-priority indicator is abnormal, the diagnosis of low-priority indicators is stopped, which can release the resources occupied by low-priority diagnosis, thereby improving resource utilization and reducing response latency.

[0200] In an optional implementation, the determination of the core degradation indicators in the real-time indicator data based on the determination result includes: Based on the historical index data, determine the mean and standard deviation of the deterioration index carried by the judgment result; Based on the historical indicator data and the real-time indicator data, the degree of degradation of the degradation indicator carried by the judgment result is calculated. The mean, standard deviation, and degree of degradation of the degradation index carried by the judgment result are calculated, and the degradation index corresponding to the maximum value after calculation is determined as the core degradation index.

[0201] As mentioned above, this disclosure provides an exemplary description of the process for locating core degradation indicators.

[0202] ,in, M is the core degradation indicator identifier, and M is the set of degradation indicators, which includes the first degradation indicator and the second degradation indicator. The weight of degradation index i, Let i be the degree of degradation of degradation index i. Let i be the mean value of the degradation index. Let be the standard deviation of the degradation index i.

[0203] The weights for domain name resolution success rate, TCP latency, and first-screen latency can be set to 0.4, 0.3, and 0.3 respectively, and can be adjusted adaptively according to the actual application scenario.

[0204] In the above implementation, the mean and standard deviation of the degradation indicators carried by the judgment result are first determined from historical indicator data. Then, the degradation degree of the degradation indicators is calculated by combining historical indicator data and real-time indicator data. Based on the indicator mean, standard deviation and degradation degree, the core factors that have the greatest impact on business experience are accurately identified from multiple degradation indicators. This facilitates the matching of targeted handling strategies for the core degradation source, forming a precise closed loop from diagnosis to handling.

[0205] In an optional implementation, when the degradation degree of the corresponding indicator at each network layer meets a preset degradation degree condition, a corresponding handling strategy is executed based on the type of the abnormal root cause, including: The degradation degree of each of the aforementioned indicators in the same network layer is aggregated to obtain the degradation degree of each network layer. The degradation degree of each network layer is weighted and summed to obtain the quality score; If the poor quality score exceeds the scoring threshold, a processing strategy matching the type of the abnormal root cause is invoked from the processing strategy library and the processing strategy is executed.

[0206] This disclosure, after aggregating the degradation levels of various indicators within the same network layer, yields the degradation levels of the Domain Name System layer, the network transport layer, and the business application layer.

[0207] Among them, the weight of the domain name system layer It can be dynamically generated based on the domain name resolution failure rate and the sigmoid function.

[0208] ,in, Let b be the domain name resolution failure rate, and b be the slope adjustment factor. When it rises, The non-linear growth can increase the proportion of domain name system layer degradation in the quality score.

[0209] Domain Name System Layer Weight It is positively correlated with the degree of degradation of TCP latency.

[0210] ,in, The degree of degradation in TCP latency. This is the benchmark latency value for competing operators.

[0211] The weights of the business application layer are: ,when or When the increase is due to the worsening of the deterioration of a certain layer, Automatic compression ensures that the sum of the three weights is 1, avoiding scoring distortion.

[0212] In the process of calculating the quality score, the degradation degree of each network layer is first uniformly mapped to the interval [0,1], where 0 represents no degradation and 1 represents severe degradation, in order to eliminate the dimensional differences between different indicators.

[0213] Then, the degradation degree mapped to each network layer and its corresponding weight are weighted and summed to obtain a quality score. This quality score is a quantitative and standardized evaluation indicator of the overall quality degradation of the entire link of the domain name system layer, TCP layer, and business application layer.

[0214] Once the poor quality score exceeds the scoring threshold (e.g., 0.8), the above-mentioned anomaly probability calculation process is triggered, resulting in... And through the formula Dynamically magnify the initial .

[0215] For example, initially It is 0.6, after magnification The value is 1.44 (actually 1.0 because the weight limit is 1) to ensure that the quality score quickly exceeds the threshold when a serious anomaly occurs at the domain name system layer.

