Target event determination method and apparatus, storage medium, and electronic device

Abstract

The embodiment of the application provides a kind of target event determination method and device, storage medium, electronic equipment, wherein, the method comprises: abnormal detection is carried out to the index to be detected, determines the abnormal interval of the index to be detected, the first time series data of the index to be detected in abnormal interval, and further determine the second time series data of the multiple candidate root cause events of the index to be detected in abnormal interval, that is, abnormal interval can be used as the analysis center, and first time series data, second time series data are combined to carry out root cause analysis from multiple root cause analysis dimensions respectively, determine the analysis result of multiple candidate root cause events in multiple root cause analysis dimensions respectively, finally, target root cause event is determined by the analysis result of multiple root cause analysis dimensions, since root cause analysis focuses not only on abnormal interval, but also combines multiple root cause analysis dimensions, so as to effectively improve the determination accuracy of target root cause event.

Description

Technical Field

[0001] This application relates to the field of computer technology, and more specifically, to a method and apparatus for determining a target event, a storage medium, and an electronic device. Background Technology

[0002] With the development of computer technology, when computer equipment experiences abnormal phenomena such as performance degradation, service downgrade, or business interruption, it is usually necessary to conduct root cause analysis to identify the target event (such as abnormal event) affecting the operation of the computer equipment.

[0003] Currently, in identifying target events, a single metric is commonly used for root cause localization. This involves calculating the correlation coefficient between the indicator to be detected (such as CPU (Central Processing Unit), memory, etc.) and candidate events (such as the number of SQL (Structured Query Language) executions, the number of connections, etc.) to achieve anomaly correlation analysis. However, a single correlation metric cannot fully cover the dependencies existing in the data, easily leading to missed or false positives, thus affecting the accuracy of target event identification.

[0004] Therefore, improving the accuracy of target event determination has become an urgent problem to be solved. Summary of the Invention

[0005] This application provides a method, apparatus, storage medium, and electronic device for determining target events, in order to at least solve the problem in related technologies where the use of a single metric for root cause localization affects the accuracy of target event determination.

[0006] According to one embodiment of this application, a method for determining a target event is provided, comprising: performing anomaly detection on an indicator to be detected, determining an anomaly interval of the indicator to be detected, and first time-series data of the indicator to be detected within the anomaly interval; determining second time-series data of multiple candidate root cause events of the indicator to be detected within the anomaly interval; analyzing the multiple candidate root cause events from multiple root cause analysis dimensions based on the first time-series data and the second time-series data, respectively, and determining the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions; and determining a target root cause event from the multiple candidate root cause events based on the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions.

[0007] According to another embodiment of this application, a target event determination apparatus is provided, comprising: a detection module, configured to perform anomaly detection on a target indicator, determine an anomaly interval of the target indicator, and first time-series data of the target indicator within the anomaly interval; a first determination module, configured to determine second time-series data of multiple candidate root cause events of the target indicator within the anomaly interval; an analysis module, configured to analyze the multiple candidate root cause events from multiple root cause analysis dimensions based on the first time-series data and the second time-series data, and determine the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions; and a second determination module, configured to determine a target root cause event from the multiple candidate root cause events based on the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions.

[0008] According to yet another embodiment of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, and the computer program is configured to perform the steps in any of the above method embodiments when it is run.

[0009] According to yet another embodiment of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0010] According to yet another embodiment of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0011] According to this application, anomaly detection is performed on the indicator to be detected, the abnormal interval of the indicator to be detected and the first time series data of the indicator to be detected within the abnormal interval are determined, and then the second time series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval are further determined. In other words, the abnormal interval can be used as the analysis center, and root cause analysis can be carried out from multiple root cause analysis dimensions in combination with the first time series data and the second time series data, respectively, to determine the analysis results of multiple candidate root cause events in multiple root cause analysis dimensions, and finally the target root cause event is determined through the analysis results of multiple root cause analysis dimensions. Since the root cause analysis not only focuses on the abnormal interval, but also combines multiple root cause analysis dimensions, the accuracy of determining the target root cause event is effectively improved. Attached Figure Description

[0012] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0013] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0014] Figure 1 This is a hardware structure block diagram of a computer device for a method of determining a target event according to an embodiment of this application;

[0015] Figure 2 This is a flowchart of a method for determining a target event according to an embodiment of this application;

[0016] Figure 3 This is a structural block diagram of a target event determination device according to an embodiment of this application. Detailed Implementation

[0017] The embodiments of this application will be described in detail below with reference to the accompanying drawings and examples.

[0018] It should be noted that the terms "first," "second," etc., in the specification, claims, and drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0019] The methods and embodiments provided in this application can be executed in a computer device or similar computing device. Taking running on a computer device as an example, Figure 1 This is a hardware structure block diagram of a computer device for a method of determining a target event according to an embodiment of this application. For example... Figure 1 As shown, a computer device may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor or programmable logic device) and a memory 104 for storing data are also shown. The computer device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the computer device described above. For example, the computer device may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0020] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the method for determining the target event in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thus implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to computer devices via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0021] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider for the computer equipment. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0022] This embodiment provides a method for determining a target event, which is applied to the aforementioned computer device. Figure 2 This is a flowchart of a method for determining a target event according to an embodiment of this application, such as... Figure 2 As shown, the process includes the following steps:

[0023] Step S202: Perform anomaly detection on the indicator to be detected, determine the abnormal range of the indicator to be detected, and the first time series data of the indicator to be detected within the abnormal range.

[0024] Understandably, the metrics to be detected refer to performance indicators used to characterize the operating status of computer equipment or database systems, including but not limited to: CPU utilization, memory utilization, disk I / O throughput, network traffic, database queries per second, and active sessions. An anomaly interval is a continuous time period identified during anomaly detection that meets anomaly characteristics. Its start and end points are called the start and end points of the anomaly interval, respectively, which together define the effective scope of the abnormal behavior. The first time-series data refers to the local time-series data containing the anomaly interval, extracted and relocated from the full time-series data of the metrics to be detected based on the determined anomaly interval. It can represent the core signal of the anomaly and serves as the reference benchmark for root cause analysis.

[0025] Optionally, the full time series data of the indicator to be detected can be obtained and analyzed to identify the fluctuation range that deviates from the set value range. The abnormal start and end points of the fluctuation range can be determined by the slope change and amplitude threshold of the full time series data.

[0026] Step S204: Determine the second time series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval.

[0027] Understandably, candidate root cause events refer to events identified by influencing metrics that drive anomalies. These influencing metrics include, but are not limited to: database-level SQL statements, database queries per second (QPS), active sessions per second (AAS), lock waits, and host-level network inbound / outbound traffic, disk read / write speeds, etc. The second time series data consists of time sequences collected for each candidate root cause event within the same anomaly interval.

[0028] Optionally, the second time series data is within the same time range and sampling granularity as the first time series data, and has undergone missing value imputation and timestamp relocation processing to ensure that the two are aligned in the time dimension, providing a consistent input basis for subsequent cross-indicator root cause analysis.

[0029] Step S206: Based on the first time series data and the second time series data, analyze multiple candidate root cause events from multiple root cause analysis dimensions to determine the analysis results of multiple candidate root cause events in multiple root cause analysis dimensions.

[0030] It should be noted that multiple root cause analysis dimensions refer to independent yet complementary analytical perspectives constructed to comprehensively, objectively, and robustly identify root causes. Root cause analysis dimensions may include, but are not limited to: correlation strength dimension, used to measure the statistical correlation between candidate events and the indicator to be detected in terms of temporal fluctuations; time lag direction dimension, used to determine whether candidate events lead, synchronize with, or lag behind changes in the indicator to be detected, thereby inferring their causal probability; and stage consistency dimension, used to assess the correlation stability of candidate events in different evolutionary stages (such as rise, peak, and decline) within the abnormal interval, excluding local accidental resonance. All of the above dimensions use the first time series data as a reference and the second time series data as the analysis object. Through parallel computation and cross-validation within a unified spatiotemporal window, the final output is a quantitative score and qualitative judgment for each candidate root cause event in each dimension, constituting a structured, multidimensional evaluation system for the probability of root causes.

[0031] Optionally, in terms of correlation strength, for each second time-series data point and the first time-series data, correlation coefficients using five algorithms—Pearson correlation coefficient, Spearman correlation coefficient, Kendall correlation coefficient, mutual information, and distance correlation—are calculated. The results are then weighted or normalized to obtain the correlation strength score for each candidate root cause event. For example, the average correlation strength between a candidate root cause event and the indicator to be detected is 0.87.

