Fault prediction method, fault prediction model training method, computing device, storage medium, and computer program product

Abstract

The present disclosure provides a fault prediction method, a fault prediction model training method, a computing device, a storage medium, and a computer program product. The fault prediction method is applied to a cloud computing system, and the cloud computing system comprises a service processing unit. The method comprises: acquiring abnormal log data of a service processing unit, and determining an abnormal event sequence on the basis of the abnormal log data; on the basis of the abnormal event sequence, using a fault prediction model to determine a fault prediction result of the service processing unit, wherein the fault prediction model is obtained by training a positive sample, a sample label corresponding to the positive sample, a negative sample and a sample label corresponding to the negative sample, and the positive sample comprises an initial positive sample abnormal event sequence; and performing data enhancement on the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence, the negative sample comprising a negative sample abnormal event sequence. The method improves the accuracy of using a fault prediction model to perform fault prediction.

Description

[0001] Fault Prediction Method, Fault Prediction Model Training Method, Computing Device, Storage Medium, Computer Program Product TECHNICAL FIELD The present disclosure relates to the field of computer technology, and in particular to a fault prediction method. One or more embodiments of this specification also relate to a fault prediction model training method, a computing device, a computer-readable storage medium, and a computer program product. BACKGROUND To ensure the stability of cloud computing platforms, cloud computing systems typically predict server failures (downtime) in advance and implement timely maintenance. Some technical solutions use exception logs recorded by cloud systems to predict failures (downtime). However, due to the extreme imbalance between downtime data and non-downtime data, the accuracy of predicting downtime using exception logs is low in actual development. Therefore, a technical solution is urgently needed to address the above technical issues. SUMMARY OF THE INVENTION In view of this, the present disclosure provides a fault prediction method. One or more embodiments of this specification also relate to a fault prediction model training method, a fault prediction device, a fault prediction model training device, a computing device, a computer-readable storage medium, and a computer program product to address the technical deficiencies existing in the prior art. According to a first aspect of the present disclosure, a fault prediction method is provided, applied to a cloud computing system, the cloud computing system including a service processing unit. The method includes: obtaining abnormal log data of the service processing unit and determining an abnormal event sequence based on the abnormal log data; and determining a fault prediction result for the service processing unit based on the abnormal event sequence using a fault prediction model, wherein the fault prediction model is obtained by training with positive samples, sample labels corresponding to the positive samples, negative samples, and sample labels corresponding to the negative samples; the positive samples include an initial positive sample abnormal event sequence and an enhanced positive sample abnormal event sequence obtained by performing data enhancement on the initial positive sample abnormal event sequence; and the negative samples include a negative sample abnormal event sequence.According to a second aspect of the present disclosure, a fault prediction model training method is provided, which is applied to a cloud computing system, the cloud computing system including a service processing unit. The method includes: obtaining sample abnormality log data of the service processing unit; determining a sample abnormality event sequence based on the sample abnormality log data; determining an initial positive sample abnormality event sequence and a negative sample abnormality event sequence based on the sample abnormality event sequence, and performing data enhancement on the initial positive sample abnormality event sequence to obtain an enhanced positive sample abnormality event sequence; using the initial positive sample abnormality event sequence and the enhanced positive sample abnormality event sequence as positive samples, using the negative sample abnormality event sequence as negative samples, and training a fault prediction model based on the positive samples, sample labels corresponding to the positive samples, the negative samples, and sample labels corresponding to the negative samples. According to a third aspect of the present disclosure, a fault prediction apparatus is provided, applied to a cloud computing system, the cloud computing system including a service processing unit, the apparatus comprising: a sequence determination module configured to obtain abnormality log data of the service processing unit and determine an abnormal event sequence based on the abnormality log data; and a fault prediction module configured to determine a fault prediction result for the service processing unit based on the abnormal event sequence using a fault prediction model, wherein the fault prediction model is obtained by training with positive samples, sample labels corresponding to the positive samples, and negative samples, and sample labels corresponding to the negative samples; the positive samples include an initial positive sample abnormal event sequence and an enhanced positive sample abnormal event sequence obtained by performing data enhancement on the initial positive sample abnormal event sequence; and the negative samples include a negative sample abnormal event sequence. According to a fourth aspect of the present disclosure, a fault prediction model training device is provided, which is applied to a cloud computing system, the cloud computing system including a service processing unit, and the device including: a sample acquisition module, configured to acquire sample abnormality log