[0216] Whether it's a domain name server cluster failure, a sudden increase in cross-network TCP latency, or slow application layer interface response, dynamic weight allocation can ensure that the quality score accurately reflects the main problems of the current network, providing a unified and adaptable quantitative standard for handling quality issues in different scenarios.

[0217] When the quality score exceeds the scoring threshold, a corresponding solution is matched from the preset handling strategy library based on the type of abnormal root cause, and the handling strategy is executed.

[0218] For example, when an anomaly is detected as a cross-provincial change of IDC affiliation, the processing strategy for coordinating the resource scheduling of content providers is invoked, explicitly requiring the content resources associated with that IP to be migrated from an IDC in another province to a node in this province.

[0219] When the root cause of the anomaly is a server response latency > 200 milliseconds, a strategy to optimize the origin server response latency is triggered, including sub-steps such as cache refresh, server load balancing adjustment, and application performance optimization.

[0220] When the root cause of the anomaly is a latency difference of more than 30% between the mobile network and the telecommunications network, a backbone link optimization strategy is initiated to reduce the network difference by adjusting routing weights and expanding link bandwidth.

[0221] When the root cause of the anomaly is a single domain name server failure rate > 40%, the strategy of switching to a mobile domain name server is executed, automatically switching the resolution request of the domain name to the backup mobile domain name node, and closing the resolution entry of the abnormal server.

[0222] Based on the same inventive concept, this disclosure also provides an anomaly diagnosis method corresponding to the anomaly diagnosis system. Since the principle of the method in this disclosure is similar to that of the anomaly diagnosis system described above, the implementation of the method can be referred to the implementation of the method, and repeated parts will not be described again.

[0223] Reference Figure 2 The diagram shows a flowchart of an anomaly diagnosis method provided in an embodiment of this disclosure. This method is applied to an anomaly diagnosis system including a data processing module, a diagnosis module, and an anomaly handling module. The method includes steps S201-S204, wherein: Step S201: Obtain real-time indicator data of the diagnostic object at multiple network layers.

[0224] Step S202: Based on the historical indicator data and benchmark data of the diagnostic object, perform a degradation judgment on each indicator in the real-time indicator data to obtain the judgment result carrying the degradation indicator.

[0225] Step S203: Based on the judgment result, determine the core degradation index in the real-time index data, and determine the target diagnosis method from multiple preset diagnosis methods according to the type of the core degradation index.

[0226] Step S204: Locate the root cause of the abnormality of the diagnostic object according to the target diagnostic method, and execute the corresponding treatment strategy based on the type of the abnormal root cause when the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition.

[0227] In one possible implementation, the method is further used for: When the target diagnostic method is domain-level diagnostic, for the domain name associated with the diagnostic object, root cause localization processing is performed based on the real-time indicator data corresponding to the domain name in the domain name system layer, and the first diagnostic result including the domain name server identified as the abnormal root cause is obtained after processing. When the target diagnosis method is address-level diagnosis, joint root cause localization processing is performed on the network address associated with the diagnostic object based on the real-time indicator data corresponding to the network address in the network transport layer and the service application layer. After processing, a second diagnostic result including the type of abnormal problem is obtained.

[0228] In one possible implementation, the method is further used for: Domain name servers whose domain name resolution success rate and number of resolution failures both meet preset resolution conditions are identified as potential abnormal candidate domain name servers. Calculate the probability of anomalies of the candidate domain name servers based on the subdomain information; If the anomaly probability is determined to meet the anomaly requirements, the candidate domain name server corresponding to the anomaly probability is determined as the domain name server of the root cause of the anomaly, so as to output the first diagnostic result.

[0229] In one possible implementation, the method is further used for: If at least one of the Transmission Control Protocol (TCP) handshake delay and the TCP packet loss rate corresponding to the network address fails to meet the first transmission condition, a second diagnostic result is obtained to indicate a network path anomaly. If the Transmission Control Protocol (TCP) handshake delay and TCP packet loss rate corresponding to the network address both meet the first transmission condition, and at least one of the resource download time and resource download rate corresponding to the network address meets the second transmission condition, a second diagnostic result for indicating an abnormality of the service server is obtained.