[0032] Optionally, in the time lag direction dimension, using the Pearson correlation coefficient as a criterion, a translational search is performed on the first and second time series data within a set time range (e.g., ±20 seconds) to determine their lag steps. Based on the lag steps, the root cause probability of the candidate root cause event is determined, and a corresponding score is assigned. For example, a larger lag step number indicates a higher root cause probability, thus assigning a higher score.

[0033] Optionally, regarding the stage consistency dimension, the first time-series data of the indicator to be detected can be divided into stages, identifying the rising stage, peak stage, and falling stage. Within each stage, the correlation between the second time-series data and the divided time-series data is calculated to determine the local correlation between the candidate root cause event and the indicator to be detected. For example, the correlation between candidate root cause event B and the indicator to be detected is higher than 0.8 in both the rising and peak stages, and gradually decreases in the falling stage, indicating high stage consistency; while candidate root cause event C and the indicator to be detected remain at a high level in the falling stage, deviating from the downward trend, indicating low stage consistency. Based on this, candidate root cause event B is assigned a high stage consistency score, and the latter a low score.

[0034] Step S208: Based on the analysis results of multiple candidate root cause events in multiple root cause analysis dimensions, determine the target root cause event from the multiple candidate root cause events.

[0035] It is understandable that the target root cause event refers to the event that is finally identified from multiple candidate root cause events after comprehensively considering the quantitative scores and qualitative judgments of the above-mentioned multiple root cause analysis dimensions, through multi-dimensional evidence fusion, weighting and confidence filtering mechanisms.

[0036] Through the above steps S202-S208, anomaly detection is performed on the indicator to be detected, the abnormal interval of the indicator to be detected and the first time series data of the indicator to be detected within the abnormal interval are determined, and the second time series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval are further determined. In other words, the abnormal interval can be used as the analysis center, and root cause analysis can be carried out from multiple root cause analysis dimensions in combination with the first time series data and the second time series data, respectively, to determine the analysis results of multiple candidate root cause events in multiple root cause analysis dimensions. Finally, the target root cause event is determined through the analysis results of multiple root cause analysis dimensions. Since the root cause analysis not only focuses on the abnormal interval but also combines multiple root cause analysis dimensions, it effectively improves the accuracy of determining the target root cause event.

[0037] Optionally, in an exemplary embodiment, performing anomaly detection on the indicator to be detected, determining the abnormal range of the indicator to be detected, and the first time-series data of the indicator to be detected within the abnormal range, includes: acquiring the time-series data of the indicator to be detected and determining the abnormal range of the time-series data to be detected; and extracting the first time-series data of the indicator to be detected within the abnormal range from the time-series data to be detected based on the abnormal range.

[0038] It is understandable that the time series data to be detected refers to the original observation sequence containing timestamps and values ​​collected by a set sampling period (such as 1 second or 5 seconds), which is used to reflect the historical change trajectory of the indicator to be detected.

[0039] Optionally, when determining the abnormal interval, it can be determined whether the time series data to be detected meets the abnormal interval generation conditions. The abnormal interval generation conditions are conditions set based on the dynamic characteristics of the time series to determine whether the abnormality is triggered, continues or ends, including but not limited to: slope conditions, amplitude conditions, data point quantity conditions, etc., which aim to exclude normal fluctuations and short-term disturbances and ensure that the identified abnormal interval has real business impact and analytical value.

[0040] In some embodiments, time-series data of the indicator to be detected is acquired, which may include multiple data points. For example, the time-series data to be detected includes 3600 data points, and the condition for generating an abnormal interval is: the number of data points exceeds a threshold to initiate the abnormal interval identification process. Since 3600 data points exceed the threshold of 1000, the abnormal interval identification process is initiated. In this process, the trend value (i.e., slope) of each data point is calculated sequentially. Based on the slope and the indicator value of the data point itself, the starting point of the abnormal data is determined from the multiple data points. Based on the determined starting point, the data points after the starting point are further processed to determine the ending point of the abnormal data.

[0041] Optionally, after determining the starting point and ending point of the abnormal data, the starting point and ending point of the abnormal data can be expanded respectively, that is, the starting point of the abnormal data is extended forward and the ending point of the abnormal data is extended backward by N data points. The abnormal interval is obtained based on the expanded result, where N is an integer greater than 0, and the value of N can be adjusted adaptively according to the actual accuracy requirements, computing resources, etc.

[0042] In the above embodiments, the abnormal intervals of the time series data to be detected are determined, and the first time series data of the indicator to be detected within the abnormal intervals are extracted, fundamentally solving the core problem of normal sample dilution and abnormal association in traditional full-time series analysis. This significantly improves the sensitivity and accuracy of root cause analysis.

[0043] In an exemplary embodiment, determining the abnormal interval of the time series data to be detected includes: traversing multiple data points included in the time series data to be detected; if the traversed data point meets a preset abnormal start point condition, determining the traversed data point as the abnormal data start point; determining the data point after the abnormal data start point that meets a preset abnormal end point condition as the abnormal data end point; and determining the abnormal interval based on the abnormal data start point and the abnormal data end point.

[0044] Understandably, multiple data points can be traversed sequentially over time to determine whether each traversed data point meets the preset anomaly initiation conditions. When determining whether a traversed data point meets the preset anomaly initiation conditions, the judgment can be based on the feature values ​​of the data points. Feature values ​​are values ​​used to describe the trend and amplitude characteristics of data points. Feature values ​​include: trend values ​​(describing trend characteristics) and index values ​​(describing amplitude characteristics). Trend values ​​refer to the local slope or trend strength calculated in the time series data to be detected, centered on the current data point and combined with the previous M data points. This is used to characterize the rising or falling dynamics of the indicator to be detected in the short term, rather than relying solely on abrupt changes in a single point value. Index values ​​are the observed values ​​of the indicator to be detected at the current sampling time, used to determine whether it exceeds the preset amplitude threshold. An anomaly initiation point refers to the data point that, during the time series traversal, first simultaneously meets both the trend value and index value conditions and is judged as the start of an anomaly, marking the trigger moment of the abnormal behavior.

[0045] After determining the starting point of the abnormal data, an observation interval can be determined based on the data points following the starting point. The observation interval refers to at least one set of continuous sampling points extending sequentially from the starting point of the abnormal data. It is used to continuously monitor whether the abnormality persists or begins to recover. Its length can be dynamically determined by the recovery window parameter. The anomaly endpoint condition is a set of composite criteria used to determine the end of the anomaly. It may include: the amplitude of several consecutive sampling points is lower than the closing threshold, the recovery trend is stable, or the maximum duration is reached, to ensure that the abnormal interval is not mistakenly judged as the end due to a brief decline.

[0046] Specifically, when traversing to the Kth data point, the linear trend slope of its most recent 10 sampling points can be calculated to obtain the trend value. If the trend value exceeds a preset slope threshold, it indicates a significant upward trend near that point. Simultaneously, the index value at that point is higher than the index threshold, satisfying both the trend surge and amplitude breakthrough conditions, thus identifying it as the starting point of abnormal data and recording this point as the initial moment of the anomaly trigger. Subsequently, an anomaly tracking state is entered, expanding backward from the Kth point to form an observation interval. The length of the observation interval can be set based on actual scenario requirements, resource conditions, etc., such as including multiple data sequences consisting of 16 data points. Multiple data sequences are traversed sequentially, monitoring whether the index value of each data point in the traversed data sequence is lower than the closing threshold. When 12 out of 16 consecutive sampling points in the traversed data sequence have values ​​lower than the closing threshold, it indicates a clear recovery trend, satisfying the anomaly endpoint condition. A data point is selected from the traversed data sequence (e.g., the last data point in the traversed data sequence) to be determined as the anomaly data endpoint.

[0047] Optionally, when calculating the closure threshold, a dual-path adaptive mechanism can be used for dynamic calculation based on the core state information during the evolution of the abnormal interval: when a significant peak (e.g., the index value is greater than the set index threshold) has been identified in the data points after the starting point of the abnormal data, the peak value is used as a benchmark and multiplied by a preset recovery coefficient (e.g., 0.7-0.9) to generate a peak-oriented closure threshold; if the abnormality does not form a significant peak, or the peak is unreliable (e.g., sparse sampling, violent fluctuations), it degenerates into using the global baseline (referring to the reference index value calculated using robust statistics (e.g., median, truncated mean, etc.) in the time series data of the index to be detected, reflecting the long-term normal operating level of the index to be detected) as a benchmark and multiplied by another recovery coefficient to generate a baseline-oriented closure threshold. Finally, the larger of the two values ​​is selected as the final closure threshold to ensure that, under any circumstances, the closure judgment is based on sufficient recovery, avoiding premature termination of the abnormal interval.