data of the service processing unit; a sample sequence determination module, configured to determine a sample abnormality event sequence based on the sample abnormality log data; an enhanced sequence acquisition module, configured to determine an initial positive sample abnormality event sequence and a negative sample abnormality event sequence based on the sample abnormality event sequence, and perform data enhancement on the initial positive sample abnormality event sequence to obtain an enhanced positive sample abnormality event sequence; and a model training module, configured to use the initial positive sample abnormality event sequence and the enhanced positive sample abnormality event sequence as positive samples, use the negative sample abnormality event sequence as negative samples, and train a fault prediction model based on the positive samples, sample labels corresponding to the positive samples, the negative samples, and sample labels corresponding to the negative samples.According to a fifth aspect of the present disclosure, a computing device is provided, comprising: a memory and a processor; the memory is configured to store a computer program / instructions, and the processor is configured to execute the computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. According to a sixth aspect of the present disclosure, a computer-readable storage medium is provided, storing a computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. According to a seventh aspect of the present disclosure, a computer program product is provided, comprising a computer program / instructions. When executed by the processor, the computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. One embodiment of the present specification provides a fault prediction method, applied to a cloud computing system, the cloud computing system including a service processing unit. The method includes: obtaining abnormal log data of the service processing unit and determining an abnormal event sequence based on the abnormal log data; and determining a fault prediction result for the service processing unit based on the abnormal event sequence using a fault prediction model, wherein the fault prediction model is obtained by training positive samples, sample labels corresponding to the positive samples, negative samples, and sample labels corresponding to the negative samples. The positive samples include an initial positive sample abnormal event sequence and an enhanced positive sample abnormal event sequence obtained by performing data enhancement on the initial positive sample abnormal event sequence. The negative samples include a negative sample abnormal event sequence. Specifically, this method performs data augmentation on the initial positive sample abnormal event sequence during model training to obtain an enhanced positive sample abnormal event sequence, thereby amplifying the positive samples for model training and achieving a better balance between positive and negative samples. This improves the fault prediction capability of the trained fault prediction model, thereby increasing the accuracy of fault prediction using the fault prediction model. Furthermore, based on this fault prediction method, the cloud computing system can predict the occurrence of faults in the cloud computing system faster, more frequently, and more accurately, enabling timely operation and maintenance, thereby improving the stability and reliability of the cloud computing system.BRIEF DESCRIPTION OF THE DRAWINGS Figure 1 is a schematic diagram of an application scenario of a fault prediction method provided according to an embodiment of this specification; Figure 2 is a flow chart of a fault prediction method provided according to an embodiment of this specification; Figure 3 is a flow chart of a fault prediction model training method provided according to an embodiment of this specification; Figure 4 is a schematic diagram of the processing process of a fault prediction model training method provided according to an embodiment of this specification; Figure 5 is a schematic diagram of the structure of a fault prediction device provided according to an embodiment of this specification; Figure 6 is a schematic diagram of the structure of a fault prediction model training device provided according to an embodiment of this specification; and Figure 7 is a block diagram of the structure of a computing device provided according to an embodiment of this specification. DETAILED DESCRIPTION The following description sets forth numerous specific details to facilitate a thorough understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art may make similar generalizations without departing from the scope of this specification. Therefore, this specification is not limited to the specific implementations disclosed below. The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. As used in one or more embodiments of this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and encompasses any and all possible combinations of one or more associated listed items. It should be understood that while terms such as "first," "second," and so on may be used in one or more embodiments of this specification to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, "first" could also be referred to as "second," and similarly, "second" could also be referred to as "first," without departing from the scope of one or more embodiments of this specification. Depending on the context, the term "if" as used herein could be interpreted as "at the time of," "when," or "in response to a determination." Furthermore, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data, etc.) referred to in one or more embodiments of this specification are all authorized by the user or fully authorized by all parties. The collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding entry points are provided for the user to choose to authorize or deny. First, the terminology used in one or more embodiments of this specification is explained.

[0002] Attention: The attention mechanism can mine the correlation information between elements in the sequence.

[0003] Transformer: An attention-based machine learning model commonly used in natural language processing and image processing tasks.