[0230] In one possible implementation, the method is further used for: If a second diagnostic result is obtained to indicate an anomaly in a network path, the absolute latency of the nodes in the network path indicated by the second diagnostic result is obtained. The latency increment of the node is calculated based on the absolute latency; The contribution of the node to the total latency increment relative to the network path indicated by the second diagnostic result is calculated based on the latency increment. If both the contribution and absolute delay of a node meet the preset judgment conditions, the node is determined to be an abnormal node, and a third diagnostic result including the abnormal node is output.

[0231] In one possible implementation, the method is further used for: When the core degradation indicator is a domain name resolution indicator, domain name-level diagnosis is determined as the target diagnosis method corresponding to the core degradation indicator. When the core degradation indicator is a network transmission indicator, address-level diagnosis is determined as the target diagnosis method corresponding to the core degradation indicator. When the core degradation indicator is a comprehensive indicator, domain-level diagnosis and address-level diagnosis are determined as the target diagnostic methods corresponding to the core degradation indicator; wherein, the comprehensive indicator is used to indicate an indicator that is affected by the performance of multiple network layers.

[0232] In one possible implementation, the method is further used for: For any given indicator, the degree of degradation of the indicator is calculated based on the mean value of the indicator in the historical indicator data and the real-time indicator value of the indicator in the real-time indicator data. Determine the difference between the real-time indicator value and the benchmark data; When the degree of degradation meets the first degradation condition, a first determination result is obtained to indicate that the index is the first degradation index; If at least one of the difference and the degree of degradation satisfies the second degradation condition, a second determination result is obtained to indicate that the index is a second degradation index; wherein the degree of degradation of the second degradation index is higher than the degree of degradation of the first degradation index.

[0233] In one possible implementation, the method is further used for: If the second degradation indicator is present in the degradation indicator carried by the determination result, the step of determining the core degradation indicator is interrupted, and the corresponding emergency response strategy is executed based on the second degradation indicator first.

[0234] In one possible implementation, the method is further used for: Based on the historical index data, determine the mean and standard deviation of the deterioration index carried by the judgment result; Based on the historical indicator data and the real-time indicator data, the degree of degradation of the degradation indicator carried by the judgment result is calculated. The mean, standard deviation, and degree of degradation of the degradation index carried by the judgment result are calculated, and the degradation index corresponding to the maximum value after calculation is determined as the core degradation index.

[0235] In one possible implementation, the method is further used for: The degradation degree of each of the aforementioned indicators in the same network layer is aggregated to obtain the degradation degree of each network layer. The degradation degree of each network layer is weighted and summed to obtain the quality score; If the poor quality score exceeds the scoring threshold, a processing strategy matching the type of the abnormal root cause is invoked from the processing strategy library and the processing strategy is executed.

[0236] The following is combined with Figure 3 The above abnormality diagnosis process is described in detail below: S301: Obtain real-time indicator data of the diagnostic object at multiple network layers.

[0237] S302: Based on the historical and baseline data of the diagnostic object, the degradation of each indicator in the real-time indicator data is determined to obtain the determination result of the degradation indicator.

[0238] S303: Determine the core degradation indicators in the real-time indicator data based on the judgment results.

[0239] S304: When the core degradation indicator is a domain name resolution indicator, determine the domain name level diagnosis as the target diagnosis method corresponding to the core degradation indicator.

[0240] S305: When the core degradation indicator is a network transmission indicator, determine address-level diagnosis as the target diagnosis method corresponding to the core degradation indicator.

[0241] S306: When the core degradation indicator is a comprehensive indicator, determine domain-level diagnosis and address-level diagnosis as the target diagnosis methods corresponding to the core degradation indicator.

[0242] Here, comprehensive metrics are used to indicate metrics that are affected by the combined performance of multiple network layers.

[0243] S307: When the target diagnostic method is domain-level diagnostic, for the domain name associated with the diagnostic object, root cause localization processing is performed based on the real-time indicator data corresponding to the domain name in the domain name system layer. After processing, the first diagnostic result including the domain name server identified as the abnormal root cause is obtained.