[0048] In the above embodiments, by traversing data points and setting abnormal starting point conditions, the accurate identification of abnormal data starting points is achieved, ensuring that the starting point has real driving force; introducing abnormal ending point conditions in the end point identification can effectively improve the integrity and accuracy of abnormal intervals.

[0049] In an exemplary embodiment, before determining the second time-series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval, the method for determining the target event further includes: determining multiple root cause indicators of the indicator to be detected; determining the activity state of at least one database indicator included in the multiple root cause indicators within the abnormal interval, and determining candidate root cause events from the at least one database indicator based on the activity state.

[0050] Optionally, when multiple root cause indicators include resource-based indicators, candidate root cause events for the indicator to be detected can be determined directly based on the resource-based indicators.

[0051] Understandably, root cause metrics refer to the collected potential influencing factors, encompassing two sources: one is database metrics, which are the load behaviors carried by database session activity, such as SQL execution, wait events, and transaction states; the other is resource-based metrics, which are system resource consumption metrics at the host or database level, such as network traffic and memory usage. Activity state refers to the aggregated performance of the number of active sessions corresponding to each database metric over time within an abnormal period. It can be quantified using the average number of active sessions (AAS) to reflect the actual contribution of that session event to the load. Candidate root cause events are determined by filtering and merging activity states, retaining the target database metrics with analytical value. These are used for subsequent multi-dimensional correlation analysis and serve as the input basis for root cause localization.

[0052] In some embodiments, multiple root cause metrics, totaling 127, can be identified for the metrics to be detected. These include 120 database metrics (corresponding to different SQL fingerprints) and 7 resource metrics (including network inbound traffic, network outbound traffic, lock wait count, disk writes, memory utilization, and connection count). For each of the 120 database metrics, their activity status within the abnormal interval is analyzed one by one. Each session event is associated with an SQL fingerprint. The number of sessions in an active execution state corresponding to each SQL fingerprint at each sampling time or time bucket can be counted according to a set time granularity (e.g., seconds; e.g., time buckets), and aggregated to form the AAS of that SQL. Subsequently, the sum and peak value of the AAS of each SQL within the abnormal interval are calculated and sorted from high to low. For example, the sum of the AAS of the top 15 SQLs accounts for 94% of all session events, while the sum of the AAS of the remaining 105 SQLs is below the threshold and is judged as low-load noise. Therefore, only the SQL fingerprints with the top 15 AAS sums are retained as candidate root cause events, and the remaining 105 session events are filtered out. For the seven resource-related indicators, no further screening is needed; all of them are directly retained as candidate root cause events because they are direct measures of system-level resource consumption, eliminating the issue of determining activity levels. Furthermore, each resource indicator has clear physical meaning and observability. Ultimately, a total of 22 candidate root cause events are formed, consisting of 15 SQL-related candidates and 7 resource-related candidates. For each candidate root cause event, second-series data within the abnormal interval is extracted for subsequent correlation analysis, time lag detection, and comprehensive scoring.

[0053] In the above embodiments, by using a session activity state filtering mechanism for database metrics, the accuracy and computational efficiency of the candidate root cause event set are significantly improved.

[0054] In an exemplary embodiment, determining the activity status of at least one database indicator, including multiple root cause indicators, within an abnormal interval includes: extracting features from at least one database indicator to determine an indicator fingerprint corresponding to the at least one database indicator; clustering each indicator fingerprint to obtain multiple cluster sets; determining the number of active sessions for each of the multiple cluster sets within the abnormal interval, and determining the activity status of at least one database indicator within the abnormal interval based on the number of active sessions.

[0055] It should be noted that an indicator fingerprint refers to a feature vector uniquely representing the logical behavior pattern of a session event, generated by standardizing, extracting, normalizing, and structurally combining key features associated with the database indicator, such as the SQL text, wait event type, execution duration range, database, and schema name. This fingerprint focuses on its execution semantics and resource interaction patterns, thereby achieving semantic clustering of multiple session instances with the same semantics but different parameters. A cluster set refers to a set of semantic similarities formed by automatically grouping a large number of session events based on the feature vector of the indicator fingerprint using an unsupervised clustering algorithm. Each cluster set represents a class of database operation patterns with common behavioral characteristics.

[0056] The number of active sessions refers to the total number of database sessions that belong to a certain cluster and are in an active execution or waiting state at a specific sampling time. Its time-series changes reflect the load intensity and concurrency trend of this type of operation mode within the abnormal interval.

[0057] In one specific embodiment, the abnormal period was from 14:02:30 to 14:08:10. All active database metrics were collected during this time period. Each database metric included fields such as the original SQL statement, wait events, execution time, the user, and the database name. Feature extraction was performed on each database metric to form a metric fingerprint. Subsequently, a clustering algorithm was used to cluster the metric fingerprints, automatically identifying several session sets with similar behavioral patterns. Within the abnormal period, the number of active sessions for each cluster was counted at each time point, with a sampling granularity of 10 seconds. Analysis revealed that the number of active sessions in cluster A increased exponentially, peaking at 89 sessions; the number of active sessions in cluster B remained stable between 15 and 20, without significant fluctuations; and the number of active sessions in cluster C was consistently below 5 and unrelated to the anomaly. Based on this, it was determined that: Cluster A's activity status is high concurrency, strong correlation, and continuous growth, and its behavior pattern continuously drives system resource consumption within the abnormal range, making it a potential root cause; Cluster B is a stable load type and can be considered as an accompanying factor; Cluster C is an irrelevant low load type and is excluded. Ultimately, the SQL fingerprint corresponding to Cluster A was included in the candidate root cause events and entered the subsequent evaluation process for correlation strength, time lag relationship, and phase consistency.

[0058] In the above embodiments, the mechanism for identifying the activity status of database metrics significantly improves the accuracy and engineering practicality of root cause localization. Compared with traditional methods that rely solely on deduplication of raw SQL text or simple aggregation, this method achieves intelligent merging of similar operations with different parameters through feature extraction and clustering. This effectively avoids load dispersion and misjudgment caused by parameter differences and can identify the behavioral pattern groups that truly constitute bottlenecks.

[0059] In an exemplary embodiment, multiple candidate root cause events are analyzed from multiple root cause analysis dimensions based on first time-series data and second time-series data, respectively, to determine the analysis results of the multiple candidate root cause events in multiple root cause analysis dimensions. This includes: determining the correlation coefficient between the target indicator and any candidate root cause event among the multiple candidate root cause events based on the first time-series data and second time-series data; determining the target lag step between the target indicator and any candidate root cause event among the multiple candidate root cause events based on the first time-series data and second time-series data; determining the stage trend value between the target indicator and any candidate root cause event among the multiple candidate root cause events based on the first time-series data and second time-series data; and weighting the correlation coefficient, target lag step, and stage trend value of any candidate root cause event to obtain the analysis result of any candidate root cause event.

[0060] The correlation coefficient refers to the statistical correlation measure calculated between the time-series data of the indicator to be detected and any candidate root cause event within the anomaly interval, used to characterize the strength of the association between the two in terms of numerical change trends. This application uses multiple correlation algorithms (including but not limited to: Pearson correlation coefficient, Spearman rank correlation coefficient, Kendall rank correlation coefficient, mutual information or distance correlation coefficient) to calculate the correlation coefficient separately, and the results are normalized to comprehensively evaluate the linear, monotonic or nonlinear dependence between the candidate root cause event and the indicator to be detected.

[0061] The target lag step refers to the offset within the preset time lag search range, which is achieved by sliding and aligning the first time series data of the candidate root cause event with the second time series data of the indicator to be detected, so that the two have the maximum absolute correlation. Its positive and negative signs are used to characterize the causal direction: a positive number indicates that the candidate root cause event precedes the occurrence of the abnormality of the indicator to be detected, a negative number indicates that the candidate root cause event lags behind the occurrence of the abnormality of the indicator to be detected, and zero indicates that the two change approximately synchronously.