[0004] BERT: Bidirectional Encoder Representations from Transformers, bidirectional encoding Transformer M-type, commonly used in natural language processing and image processing tasks.

[0005] TF-IDF: The product of term frequency and inverse document frequency, used to measure the importance of a word relative to the corpus.

[0006] TAAT: Time-aware Attention based Transformer, Transformer algorithm with time-aware attention mechanism.

[0007] NC: Node Controller, a single unit in a cloud computing system that counts failures and downtime. In cloud computing environments, centralized server management and utilization is a key strategy for improving resource utilization. However, the failure of a single NC can severely impact the stability and availability of the entire system, negatively impacting customer project continuity and user experience. To prevent such sudden downtime events, analyzing system logs and identifying different types of abnormal patterns to predict them and take proactive operational measures is a key practice. However, building and training predictive models in practice presents a significant problem: because normal operation data far outweighs abnormal downtime data, there is an extreme imbalance between positive and negative samples. This can cause the model to overly favor common data features that are not representative of downtime during training, thus affecting its ability to accurately predict downtime. To overcome this problem, this disclosure utilizes text analysis techniques from natural language processing, such as N-grams and TF-IDF. N-grams are used to capture the relationships and contextual information between consecutive event sequences in system logs, while TF-IDF helps measure the importance of abnormal events in different log entries. Five data augmentation operators are designed for abnormal log sequences. These operators generate new, meaningful abnormal examples based on the abnormal context and importance, thereby expanding the originally limited set of positive samples (downtime anomaly data). Furthermore, by integrating different data augmentation operators to generate more positive samples, the class imbalance problem can be further alleviated, allowing the model to better encounter a variety of abnormal scenarios during training, thereby improving its generalization ability and enabling it to make more accurate predictions even for unseen or rare downtime anomalies, ultimately reducing downtime risk and improving operation and maintenance efficiency. Based on this, this specification provides a fault prediction method. One or more embodiments of this specification relate to a fault prediction model training method, a fault prediction apparatus, a fault prediction model training device, a computing device, a computer-readable storage medium, and a computer program product, each of which is described in detail in the following embodiments. Referring to Figure 1 , FIG1 illustrates a schematic diagram of an application scenario of a fault prediction method provided according to one embodiment of this specification. The fault prediction method can be applied in a cloud computing system, involving a cloud computing platform 102 and a cloud computing server cluster 104. The cloud computing platform 102 can be understood as a service based on hardware and software resources, providing computing, network, and storage capabilities. In this disclosure, it is used to provide a fault prediction service, which obtains server abnormality log data to predict whether the server will experience a downtime.The servers in the cloud computing server cluster 104 can be understood as servers that provide various services, including physical servers and cloud servers. For example, servers that provide communication services to multiple clients, servers that support backend training for models used by clients, and servers that process data sent by clients. The cloud computing server cluster 104 may include one server or multiple servers, and this disclosure is not limited to this. In specific implementations, the cloud computing platform 102 may obtain abnormality log data from each server in the cloud computing server cluster 104, determine abnormality event sequences based on the abnormality log data, and use a fault prediction model based on the abnormality event sequences to obtain fault prediction results for each server, so that the cloud computing system can subsequently perform operations and maintenance based on these fault prediction results. The fault prediction model is trained using positive samples, sample labels corresponding to the positive samples, and negative samples, sample labels corresponding to the negative samples. The positive samples include an initial positive abnormality event sequence and an enhanced positive abnormality event sequence obtained by data augmentation of the initial positive abnormality event sequence. The negative samples include a negative abnormality event sequence. The fault prediction method provided herein performs data augmentation on initial positive abnormal event sequences during model training to obtain enhanced positive abnormal event sequences. This augments the positive samples used in model training, achieving a better balance between positive and negative samples, improving the fault prediction capability of the trained fault prediction model, and thereby increasing the accuracy of fault prediction using the fault prediction model. Furthermore, based on this fault prediction method, a cloud computing system can more quickly, more frequently, and more accurately predict faults in the cloud computing system, enabling timely operation and maintenance, thereby improving the stability and reliability of the cloud computing system. Referring to Figure 2, a flowchart of a fault prediction method provided according to one embodiment of this specification is shown. The method is applied to a cloud computing system, including a service processing unit, and specifically includes the following steps: Step 202: Acquire abnormality log data from the service processing unit and determine an abnormal event sequence based on the abnormality log data.The service