[0244] S308: When the target diagnosis method is address-level diagnosis, joint root cause localization processing is performed on the network address associated with the diagnostic object based on the real-time indicator data corresponding to the network address in the network transport layer and the business application layer. After processing, a second diagnostic result including the type of abnormal problem is obtained.

[0245] S309: If the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition, execute the corresponding handling strategy based on the type of abnormal root cause.

[0246] As can be seen from the above description, the technical solution disclosed herein has the following advantages: (1) Improve the accuracy of poor quality identification: The dynamic threshold calculation module combines historical averages with benchmark values ​​from competing operators to generate dynamic judgment criteria, solving the problem that traditional static thresholds are not adaptable to dynamic network changes. It can significantly reduce the false positive rate and false negative rate, ensuring that real degradation is captured in time, while avoiding false alarms triggered by normal fluctuations.

[0247] (2) Accelerate diagnostic response efficiency: The multi-level diagnostic engine's priority interruption mechanism immediately terminates low-priority diagnostics when high-priority indicators are abnormal, reducing unnecessary calculations. This allows for focusing on core issues, significantly shortening diagnostic response time and improving fault detection efficiency.

[0248] (3) Achieve precise root cause localization: The root cause localization module integrates multi-dimensional data and combines it with a path degradation contribution algorithm to accurately distinguish root causes such as poor server quality, network path problems, and changes in IDC ownership. This effectively improves the accuracy of root cause localization and avoids incorrect handling due to ambiguous localization.

[0249] (4) Construct a closed-loop process for the entire process: The closed-loop handling engine is based on root cause type matching and pre-set strategies. It also monitors the recovery status of indicators in real time through the effect verification unit, forming a closed loop of "diagnosis-location-handling-verification", which significantly improves the problem resolution rate and eliminates management breakpoints.

[0250] (5) Optimize the scientific nature of comprehensive scoring decision-making: The adaptive weighted decision model dynamically adjusts the weight coefficients to ensure that the comprehensive quality score accurately reflects the current core degradation layer, ensuring that emergency response is initiated first and accelerating the recovery speed of core business quality degradation.

[0251] (6) Enhance the synergy of system modules: Deep data linkage between modules ensures consistency of data benchmarks in diagnosis, positioning, and treatment, improves the overall accuracy of the system, and provides stable and reliable technical support for complex network scenarios.

[0252] Corresponding to Figure 2 In addition to the abnormal diagnosis method in the present disclosure, this embodiment also provides an electronic device 40 such as... Figure 4 The diagram shown is a schematic representation of an electronic device 40 provided in an embodiment of this disclosure, including: The system includes a processor 41, a memory 42, and a bus 43. The memory 42 stores execution instructions and includes main memory 421 and external memory 422. The main memory 421, also called internal memory, temporarily stores the computational data in the processor 41, as well as data exchanged with external memory such as a hard disk. The processor 41 exchanges data with the external memory 422 through the main memory 421. When the electronic device 40 is running, the processor 41 communicates with the memory 42 through the bus 43, causing the processor 41 to execute the following instructions: Obtain real-time indicator data for the diagnostic target across multiple network layers.

[0253] Based on the historical and baseline data of the diagnostic object, the degradation of each indicator in the real-time indicator data is determined to obtain the determination result carrying the degradation indicator.

[0254] Based on the determination result, the core degradation index in the real-time index data is determined, and the target diagnostic method is determined from multiple preset diagnostic methods according to the type of the core degradation index.

[0255] The root cause of the abnormality of the diagnostic object is located according to the target diagnostic method, and the corresponding treatment strategy is executed based on the type of the abnormality when the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition.