[0062] The stage trend value is a measure of the consistency in trend direction and intensity changes between the second time-series data and each first time-series sub-data of the first time-series data of a candidate root cause event. It is used to evaluate the multi-stage coordinated behavior of the candidate event throughout the entire process of anomalous evolution. This value comprehensively reflects whether the candidate root cause event synchronously strengthens, weakens, or reverses with the indicator to be detected at each stage, and is a key basis for judging whether it is a stable driving source rather than an occasional disturbance.

[0063] Specifically, the values ​​obtained from the three root cause analysis dimensions mentioned above—correlation coefficient, target lag step count, and stage trend value—for any candidate root cause event can be weighted and fused to generate a comprehensive evaluation value, which is used to characterize the credibility of the candidate event as a true root cause. For example, corresponding weights can be set for the correlation coefficient, target lag step count, and stage trend value. The magnitude of the weights can be adaptively adjusted according to the actual root cause localization scenario, for example, the correlation coefficient weight is 0.5, the target lag step count weight is 0.3, and the stage trend value weight is 0.2.

[0064] In the above embodiments, by integrating three dimensions—correlation coefficient, target lag steps, and stage trend value—a multidimensional root cause analysis framework driven by anomaly intervals is constructed, significantly improving the scientific rigor and engineering practicality of root cause assessment. Compared to existing technologies that rely solely on a single correlation coefficient or simple time-lag detection, this greatly enhances the accuracy of target event identification.

[0065] In an exemplary embodiment, determining the target lag step number for a target indicator and any candidate root cause event among multiple candidate root cause events based on first time-series data and second time-series data includes: obtaining a time-lag search interval; the time-lag search interval includes multiple time-lag search steps; traversing the multiple time-lag search steps, and if the traversed time-lag search step number is different from the target threshold, shifting the first time-series data and the second time-series data based on the traversed time-lag search step number to obtain shifted first time-series data and second time-series data; calculating the shifted correlation value of the shifted first time-series data and second time-series data; and determining the target lag step number for any candidate root cause event based on the shifted correlation value.

[0066] Understandably, the time delay search interval refers to a continuous integer range on the time axis used to traverse offsets in order to identify whether there is a time causal lead or lag relationship between candidate root cause events and the indicators to be detected. Its starting and ending points are determined by the maximum acceptable propagation delay and the system sampling frequency, and it includes multiple discrete time delay search steps.

[0067] The time-delay search step count refers to the offset within the time-delay search interval, measured in units of sampling periods. It characterizes the forward or backward shift of the candidate root cause event time series relative to the time series of the indicator to be detected. A positive integer indicates that the candidate root cause event occurs before the indicator to be detected, a negative integer indicates that the candidate root cause event occurs after the indicator to be detected, and zero indicates that the two change synchronously.

[0068] Specifically, the process iterates through multiple time-lag search steps. If the current time-lag search step differs from the target threshold, a directional shift is performed on the time axis of the second time-series data of the candidate root cause event and the first time-series data of the indicator to be detected, aligning them to a specific offset relationship in the time dimension. This constructs a paired sample sequence with a computable correlation under this offset condition. After the shifting process, the correlation metric calculated from the paired two sets of time-series data is used, such as the Pearson correlation coefficient. Within the time-lag search interval, the shifted correlation value with the largest absolute value is determined as the time-lag search step. The time-lag search step represents the time offset position where the strongest temporal association between the candidate root cause event and the indicator to be detected occurs, serving as a key basis for determining the causal direction.

[0069] In the above embodiments, by constructing a time-delay search mechanism, the precise quantification of the causal temporal relationship between candidate root cause events and the indicators to be detected is achieved. Searching across the entire time-delay range elevates root cause localization from correlation discovery to causal inference.

[0070] In an exemplary embodiment, the method for determining the target event further includes: calculating a pre-shift correlation value based on first time-series data and second time-series data when the number of time-delay search steps reached is the same as the target threshold; comparing the post-shift correlation value and the pre-shift correlation value; and determining the target lag step number of any candidate root cause event from the post-shift correlation value and the pre-shift correlation value according to the comparison result.

[0071] Specifically, the target threshold refers to a preset reference value used during the time-lag search process to determine whether a shift operation needs to be performed. It can be 0, representing the synchronization relationship between the candidate root cause event and the indicator to be detected in the original, unshifted state. The target threshold can serve as a control condition for optimizing the computation path, avoiding redundant shift operations on the synchronized state. The pre-shift correlation value is the correlation metric calculated directly based on the original aligned time series without any time axis shifting of the first and second time series data. It represents the original correlation strength between the candidate root cause event and the indicator to be detected in the zero-lag state. When the time-lag search step count reaches 0, it is determined that the step count equals the target threshold, therefore no shift operation is performed. The pre-shift correlation value is calculated directly using the two originally aligned time series data. The process continues to iterate through other time-lag steps (e.g., 3), performing shift operations to calculate the post-shift correlation value. When the iteration ends, all calculation results are compared, and the target lag step count for any candidate root cause event is determined from the post-shift correlation value and the pre-shift correlation value.

[0072] In the above embodiments, by retaining the pre-shift correlation value of the original state at the target threshold as a benchmark, the accuracy and robustness of root cause localization are significantly improved, and false time delay inferences caused by abnormal data fluctuations or local peaks are avoided.

[0073] In an exemplary embodiment, determining the stage trend value of the indicator to be detected and any candidate root cause event among multiple candidate root cause events based on first time-series data and second time-series data includes: dividing the first time-series data to obtain multiple first time-series sub-data, and determining the local trend data of the multiple first time-series sub-data; performing correlation analysis between the second time-series data of any candidate root cause event and the local trend data of the multiple first time-series sub-data respectively, and determining the stage trend value of any candidate root cause event based on the correlation analysis results.

[0074] Optionally, the first time series sub-data refers to multiple continuous, non-overlapping or partially overlapping local time series segments obtained by segmenting the first time series data. Each sub-data represents an independent dynamic stage within the abnormal interval. The division can be based on local trend changes in time series fluctuations or a fixed time window; this embodiment does not impose any limitations. The local trend data is the slope value obtained by fitting each first time series sub-data using a linear regression method, used to quantify the direction and intensity of change of the target indicator within the sub-data segment. Positive values ​​indicate an upward trend, negative values ​​indicate a downward trend, larger absolute values ​​indicate more drastic changes, and zero values ​​indicate a tendency towards stability. This trend value does not depend on the global baseline and only reflects local dynamic characteristics. By performing correlation analysis on the local trend data of the second time series data and multiple first time series sub-data, the trend consistency score between the second time series data and the first time series sub-data can be determined. The average of the obtained trend consistency scores is used to obtain the stage trend value of the candidate root cause event. By calculating the stage trend value, a quantitative assessment of the behavioral consistency of the candidate event in the dynamic evolution process can be achieved.

[0075] To better understand the process of determining the target event described above, the implementation flow of the method for determining the target event will be further described below in conjunction with optional embodiments, but this is not intended to limit the technical solution of the embodiments of this application.

[0076] Step S1: Collect the time-series data of the indicator to be detected and perform anomaly detection on the time-series data to obtain at least one abnormal interval. Anomaly detection can be performed using an adaptive detector. Specifically, the discrete time series of the time-series data to be detected is X={x1,x2,...,xT}, and the corresponding timestamp sequence is TS={t1,t2,...,tT}. The detection process includes at least the following steps: 1. When the number of effective sampling points is less than the slope window parameter SlopeWindow, no abnormal interval is output; 2. Calculate the global baseline GlobalBaseline of the indicator to be detected, preferably using the median of the entire time series; 3. Calculate the window slope WindowSlope(i) for each sampling point (i.e., data point) xi, using the following formula:

[0077] WindowSlope(i)=(xi-x{i-SlopeWindow}) / (ti-t{i-SlopeWindow}).

[0078] Where xi: the index value of the current i-th sampling point; x(i-SlopeWindow): the index value of the previous SlopeWindow points; ti-t(i-SlopeWindow): the time elapsed between the two points.