processing unit can be understood as an NC, which refers to a server in the cloud computing server cluster 104 in the aforementioned embodiments. Exception log data includes, but is not limited to, exception information and the time of the exception corresponding to the exception information. Exception information can be understood as raw, unprocessed, formatted, or compressed recorded information within the service processing unit. This exception information typically contains detailed errors, warnings, and debugging information, comprehensively recording all activity details during the operation of the service processing unit. The time of the exception corresponding to the exception information can be understood as the timestamp of the exception information, recording the time of occurrence of each exception information. The exception event sequence can be understood as a sequence containing semantic information of the exception log data. Furthermore, a detector can be used to continuously monitor the operation of the service processing unit and, when an exception or error occurs in the service processing unit, record and capture relevant exception log data. In practical applications, once initial exception logs are obtained, the initial log data can be sorted according to the time of the exception corresponding to the initial exception information, thereby obtaining exception log data arranged in order according to the time of the exception corresponding to the initial exception information. The specific implementation is as follows: Obtaining the exception log data of the service processing unit includes: obtaining initial exception log data of the service processing unit, wherein the initial exception log data includes initial exception information and the exception occurrence time corresponding to the initial exception information; sorting the initial exception log data according to the exception occurrence time corresponding to the initial exception information using a preset sorting rule to obtain sorted initial exception log data; and sampling the sorted initial exception log data according to a sampling time interval and a sampling time length to obtain the exception log data. The initial exception log data can be understood as out-of-order exception situations obtained from the service processing unit; the preset sorting rule can be understood as a pre-set rule for sorting according to the exception occurrence time corresponding to the initial exception information, which can be sorting from earliest to latest according to the exception occurrence time corresponding to the initial exception information, or from latest to earliest according to the exception occurrence time corresponding to the initial exception information.Specifically, initial exception log data from the service processing unit is obtained and parsed to extract the initial exception information and the corresponding exception occurrence time. The initial exception log data is then sorted according to a preset sorting rule (e.g., sorting the exception occurrence time corresponding to the initial exception information from latest to earliest). This ensures that the initial exception log data is arranged in an orderly manner according to the chronological order of the exception occurrence time. Once the sorting is complete, the resulting ordered initial exception log data is the exception log data, which chronologically displays the exceptions encountered by the service processing unit and their specific occurrence times. The fault prediction method provided herein sorts the initial exception log data according to the exception occurrence time corresponding to the initial exception information to obtain time-ordered exception log data, thereby more quickly obtaining an abnormal event sequence from the time-ordered exception log data. Furthermore, the abnormal log data in the service processing unit can be analyzed and processed to obtain an abnormal event sequence. Thus, when the abnormal event sequence is input into a fault prediction model, semantic information and time information contained in the abnormal log data can be extracted. In practical applications, processing abnormal information to obtain an abnormal event sequence and inputting this abnormal event sequence into a fault prediction model can avoid the fault prediction model's encoding of text information. A specific implementation is as follows: Determining the abnormal event sequence based on the abnormal log data includes: processing the abnormal information in the abnormal log data to determine the abnormal event corresponding to the abnormal information; determining the event identifier corresponding to the abnormal event based on a matching relationship between reference abnormal events and reference event identifiers in an abnormal event library; and sorting the event identifiers corresponding to the abnormal events based on the abnormal occurrence time of the abnormal information to generate the abnormal event sequence. The event identifier can be understood as the event identifier corresponding to the abnormal event determined based on a matching relationship between the reference abnormal event and the reference event identifier. It can be represented by a numerical value, a symbol, or other means, and is not limited here. The abnormal event library contains references to multiple abnormal event types. Each reference abnormal event corresponds to a reference event identifier, thereby establishing a matching relationship between the reference abnormal event and the reference event identifier. Specifically, the matching relationship between the reference abnormal event and the reference event identifier can be obtained through historical abnormal log data. Based on abstract processing of the historical abnormal log data, the corresponding reference abnormal event is constructed. The constructed reference abnormal event is subjected to corresponding identification encoding operations to obtain the reference event identifier corresponding to the reference abnormal event, thereby pre-establishing the matching relationship between each reference abnormal event and the reference event