[0256] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the anomaly diagnosis method described in the above-described method embodiments. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0257] This disclosure also provides a computer program product 50, such as... Figure 5 The diagram shown is a structural schematic of a computer program product 50 provided in an embodiment of this disclosure. The computer program product 50 carries a computer program 51. The program included in the computer program 51 can be used to execute the steps of the abnormal diagnosis method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0258] The above description, with reference to the accompanying drawings, outlines an anomaly diagnosis system, method, device, medium, and product according to embodiments of this disclosure. In these embodiments, a data processing module first acquires real-time indicator data of the diagnostic object at multiple network layers. Then, based on the historical indicator data and baseline data of the diagnostic object, it performs degradation judgment on each indicator in the real-time indicator data to obtain a judgment result carrying the degradation indicator. This judgment result is then sent to a diagnosis module. The diagnosis module determines the core degradation indicator in the real-time indicator data based on the judgment result, and determines a target diagnosis method from multiple preset diagnosis methods according to the type of the core degradation indicator. This target diagnosis method is then sent to an anomaly handling module. The anomaly handling module locates the root cause of the anomaly of the diagnostic object according to the target diagnosis method. When the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition, the module executes the corresponding handling strategy based on the type of the root cause of the anomaly. Through the above processing method, a dynamically adjustable degradation judgment standard is generated by dual judgment of historical indicator data and benchmark data. This provides a quantitative basis for the system to accurately diagnose anomalies and locate the core degradation source based on the judgment result to help determine the direction of diagnosis. Furthermore, the strategy of determining the target diagnosis method is determined through multi-layer indicator data to prevent the root cause location from being based on a single dimension. This can effectively improve the accuracy and comprehensiveness of root cause location. Then, based on the type of anomaly, the corresponding treatment strategy is accurately matched and executed, realizing a closed loop of diagnosis-location-treatment through an automated process, thereby improving diagnostic efficiency.

[0259] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0260] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0261] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0262] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0263] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0264] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0265] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. An abnormality diagnosis system, characterized in that, The anomaly diagnosis system includes a data processing module, a diagnosis module, and an anomaly handling module, including: The data processing module is used to acquire real-time indicator data of the diagnostic object at multiple network layers; and based on the historical indicator data and benchmark data of the diagnostic object, to determine the degradation of each indicator in the real-time indicator data and obtain a determination result carrying the degradation indicator. The diagnostic module is used to determine the core degradation indicators in the real-time indicator data based on the judgment result; and to determine the target diagnostic method from multiple preset diagnostic methods according to the type of the core degradation indicators. The anomaly handling module is used to locate the root cause of the anomaly of the diagnostic object according to the target diagnostic method; and to execute the corresponding handling strategy based on the type of the root cause of the anomaly when the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition.

2. The anomaly diagnosis system according to claim 1, characterized in that, The network layers include the Domain Name System layer, the network transport layer, and the service application layer. Locating the root cause of the abnormality in the diagnostic object according to the target diagnostic method includes: When the target diagnostic method is domain-level diagnostic, for the domain name associated with the diagnostic object, root cause localization processing is performed based on the real-time indicator data corresponding to the domain name in the domain name system layer, and the first diagnostic result including the domain name server identified as the abnormal root cause is obtained after processing. When the target diagnosis method is address-level diagnosis, joint root cause localization processing is performed on the network address associated with the diagnostic object based on the real-time indicator data corresponding to the network address in the network transport layer and the service application layer. After processing, a second diagnostic result including the type of abnormal problem is obtained.

3. The anomaly diagnosis system according to claim 2, characterized in that, The real-time metric data corresponding to the domain name system layer includes the subdomain information of the domain name and the domain name server information that resolves the domain name. The domain name server information includes the domain name resolution success rate and the number of resolution failures of multiple domain name servers. The root cause localization process is performed based on the real-time indicator data corresponding to the domain name in the domain name system layer. After processing, a first diagnostic result is obtained, including the domain name server identified as the abnormal root cause, which includes: Domain name servers whose domain name resolution success rate and number of resolution failures both meet preset resolution conditions are identified as potential abnormal candidate domain name servers. Calculate the probability of anomalies of the candidate domain name servers based on the subdomain information; If the anomaly probability is determined to meet the anomaly requirements, the candidate domain name server corresponding to the anomaly probability is determined as the domain name server of the root cause of the anomaly, so as to output the first diagnostic result.