[0079] If not currently in the abnormal tracking state, jointly determine whether to start the abnormal interval based on the slope condition and the amplitude condition. The slope condition is WindowSlope(i) > SlopeThreshold (slope threshold); the amplitude condition is determined according to the peak detection mode: (1) In the relative multiple mode, it is required that xi > Baseline × RelativeThreshold (relative threshold); (2) In the absolute increment mode, it is required that xi - Baseline > AbsoluteThreshold (absolute threshold); (3) In the adaptive mode, when Baseline < AdaptiveBaselineLimit (adaptive baseline limit), the relative multiple mode is adopted, otherwise the absolute increment mode is adopted; (4) In the moving baseline mode, first calculate the local baseline based on the median of the previous BaselineWindow (baseline window) sampling points before the current point, and then require xi > MovingBaseline (moving baseline) × MovingBaselineThreshold (moving baseline threshold). When both the slope condition and the corresponding amplitude condition are satisfied, it is considered that the current sampling point triggers an abnormality, and trace back forward to determine the starting point of the abnormal interval; the preferred trace back is: find the first position lower than Baseline × BacktraceThreshold (trace back threshold) forward from the trigger point, and determine the starting point of the abnormal interval based on this; after entering the abnormal tracking state, continuously update the peak value PeakValue and peak position PeakIdx of the abnormal interval; when closing the abnormal interval, first determine the closure threshold ClosureThreshold, and select the larger value between RecoveryThreshold × the current baseline and RecoveryThreshold × the global baseline; when the number of sampling points lower than the closure threshold within the current sampling point and its subsequent RecoveryWindow (recovery window) sampling points reaches the preset number, it is considered that the abnormality has recovered, and the end point of the abnormal interval is determined; if the maximum abnormal duration MaxAnomalyDuration (maximum abnormal duration) is configured, then when the abnormal duration reaches this threshold, forcefully close the abnormal interval;

[0080] Step S2: Expand the starting point and ending point of the abnormal interval to form the final abnormal interval. The purpose of the expansion is to retain the context data before and after the occurrence of the abnormality, so as to carry out subsequent correlation analysis and time lag identification. Combined with the program implementation, the expansion amount directly uses the slope window parameter SlopeWindow of the abnormal detector. Specifically, perform window expansion processing on each abnormal interval, and expand its start and end indexes forward and backward by SlopeWindow sampling points respectively to obtain the abnormal interval, that is:

[0081] AnalysisStartIdx=max(0,StartIdx-SlopeWind);

[0082] AnalysisEndIdx=min(T-1,EndIdx+SlopeWindow).

[0083] The start and end times of the abnormal interval are updated accordingly. Thus, the slope window parameter is used both for slope calculation when an anomaly is triggered and for preserving context samples before and after the abnormal interval, ensuring consistency in the time scale between the detection window and the abnormal interval. Subsequently, slicing is performed on the time series of the indicator to be detected corresponding to the abnormal interval, ensuring that only key samples related to the anomaly are retained. Specifically, the time series of the indicator to be detected is sliced ​​according to the expanded AnalysisStartIdx and AnalysisEndIdx, retaining only data points within the interval; after slicing, the interval index is reset to the local coordinate system after slicing, i.e., the start index is set to 0, and the end index is set to the index of the last sampling point of the sequence after slicing, and the start time, end time, and duration are updated synchronously. Therefore, in the current program implementation, the abnormal interval is the expanded interval formed by the window expansion process, and the subsequent slicing and local index relocation are used to restrict the time series of the indicator to be detected and the subsequent candidate root cause event analysis process to this expanded interval, thereby retaining only key samples related to this anomaly and eliminating a large number of normal samples outside the abnormal interval. This design reduces interference from normal samples, fundamentally improving the sensitivity of correlation analysis to anomalous behavior. For multiple detected anomalous intervals, if the time interval between two adjacent anomalous intervals does not exceed the MergeGap, interval merging is performed, retaining larger peak values ​​and higher severity levels. Therefore, an interval that can be identified as an anomalous interval must at least satisfy a combination of the following conditions: the window slope exceeds a slope threshold at a certain detection point, the current value satisfies the peak condition relative to the corresponding baseline, and it closes when the recovery condition is met or the maximum duration is reached. The anomalous interval AnomalyInterval includes at least: 1. StartTime; 2. EndTime; 3. StartIndexStartIdx; 4. EndIndexEndIdx; 5. PeakValue; 6. Duration; 7. Severity.

[0084] Step S3: Construct a candidate root cause event set within the anomaly interval. The candidate root cause event set includes at least two categories: 1. SQL candidate set: Based on database active session AAS data, sorted by AAS aggregation value within the anomaly interval, and the Top N SQL fingerprints are selected as candidates; 2. Resource candidate set: Includes database QPS, host network inbound traffic, host network outbound traffic, and optional resource indicators such as locks, disks, and memory. Among them, AAS (Average Active Sessions) is the core database load representation in SQL candidate screening and subsequent related scoring. Its meaning is not the number of SQL executions, nor the number of slow SQL statements, but the number of sessions that are active and can be attributed to a certain SQL summary at a given sampling time or sampling time bucket, or its time average. In one implementation, the database process list or session list is collected periodically; for each active session, at least the following fields are extracted: 1. Current waiting event or status EventName; 2. SQL text or SQL sample text; 3. Database name and schema name; 4. One or more of username and hostname; 5. Execution duration or maximum execution duration.

[0085] The SQL text is then standardized or fingerprinted to obtain SQLDigest, which is used to group SQLs with different literals but the same structure into the same SQL fingerprint. For a set of sessions with the same sampling time t, the same SQLDigest, and the same wait event e, the number of active sessions is denoted as N(d,e,t). Then, at the basic sampling granularity, the AAS of this sampling point can be expressed as: AAS_sql(d,e,t)=N(d,e,t). AAS has a dual role: 1. The first role is candidate convergence, that is, using AAS within the abnormal interval to screen out a small number of high-load SQLs most likely to cause anomalies from a massive amount of SQL; 2. The second role is scoring input, that is, the AAS time series of the selected SQLs is used as a candidate root cause event sequence, which, together with the time series of the indicators to be detected, participates in the correlation, lag, stage consistency, and comprehensive score calculation in steps S5 to S8. The AAS aggregation value determines which SQLs are eligible to enter the candidate set, while the AAS time series shape of the SQL determines how many points these candidate SQLs get in the correlation analysis. The former is the candidate screening threshold, while the latter is the root cause ranking criterion. Although they have different functions, they are connected.

[0086] In database scenarios, the most likely cause of CPU or wait anomalies is often a small number of high-contribution SQL queries, rather than all SQL queries. Therefore, the following candidate construction scheme is adopted: 1. Adaptively select the AAS query resolution based on the anomaly interval span, which could be 1 second, 10 seconds, or 60 seconds; 2. Align the anomaly interval boundaries to the time bucket corresponding to the resolution; 3. Calculate the AAS aggregation value of each SQL fingerprint within the anomaly interval; 4. Sort the aggregation values ​​from high to low and select the top Q SQL summaries; 5. Convert the AAS time series corresponding to each SQL fingerprint into a candidate time series with a unified time axis.

[0087] Step S4: Perform timeline alignment and missing value imputation on the first time-series data of the indicator to be detected and the second time-series data of the candidate root cause event to construct an aligned time-series sequence with a uniform sampling interval. Alignment is performed according to a uniform start and end time and resolution; missing points can be filled with zero, previous values, or linear interpolation.

[0088] Step S5: For the indicator to be detected and each candidate root cause event, perform multi-algorithm correlation analysis within the abnormal interval, and record the correlation values ​​corresponding to each algorithm. To facilitate unified sorting, the results obtained from multiple correlation algorithms can be combined into a correlation strength score. Based on the current implementation, the correlation strength score is the average of the absolute values ​​of the correlation values ​​of each algorithm, i.e.: CorrScore = Avg(|s1|,|s2|,...,|sn|), where s1, s2,..., sn are the correlation values ​​obtained from different correlation algorithms. The absolute value average is used because root cause candidates may be positively correlated with the indicator to be detected, or they may exhibit a negative correlation in certain abnormal recovery scenarios.

[0089] Step S6: Perform a time-lag search for the indicator to be detected and each candidate root cause event, and find the lag step with the largest absolute correlation value within the preset time lag range. When the lag step is positive, it means that the candidate root cause event leads the indicator to be detected; when the lag step is negative, it means that the indicator to be detected leads the candidate root cause event; when the lag step is zero, it means that the two change approximately synchronously. In order to determine the order of candidate root cause events and the indicator to be detected, a translation search is performed on the candidate sequence within the interval context. Let the maximum search step be MaxLag, which can be determined by the maximum expected propagation time Tlag and the sampling interval Δt, i.e., MaxLag=ceil(Tlag / Δt). For each candidate lag step of lag∈[-MaxLag,+MaxLag], calculate the corresponding shifted correlation value Corr(lag) once, and obtain a set of shifted correlation values ​​Corr(-MaxLag),...,Corr(0),...,Corr(+MaxLag), and then select the one with the largest absolute value as the optimal lag result.