identifier.Specifically, exception information can be abstracted to determine the exception event corresponding to the exception information. For example, using regular expressions, the exception information "mce: [Hardware Error]: Machine check events logged" can be abstracted into the exception event "dmesg_unrecover_mce". In the exception event library, the event identifier corresponding to the exception event is determined based on the matching relationship between the reference exception events and the reference event identifiers in the exception event library. For example, the event identifier corresponding to the exception event "dmesg_unrecover_mce" is 32. Based on the event identifier, the event identifiers need to be sorted according to the corresponding exception occurrence time to generate an exception event sequence. In practical applications, the reported exception information can be mapped to the exception event using regular expressions. Specifically, for each exception information, keywords shared by this exception information and other exception information can be determined, such as "Error" and "hardware". Then, different exception names can be classified based on the type of keywords, resulting in phrases used to name the exception event. For example, the exception information "mce: [Hardware Error]: Machine check events logged" can be mapped to the exception event sequence. :Machinecheckevents logged" is abstracted as the exception event "dmesg_unrecover_mce"; Because exception information is a statement describing the computer status and contains a lot of redundant information, abstracting the exception information text can extract key information and selectively filter the reported exception information, such as parsing exception information with the Error field. It should be noted that the abstracted exception event is often a unified description of a category of exception information. The fault prediction method provided by this disclosure, by encoding and identifying exception events, eliminates the need for encoding using a model, improves the execution speed of fault prediction, and thereby improves the efficiency of fault prediction in cloud computing systems. In actual applications, event identifiers are sorted according to preset sorting rules, and an exception event sequence is generated based on the sorted event identifiers. The specific implementation method is as follows: Sorting the event identifiers corresponding to the exception events according to the exception occurrence time of the exception information to generate the exception event sequence includes: sorting the event identifiers corresponding to the exception events according to the exception occurrence time according to preset sorting rules, and based on the sorted event identifiers, Generate an abnormal event sequence. The preset sorting rule can be understood as a rule for sorting event identifiers according to the time when the abnormality occurred.Specifically, the event identifiers can be sorted in reverse order based on the abnormal occurrence time corresponding to the abnormal events. When predicting faults, abnormal events corresponding to abnormal occurrence times closer to the current moment are generally more useful. Therefore, the event identifiers corresponding to the abnormal events are sorted in reverse order based on the abnormal occurrence time, thereby generating an abnormal event sequence based on the reverse order of the abnormal occurrence time. Furthermore, abnormal information often has a correlation, meaning that abnormal information at a previous moment can cause another abnormal information at a later moment. By sorting the event identifiers (which can actually also be understood as abnormal information) based on the abnormal occurrence time, the fault prediction model can be used to better utilize the contextual semantic information of the abnormal information to predict faults for the service processing unit. The fault prediction method provided in this disclosure, by sorting abnormal events, standardizes the processing targets for subsequent fault prediction, thereby improving the execution speed of subsequent fault prediction and, in turn, enhancing the efficiency of fault prediction in the cloud computing system. Step 204: Determine the fault prediction result for the service processing unit using the fault prediction model based on the abnormal event sequence. The fault prediction model is obtained by training with positive samples, sample labels corresponding to the positive samples, and negative samples, and sample labels corresponding to the negative samples. The positive samples include an initial positive sample abnormal event sequence and an enhanced positive sample abnormal event sequence obtained by data augmentation of the initial positive sample abnormal event sequence. The negative samples include a negative sample abnormal event sequence. The fault prediction model can be understood as a model for predicting whether a service processing unit will experience a downtime. It has a Transform structure, such as a TAAT model or a BERT model. The fault prediction results include a downtime prediction result and a no-downtime prediction result. Positive samples include but are not limited to initial positive sample abnormal event sequences and enhanced positive sample abnormal event sequences; the initial positive sample abnormal event sequence can be understood as a downtime sample, that is, when a service processing unit crashes, the sample abnormality log data of the service processing unit is obtained, and the sample log acquisition time of the abnormal log data sample is used to determine the sample abnormality event sequence, the sample abnormality timestamp sequence, and the sample abnormality grouping sequence; the enhanced positive sample abnormal event sequence can be understood as the amplified positive sample obtained by performing data enhancement based on the initial positive sample abnormal event sequence; the sample label corresponding to the positive sample can be understood as the result label of the downtime of the service processing unit.Negative samples can be understood as normal samples. That