4. The anomaly diagnosis system according to claim 2, characterized in that, The real-time metrics data corresponding to the network transport layer include Transmission Control Protocol (TCP) handshake delay and TCP packet loss rate, while the real-time metrics data corresponding to the service application layer include resource download time and resource download rate. The joint root cause localization process, based on real-time indicator data corresponding to the network address in the network transport layer and the service application layer, yields a second diagnostic result that includes the type of abnormal problem, including: If at least one of the Transmission Control Protocol (TCP) handshake delay and the TCP packet loss rate corresponding to the network address fails to meet the first transmission condition, a second diagnostic result is obtained to indicate a network path anomaly. If the Transmission Control Protocol (TCP) handshake delay and TCP packet loss rate corresponding to the network address both meet the first transmission condition, and at least one of the resource download time and resource download rate corresponding to the network address meets the second transmission condition, a second diagnostic result for indicating an abnormality of the service server is obtained.

5. The anomaly diagnosis system according to claim 2, characterized in that, After obtaining a second diagnostic result that includes the type of abnormal problem, the system is further used to: If a second diagnostic result is obtained to indicate an anomaly in a network path, the absolute latency of the nodes in the network path indicated by the second diagnostic result is obtained. The latency increment of the node is calculated based on the absolute latency; The contribution of the node to the total latency increment relative to the network path indicated by the second diagnostic result is calculated based on the latency increment. If both the contribution and absolute delay of a node meet the preset judgment conditions, the node is determined to be an abnormal node, and a third diagnostic result including the abnormal node is output.

6. The anomaly diagnosis system according to claim 1, characterized in that, The step of determining the target diagnostic method from multiple preset diagnostic methods based on the type of the core degradation indicator includes: When the core degradation indicator is a domain name resolution indicator, domain name-level diagnosis is determined as the target diagnosis method corresponding to the core degradation indicator. When the core degradation indicator is a network transmission indicator, address-level diagnosis is determined as the target diagnosis method corresponding to the core degradation indicator. When the core degradation indicator is a comprehensive indicator, domain-level diagnosis and address-level diagnosis are determined as the target diagnostic methods corresponding to the core degradation indicator; wherein, the comprehensive indicator is used to indicate an indicator that is affected by the performance of multiple network layers.

7. The anomaly diagnosis system according to claim 1, characterized in that, The process of determining the degradation of each indicator in the real-time indicator data based on the historical and baseline indicator data of the diagnostic subject, and obtaining a determination result carrying the degradation indicator, includes: For any given indicator, the degree of degradation of the indicator is calculated based on the mean value of the indicator in the historical indicator data and the real-time indicator value of the indicator in the real-time indicator data. Determine the difference between the real-time indicator value and the benchmark data; When the degree of degradation meets the first degradation condition, a first determination result is obtained to indicate that the index is the first degradation index; If at least one of the difference and the degree of degradation satisfies the second degradation condition, a second determination result is obtained to indicate that the index is a second degradation index; wherein the degree of degradation of the second degradation index is higher than the degree of degradation of the first degradation index.

8. The anomaly diagnosis system according to claim 7, characterized in that, After obtaining the determination result of carrying the deterioration index, it also includes: If the second degradation indicator is present in the degradation indicator carried by the determination result, the step of determining the core degradation indicator is interrupted, and the corresponding emergency response strategy is executed based on the second degradation indicator first.

9. The anomaly diagnosis system according to claim 1, characterized in that, The determination of the core degradation indicators in the real-time indicator data based on the judgment result includes: Based on the historical index data, determine the mean and standard deviation of the deterioration index carried by the judgment result; Based on the historical indicator data and the real-time indicator data, the degree of degradation of the degradation indicator carried by the judgment result is calculated. The mean, standard deviation, and degree of degradation of the degradation index carried by the judgment result are calculated, and the degradation index corresponding to the maximum value after calculation is determined as the core degradation index.

10. The anomaly diagnosis system according to claim 1, characterized in that, When the degradation degree of the corresponding indicator at each network layer meets the preset degradation degree condition, the corresponding handling strategy is executed based on the type of the abnormal root cause, including: The degradation degree of each of the aforementioned indicators in the same network layer is aggregated to obtain the degradation degree of each network layer. The degradation degree of each network layer is weighted and summed to obtain the quality score; If the poor quality score exceeds the scoring threshold, a processing strategy matching the type of the abnormal root cause is invoked from the processing strategy library and the processing strategy is executed.

Images