[0090] The calculation process for the shifted correlation value Corr(lag) of any given lag includes:

[0091] 1. When lag > 0, it indicates that the candidate root cause event is ahead of the indicator to be detected. The second sequence data is shifted forward by lag sampling steps. At this time, the first N samples of the first sequence data and the N samples of the second sequence data starting from the lag sample form a pairing sequence, where N = min(len(X), len(Y) - lag).

[0092] 2. When lag < 0, it indicates that the indicator to be detected is ahead of the candidate root cause event. The first sequence data is shifted forward by |lag| sampling steps. At this time, the N samples of the first sequence data starting from the |lag|th sample are taken and paired with the first N samples of the second sequence data to form a pairing sequence, where N = min(len(X) - |lag|, len(Y)).

[0093] 3. When lag=0, no shifting is performed, and the first sequence data is directly paired with the second sequence data according to the same time position, where N=min(len(X),len(Y));

[0094] 4. When the number of valid paired samples N formed under a certain lag is less than the preset minimum value, the shifted correlation value corresponding to that lag is recorded as 0, or it is not included in the optimal lag step comparison.

[0095] The shifted correlation value Corr(lag) in the time-lag search is calculated using the Pearson correlation coefficient. Pearson is chosen because it has high sensitivity to linear relationships and can effectively capture the linear correlation between paired sequences in time-lag detection. For any paired sample sequence {(x1,y1),(x2,y2),...,(xN,yN)} obtained from any lag, its shifted correlation value can be calculated as follows:

[0096] ;

[0097] in, This represents the mean of the paired samples of the indicator to be detected under this lag. Let be the mean of the paired samples of candidate root cause events under that lag. After calculating Corr(lag) for each lag in the manner described above, select the lag number that satisfies the following formula as the optimal lag number:

[0098] ;

[0099] Record CorrelationAtLag=Corr(Lag) The optimal lag step is used to characterize the time offset at which the strongest temporal correlation occurs between the detected indicator and the candidate root cause event, and is not directly equivalent to the root cause conclusion. 1. Lag >0 indicates that the candidate root cause event leads the detected indicator, suggesting a higher probability of it being the root cause; 2. Lag =0 indicates that the two are synchronized, and can be marked as a synchronous correlation indicator or a time-dependent correlation indicator; 3. Lag A value <0 indicates that the candidate root cause event is lagging, representing more of an outcome than a cause, and can be labeled as an outcome-type correlation indicator. In root cause localization scenarios, if the candidate root cause event corresponding to the optimal lag step count leads the indicator to be detected, the root cause score of the candidate root cause event is increased; if the candidate root cause event corresponding to the optimal lag step count is synchronized with the indicator to be detected, a neutral lag score is assigned and it is retained as an accompanying root cause or a strongly correlated candidate; if the candidate root cause event corresponding to the optimal lag step count lags the indicator to be detected, its root cause score is decreased, or it is labeled as an outcome-type correlation indicator. The lag detection results should include at least: 1. Optimal lag step count (LagSteps); 2. Lag duration (LagDuration); 3. Lag confidence; 4. Correlation AtLag value at the optimal lag point; 5. Directional information of the correlation value at the optimal lag point.

[0100] Step S7: Divide the abnormal interval of the indicator to be detected into stages, and obtain one or more of the following: rising stage, falling stage, stable stage, oscillation stage and peak stage. Calculate the stage correlation of candidate root cause events in each stage, and optionally calculate stage time delay information.

[0101] To reduce the interference of local resonance or short-term accidental correlation within abnormal intervals on root cause determination, this application further performs stage division within the abnormal interval of the indicator to be detected. The stage division is based solely on the abnormal interval sequence of the indicator itself, and the resulting stage results are then used for subsequent staged correlation analysis and staged time lag analysis of candidate root cause events. The stages include: 1. Rising stage; 2. Falling stage; 3. Stable stage; 4. Oscillation stage; 5. Peak stage.

[0102] In one embodiment, step S7 includes at least the following processing procedures:

[0103] 1. Set the minimum stage length. The minimum stage length refers to the minimum number of sampling points that a single stage should contain, used to suppress excessive segmentation caused by short-term noise. When the length of the abnormal interval is less than the minimum stage length, stage division is not performed.

[0104] 2. Construct local analysis windows. For abnormal intervals that meet the stage division conditions, set up local analysis windows that slide along the time axis within the abnormal intervals.

[0105] 3. Calculate the local trend value. The local trend value is used to characterize the direction and intensity of change of the indicator to be detected within the current local analysis window. In this embodiment, the local trend value is represented by the linear regression slope of the sampled values ​​within the window. Let there be n sampling points in the local analysis window, and let x be the independent variable numbered in the sampling order. i The corresponding sample value is y i The local trend value Trend is calculated using the following formula:

[0106]

[0107] The formula consists of a numerator (covariance term) and a denominator (variance term), essentially representing the slope calculation formula in linear regression. Trend > 0 indicates an overall upward trend in the local window, while Trend < 0 indicates an overall downward trend. A larger |Trend| indicates a more pronounced change.

[0108] 4. Stage Determination. For each local analysis window within the abnormal interval, stage determination is performed according to a predetermined order. Based on the existing implementation of this project, the determination order and rules are as follows: When |Trend| < 0.01, it is determined to be a stable stage, where 0.01 is the stability threshold, used to indicate that the overall change within the local window is small; when Trend > 0.05, it is determined to be an upward stage, where 0.05 is the upward threshold, used to indicate that there is a significant upward trend within the local window; when Trend < -0.05, it is determined to be a downward stage, where -0.05 is the downward threshold, used to indicate that there is a significant downward trend within the local window; when the above stable, upward, and downward conditions are not met, but the local window meets the oscillation determination condition, it is determined to be an oscillation stage; when the above conditions are not met, but the local window meets the peak determination condition, it is determined to be a peak stage; all other cases are determined to be stable stages.

[0109] 5. Determine oscillation and peak characteristics. Oscillation characteristics are determined by counting the occurrences of local maxima and minima within a local window; when the ratio of the occurrence count to the window length is greater than 0.3, the local window is considered to have oscillation characteristics. Peak characteristics are determined by the mean and standard deviation of the samples within a local window; when the deviation of a sampled value from the window mean is greater than 3 times the standard deviation, the local window is considered to have peak characteristics.

[0110] 6. Output stage fragments. During stage division, the current stage type and current stage start position are continuously maintained; when a change in stage type is detected and the current stage length reaches the minimum stage value, the fragment is broken.

[0111] 7. Merge adjacent stages of the same type. For two stages that are adjacent in time and of the same stage type, perform a merge process and update the end position and overall trend value of the merged stage to reduce redundant segmentation.

[0112] 8. Calculate the stage correlations for different stages, and optionally calculate stage time lag information. After completing the stage division, for each candidate root cause event, extract the time-series data of the target index and the candidate root cause event within each stage according to the stage division results, and calculate the stage correlation separately for each stage. Based on the existing implementation of this project, the stage correlation is obtained by averaging the absolute values ​​of the calculation results of multiple correlation algorithms. Furthermore, in the implementation method that enables stage time lag analysis, the time lag search in step S6 can also be performed on the data segments corresponding to each stage to obtain the lag steps, the optimal lag point correlation value, and the lag confidence for each stage; at this time, the lag for different stages is calculated separately, rather than directly reusing the single lag result of the entire anomaly analysis window.

[0113] Therefore, this application distinguishes two layers of time-lag information: 1. The overall time-lag result calculated in step S6 for the entire anomaly analysis window is used to characterize the overall sequential relationship between candidate root cause events and target indicators throughout the anomaly process, and serves as the main time-lag basis in the comprehensive scoring; 2. When phased time-lag analysis is enabled, the phased time-lag results calculated for each phase are used to characterize the local sequential relationship between candidate root cause events and target indicators in different anomaly phases, serving as a supplementary basis for phase consistency and local interpretation, rather than replacing the overall time-lag result. Phase division and phase correlation analysis capabilities are already available, but the main business process defaults to primarily using the overall time-lag result; the phased time-lag result is optional enhanced analysis information. Through the above processing, it is possible to distinguish whether candidate root cause events are continuously correlated throughout the anomaly process or only briefly correlated in a certain local phase, thus providing a more granular basis for subsequent comprehensive scoring and interpretation output.