is, when the service processing unit does not crash, the sample abnormality log data of the service processing unit is obtained, and the sample log acquisition time of the abnormal log data sample is used to determine the sample abnormality event sequence, sample abnormality timestamp sequence, and sample abnormality grouping sequence. The sample label corresponding to the negative sample is the result label of the server not crashing. In practical applications, a fault prediction model can be pre-trained to improve its accuracy. The specific implementation is as follows: The fault prediction model is trained through the following steps: obtaining sample abnormality log data from the service processing unit; determining a sample abnormality event sequence based on the sample abnormality log data; determining an initial positive abnormality event sequence and a negative abnormality event sequence based on the sample abnormality event sequence, and performing data enhancement on the initial positive abnormality event sequence to obtain an enhanced positive abnormality event sequence; using the initial positive abnormality event sequence and the enhanced positive abnormality event sequence as positive samples, and the negative abnormality event sequence as negative samples, and training a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples. Specifically, this disclosure and the following embodiments of the specification belong to the same general inventive concept. Any details not described in detail in the specific implementation of fault prediction model training in this disclosure can be found in the following embodiments of the specification. The fault prediction model training method provided herein performs data augmentation on an initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence, thereby amplifying the positive samples used in model training and achieving a good balance between positive and negative samples. This improves the fault prediction capability of the trained fault prediction model, resulting in more accurate fault predictions when the model is subsequently applied. In practical applications, the fault prediction model can be designed to directly output a result indicating a downtime or no downtime, as described above. Alternatively, the fault prediction model can be designed to output a confidence level indicating a service processing unit downtime, with a preset confidence threshold set based on actual conditions. The fault prediction result indicating whether a service processing unit downtime has occurred is determined based on the relationship between the confidence level output by the fault prediction model and the preset confidence threshold. The specific implementation method is as follows: Determining the fault prediction result of the service processing unit based on the abnormal event sequence using a fault prediction model includes: inputting the abnormal event sequence into the fault prediction model, obtaining the confidence level of the fault prediction model output, and determining the fault prediction result of whether the service processing unit has experienced a downtime based on the confidence level and a preset confidence threshold.The confidence level can be understood as the probability of a service processing unit downtime, as output by the fault prediction model. For example, the confidence level can be 70%. The preset confidence threshold can be set according to actual needs, including but not limited to determination based on historical data, expert knowledge, simulation, etc., and this specification does not limit this. The fault prediction model training method provided in this disclosure sets a preset confidence threshold to determine the fault prediction result, making the fault prediction more consistent with actual conditions and improving the accuracy of fault prediction. The fault prediction method provided in this disclosure performs data augmentation on the initial positive sample abnormal event sequence during model training to obtain an enhanced positive sample abnormal event sequence, thereby amplifying the positive samples for model training and achieving a good balance between positive and negative samples, improving the fault prediction capability of the trained fault prediction model, and thus improving the accuracy of fault prediction using the fault prediction model. The following further describes a fault prediction model training method provided in this disclosure with reference to FIG3 . FIG3 shows a flowchart of a fault prediction model training method provided in accordance with one embodiment of this specification, applied to a cloud computing system including a service processing unit, and specifically comprising the following steps. Step 302: Obtain sample exception log data from the service processing unit. The service processing unit can be understood as an NC, which is a server in the cloud computing server cluster 104 in the aforementioned embodiment. Sample exception log data includes, but is not limited to, sample exception information and the time at which the sample exception information corresponds to the sample exception information. Sample exception information can be understood as raw, unprocessed, formatted, or compressed sample record information within the service processing unit. This sample exception information typically contains detailed errors, warnings, and debugging information, thoroughly recording all activity details during the operation of the service processing unit. The sample exception time corresponding to the sample exception information can be understood as the timestamp of the sample exception information, recording the time at which each piece of sample exception information occurs. Optionally, obtaining the sample exception log data of the service processing unit includes: obtaining initial sample exception log data of the service processing unit, wherein the initial sample exception log data includes initial sample exception information and the sample exception occurrence time corresponding to the initial sample exception information; sorting the initial sample exception log data using the preset sorting rule