[0114] Step S8: Based on the relevance strength, confidence level, time delay direction and stage consistency, the candidate root cause events are comprehensively scored to obtain the root cause ranking results.

[0115] This application calculates a comprehensive root cause score for each candidate root cause event, in the following form: Score=w1 Corr+w2 Lag+w3 Phase. Where: 1. Corr: Correlation strength score, used to characterize the strength of the association between the candidate root cause event and the detected indicator within the anomaly analysis window; it is obtained by combining the calculation results of one or more of Pearson, Spearman, Kendall, mutual information, and distance correlation. 2. Lag: Lag direction score, used to characterize the leading or lagging relationship between the candidate root cause event and the detected indicator; when the candidate root cause event leads the detected indicator, a higher score is assigned; when the candidate root cause event changes synchronously with the detected indicator, a neutral score is assigned; when the candidate root cause event lags behind the detected indicator, its score is reduced or no score is awarded. 3. Phase: Phase consistency score, used to characterize whether the candidate root cause event continuously shows a stable association in different phases such as abnormal rise, fall, stability, oscillation, and spike; if only a random association occurs in a local short-term phase, this score is reduced. 4. w1, w2, and w3 are configurable weights.

[0116] Before performing the above comprehensive scoring, result reliability constraints can be set to filter candidate root cause events that lack statistical significance or stability. The constraints include at least one of the following: 1. The number of effective sample points reaches a preset minimum value. The number of effective sample points refers to the number of overlapping sample points that can participate in the calculation of "a single candidate root cause event and the target indicator" under the current analysis window and current lag pairing, rather than the total number of sample points after merging all candidate root cause events; 2. The consistency of the calculation results of multiple correlation algorithms reaches a preset threshold. The consistency does not simply mean that the comprehensive score in step S5 reaches the threshold, but rather that the difference in the results given by different correlation algorithms for the same candidate after normalization does not exceed a preset range. Consistency can be defined as Consistency=1-Std(|s1|,|s2|,...,|sn|), and Consistency≥θcons (preset threshold) is required; 3. The analysis results of multiple stages within the abnormal interval meet the minimum stability requirements. The stability requirement means that the correlation between the candidate root cause event and the indicator to be detected does not only appear in a single short-term phase, but persists in multiple phases within the abnormal range; and the leading, synchronous, or lagging direction exhibited by the candidate root cause event in these multiple phases is consistent or substantially consistent. For candidate root cause events that show accidental correlation only in local short-term phases, or whose direction frequently reverses in different phases, their credibility can be reduced, or they can be filtered out before ranking.

[0117] Step S9: Generate an interpretation of the ranking results. If the top-ranked candidate root cause event is an SQL candidate, output the SQL text, SQL summary, summary hash, database, and schema information. If the SQL candidate does not reach the threshold, output a resource-indicator-type root cause interpretation. The resource-indicator-type root cause interpretation means that when high-scoring SQL candidates are insufficient to support the conclusion that "an anomaly is directly driven by a certain SQL statement," instead, output resource-level root cause candidates and their interpretation text, such as a sudden increase in QPS, abnormal increase in network inbound traffic, network outbound traffic congestion, disk write saturation, lock wait accumulation, memory usage approaching the upper limit, etc., and explain the correlation strength, leading or synchronous relationship, anomaly stage, and suggested focus areas with the target indicator. Root cause output includes: 1. Root cause candidate name; 2. Overall score; 3. Correlation strength score; 4. Optimal lag step and its direction explanation; 5. Stage consistency analysis results; 6. Natural language interpretation text; 7. One or more of SQL summary hash, SQL text, database name, and schema name; 8. Optional handling suggestions or attention tags; 9. Optional result reliability description.

[0118] For resource indicator-based root cause explanations, the natural language explanation text can be generated using the following template: Within the analysis window, if the candidate root cause event M shows a significant change in LagDuration time before / at the same time / after the occurrence of the target indicator anomaly, its correlation strength is Corr, its phase consistency is Phase, and its comprehensive score is Score. Based on this, it is determined to be a suspected root cause or accompanying factor at the resource level.

[0119] This application focuses on anomaly intervals for analysis, avoiding the dilution of anomaly correlation by normal data and improving the accuracy of root cause identification. It uses AAS aggregation values ​​to filter the Top N SQL queries before performing deep correlation analysis, significantly reducing candidate size and computational noise. It integrates Pearson, Spearman, Kendall, mutual information, and distance correlation methods to improve robustness to complex relationships. It identifies leading indicators through time-lag search, bringing root cause localization closer to the possible cause from the correlation level. Through anomaly phase division and phase consistency assessment, it reduces misjudgments caused by accidental resonance. It can automatically switch between SQL root cause and resource root cause analysis, adapting to different scenarios such as internal database load and external traffic surges. The final output includes SQL text, fingerprint hash, database / schema, and natural language interpretation, facilitating direct use in inspection reports, alarm notifications, and operational handling. It does not heavily rely on complete topology, log semantics, or knowledge graphs, making it more lightweight and easier to deploy in real-time for database monitoring.

[0120] Based on the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0121] This embodiment also provides a target event determination device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0122] Figure 3 This is a structural block diagram of a target event determination device according to an embodiment of this application, such as... Figure 3 As shown, the device includes:

[0123] Detection module 32 is used to perform anomaly detection on the indicator to be detected, determine the abnormal range of the indicator to be detected, and the first time series data of the indicator to be detected within the abnormal range.

[0124] The first determining module 34 is used to determine the second time-series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval;

[0125] Analysis module 36 is used to analyze the multiple candidate root cause events from multiple root cause analysis dimensions based on the first time series data and the second time series data, and to determine the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions respectively.

[0126] The second determining module 38 is used to determine the target root cause event from the multiple candidate root cause events based on the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions.

[0127] According to the above-mentioned device, anomaly detection is performed on the indicator to be detected, the abnormal interval of the indicator to be detected and the first time series data of the indicator to be detected within the abnormal interval are determined, and then the second time series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval are further determined. In other words, the abnormal interval can be used as the analysis center, and the root cause analysis can be carried out from multiple root cause analysis dimensions by combining the first time series data and the second time series data, respectively, to determine the analysis results of multiple candidate root cause events in multiple root cause analysis dimensions. Finally, the target root cause event is determined through the analysis results of multiple root cause analysis dimensions. Since the root cause analysis not only focuses on the abnormal interval, but also combines multiple root cause analysis dimensions, the accuracy of determining the target root cause event is effectively improved.

[0128] In an exemplary embodiment, the detection module 32 is further configured to acquire the time-series data of the indicator to be detected; if the multiple data points included in the time-series data to be detected meet the preset abnormal interval generation conditions, determine the start point and the end point of the abnormal interval from the multiple data points; determine the abnormal interval based on the start point and the end point of the abnormal interval, and extract the first time-series data of the indicator to be detected within the abnormal interval from the time-series data to be detected based on the abnormal interval.

[0129] In an exemplary embodiment, the detection module 32 is further configured to: traverse the plurality of data points according to a set time sequence; determine the feature value of the traversed data point; if the feature value of the traversed data point satisfies a preset abnormal data start point condition, determine the traversed data point as an abnormal data start point; determine an observation interval based on the data points after the abnormal data start point; if the data points included in the observation interval satisfy a preset abnormal end point condition, determine the abnormal data end point from the data points included in the observation interval; determine the start point of the abnormal interval based on the abnormal data start point; and determine the end point of the abnormal interval based on the abnormal data end point.

[0130] In one exemplary embodiment, the apparatus further includes a third determining module; the third determining module is configured to determine a plurality of root cause indicators of the indicator to be detected; when the plurality of root cause indicators include at least one database indicator, determine the activity state of the at least one database indicator within the abnormal interval, and filter out a target database indicator from the at least one database indicator based on the activity state, and determine a candidate root cause event based on the target database indicator; when the plurality of root cause indicators include resource-based indicators, determine a candidate root cause event of the indicator to be detected based on the resource-based indicators.

[0131] In an exemplary embodiment, the third determining module is further configured to perform feature extraction on the at least one database indicator to determine the indicator fingerprint corresponding to the at least one database indicator; cluster each indicator fingerprint to obtain multiple cluster sets; determine the number of active sessions of each of the multiple cluster sets within the abnormal interval, and determine the activity status of the at least one database indicator within the abnormal interval based on the number of active sessions.

[0132] In an exemplary embodiment, the analysis module 36 is further configured to: determine the correlation coefficient between the target indicator and any candidate root cause event among the plurality of candidate root cause events based on the first time-series data and the second time-series data; determine the target lag step number among the target indicator and any candidate root cause event among the plurality of candidate root cause events based on the first time-series data and the second time-series data; determine the stage trend value of the target indicator and any candidate root cause event among the plurality of candidate root cause events based on the first time-series data and the second time-series data; and weight the correlation coefficient, the target lag step number, and the stage trend value of any candidate root cause event to obtain the analysis result of any candidate root cause event.

[0133] In an exemplary embodiment, the analysis module 36 is further configured to obtain a time-lag search interval; the time-lag search interval includes: multiple time-lag search steps; traversing the multiple time-lag search steps, and when the traversed time-lag search step is different from the target threshold, shifting the first time-series data and the second time-series data based on the traversed time-lag search step to obtain shifted first time-series data and second time-series data; calculating the shifted correlation value of the shifted first time-series data and second time-series data; and determining the target lag step for any candidate root cause event based on the shifted correlation value.

[0134] In an exemplary embodiment, the second determining module 38 is further configured to calculate the pre-shift correlation value based on the first time series data and the second time series data when the number of time delay search steps traversed is the same as the target threshold; compare the post-shift correlation value and the pre-shift correlation value; and determine the target lag step number of any candidate root cause event from the post-shift correlation value and the pre-shift correlation value according to the comparison result.

[0135] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0136] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when run.

[0137] Optionally, in this embodiment, the storage medium may be configured to store program code for performing the following steps:

[0138] S1, perform anomaly detection on the indicator to be detected, determine the abnormal range of the indicator to be detected, and the first time series data of the indicator to be detected within the abnormal range;

[0139] S2, determine the second time-series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval;

[0140] S3, based on the first time series data and the second time series data, analyze the multiple candidate root cause events from multiple root cause analysis dimensions respectively, and determine the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions respectively;

[0141] S4. Based on the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions, determine the target root cause event from the multiple candidate root cause events.

[0142] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0143] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0144] In one exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0145] Optionally, in this embodiment, the processor may be configured to perform the following steps according to a computer program:

[0146] S1, perform anomaly detection on the indicator to be detected, determine the abnormal range of the indicator to be detected, and the first time series data of the indicator to be detected within the abnormal range;

[0147] S2, determine the second time-series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval;

[0148] S3, based on the first time series data and the second time series data, analyze the multiple candidate root cause events from multiple root cause analysis dimensions respectively, and determine the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions respectively;

[0149] S4. Based on the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions, determine the target root cause event from the multiple candidate root cause events.

[0150] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0151] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0152] Embodiments of this application also provide a computer program that includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in any of the above method embodiments.

[0153] Optionally, in this embodiment, the processor may be configured to perform the following steps according to a computer program:

[0154] S1, perform anomaly detection on the indicator to be detected, determine the abnormal range of the indicator to be detected, and the first time series data of the indicator to be detected within the abnormal range;

[0155] S2, determine the second time-series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval;

[0156] S3, based on the first time series data and the second time series data, analyze the multiple candidate root cause events from multiple root cause analysis dimensions respectively, and determine the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions respectively;

[0157] S4. Based on the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions, determine the target root cause event from the multiple candidate root cause events.

[0158] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0159] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0160] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for determining a target event, characterized in that, include: Anomaly detection is performed on the indicator to be detected, the abnormal range of the indicator to be detected is determined, and the first time series data of the indicator to be detected within the abnormal range is determined. Second time-series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval; Based on the first time series data and the second time series data, the multiple candidate root cause events are analyzed from multiple root cause analysis dimensions to determine the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions respectively. Based on the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions, the target root cause event is determined from the multiple candidate root cause events.

2. The method according to claim 1, characterized in that, Anomaly detection is performed on the indicator to be detected, determining the abnormal range of the indicator to be detected, and the first time-series data of the indicator to be detected within the abnormal range, including: Obtain the time series data of the indicator to be detected, and determine the abnormal interval of the time series data to be detected; Based on the abnormal interval, the first time series data of the indicator to be detected within the abnormal interval is extracted from the time series data to be detected.

3. The method according to claim 2, characterized in that, Determining the abnormal intervals of the time series data to be detected includes: The process involves traversing multiple data points included in the time series data to be detected. If a data point reached during the traversal meets a preset abnormal starting point condition, the data point reached during the traversal is determined as an abnormal data starting point. The data points that meet the preset abnormal endpoint conditions after the abnormal data starting point are determined as the abnormal data endpoints. The abnormal interval is determined based on the abnormal data start point and the abnormal data end point.

4. The method according to claim 1, characterized in that, Before determining multiple candidate root cause events of the indicator to be detected within the second time-series data in the abnormal interval, the method further includes: Identify multiple root cause indicators of the indicator to be detected; Determine the activity status of at least one database indicator included in the plurality of root cause indicators within the abnormal interval, and filter the target database indicator from the at least one database indicator based on the activity status; Candidate root cause events are determined based on the target database metrics.

5. The method according to claim 4, characterized in that, Determining the activity status of at least one database indicator, including the plurality of root cause indicators, within the abnormal interval includes: Feature extraction is performed on the at least one database indicator to determine the indicator fingerprint corresponding to the at least one database indicator; Clustering is performed on the fingerprints of each indicator to obtain multiple cluster sets; The number of active sessions for each of the multiple cluster sets within the abnormal interval is determined, and the activity status of the at least one database metric within the abnormal interval is determined based on the number of active sessions.

6. The method according to claim 1, characterized in that, Based on the first time-series data and the second time-series data, the multiple candidate root cause events are analyzed from multiple root cause analysis dimensions to determine the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions, including: Based on the first time series data and the second time series data, determine the correlation coefficient between the indicator to be detected and any candidate root cause event among the plurality of candidate root cause events; and based on the first time series data and the second time series data, determine the target lag step number between the indicator to be detected and any candidate root cause event among the plurality of candidate root cause events; and based on the first time series data and the second time series data, determine the stage trend value between the indicator to be detected and any candidate root cause event among the plurality of candidate root cause events. The correlation coefficient, the target lag step, and the stage trend value of any candidate root cause event are weighted to obtain the analysis result of any candidate root cause event.

7. The method according to claim 6, characterized in that, Determining the target lag step number for the target indicator and any candidate root cause event among the plurality of candidate root cause events based on the first time series data and the second time series data includes: Obtain the time-delay search interval; the time-delay search interval includes: multiple time-delay search steps; The multiple time-delay search steps are traversed. If the time-delay search step reached is different from the target threshold, the first time-series data and the second time-series data are shifted based on the time-delay search step reached to obtain the shifted first time-series data and the second time-series data. Calculate the shifted correlation values ​​of the first time-series data and the second time-series data after the shift processing; The target lag step number for any candidate root cause event is determined based on the shifted correlation value.

8. The method according to claim 7, characterized in that, The method further includes: If the number of time-delay search steps reached is the same as the target threshold, calculate the pre-shift correlation value based on the first time-series data and the second time-series data; The post-shift correlation value is compared with the pre-shift correlation value, and the target lag step for any candidate root cause event is determined from the post-shift correlation value and the pre-shift correlation value based on the comparison result.

9. The method according to claim 6, characterized in that, Determining the stage trend value of the indicator to be detected and any candidate root cause event among the plurality of candidate root cause events based on the first time series data and the second time series data includes: The first time series data is divided into multiple first time series sub-data, and the local trend data of the multiple first time series sub-data are determined. Correlation analysis is performed on the second time series data of any candidate root cause event and the local trend data of the plurality of first time series sub-data, and the stage trend value of any candidate root cause event is determined based on the correlation analysis results.

10. A device for determining a target event, characterized in that, include: The detection module is used to perform anomaly detection on the indicator to be detected, determine the abnormal range of the indicator to be detected, and the first time series data of the indicator to be detected within the abnormal range. The first determining module is used to determine the second time-series data of multiple candidate root cause events of the indicator to be detected within the abnormal interval; The analysis module is used to analyze the multiple candidate root cause events from multiple root cause analysis dimensions based on the first time series data and the second time series data, and to determine the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions respectively. The second determining module is used to determine the target root cause event from the multiple candidate root cause events based on the analysis results of the multiple candidate root cause events in the multiple root cause analysis dimensions.

Images