according to the sample exception occurrence time corresponding to the initial sample exception information to obtain the sorted initial sample exception log data; sampling the sorted initial sample exception log data according to the sampling time interval and the sampling time length to obtain the sample exception log data.Specifically, for details not fully described in the above-mentioned implementation of obtaining the sample abnormality log data of the service processing unit, please refer to the specific implementation of obtaining the abnormality log data of the service processing unit in the above-mentioned embodiments, and this specification does not elaborate on them. Step 304: Determine a sample abnormality event sequence based on the sample abnormality log data. Specifically, after determining the sample abnormality log data, the sample abnormality log data can be analyzed and processed to obtain a sample abnormality event sequence. Optionally, determining the sample abnormality event sequence based on the sample abnormality log data includes: determining, based on the sample abnormality information in the sample abnormality log data, the sample abnormality events corresponding to the sample abnormality information; determining, based on the matching relationship between events and codes in the abnormal event library, the sample event codes corresponding to the sample abnormality events; and sorting the sample event codes corresponding to the sample abnormality events based on the sample abnormality occurrence time of the sample abnormality information to generate the sample abnormality event sequence. Optionally, sorting the sample event codes corresponding to the sample abnormal events according to the sample abnormality occurrence time of the sample abnormality information to generate the sample abnormality event sequence includes: sorting the sample event codes corresponding to the sample abnormal events according to the sample abnormality occurrence time corresponding to the sample abnormality events using a preset sorting rule to obtain sample event codes corresponding to the sorted sample abnormal events; and sampling the sample event codes corresponding to the sorted sample abnormal events according to a sampling time interval and a sampling time length to generate the sample abnormality event sequence. Specifically, the specific implementation of determining the sample abnormality event sequence based on sample abnormality log data in the present disclosure can be found in the specific implementation of determining the abnormality event sequence based on abnormality log data in the above embodiments. Step 306: Determine an initial positive sample abnormality event sequence and a negative sample abnormality event sequence based on the sample abnormality event sequence, and perform data enhancement on the initial positive sample abnormality event sequence to obtain an enhanced positive sample abnormality event sequence. In practical applications, samples can be obtained through sampling. Due to the significant disparity in the number of positive and negative samples, different sampling methods can be used for positive and negative samples to minimize the imbalance between positive and negative samples. The specific implementation method is as follows: Determining the initial positive sample abnormal event sequence and the negative sample abnormal event sequence based on the sample abnormal event sequence includes: determining the initial positive sample abnormal event sequence from the sample abnormal event sequence according to a preset sampling time and a preset sampling length; and determining the negative sample abnormal event sequence from the sample abnormal event sequence according to a preset negative sample sampling rule.The preset sampling time can be understood as a preset sampling interval; the preset sampling length can be understood as a preset sampling window length; and the preset negative sample sampling rule can be understood as a rule for randomly sampling in a proportional manner from the sample abnormal event sequence. Specifically, when acquiring positive samples, overlapping sampling can be performed within the sample abnormal event sequence at 5-minute intervals and a 3-day sampling window length, thereby obtaining an initial positive sample abnormal event sequence. When acquiring negative samples, abnormal events can be randomly sampled in a proportional manner from the sample abnormal event sequence to determine the negative sample abnormal event sequence. In practical applications, a sliding window approach is used, where a subsequence of all abnormal events within the previous 72 hours (i.e., 3 days) is calculated at each 5-minute time point. For example, the first sampling window starts at time A and ends at time B (72 hours before time A). The window then moves forward 5 minutes, and the second sampling window begins at time C (5 minutes before time A), also covering the previous 72 hours, and so on. The fault prediction method provided herein reduces the amount of sample data while ensuring accurate model training by sampling positive and negative abnormal event sequences, thereby reducing the load on the cloud computing system. In practical applications, data enhancement can be performed on the initial positive abnormal event sequence using a first data enhancement operator based on context and / or a second data enhancement operator based on word importance. The specific implementation is as follows: Data enhancement of the initial positive abnormal event sequence to obtain an enhanced positive abnormal event sequence includes: determining a data enhancement operator, and performing data enhancement on the initial positive abnormal event sequence based on the data enhancement operator to obtain an enhanced positive abnormal event sequence. The initial positive abnormal event sequence includes multiple initial positive abnormal events, and the data enhancement operators include a first data enhancement operator based on context and / or a second data enhancement operator based on word importance. The initial positive abnormal events can be understood as abnormal events contained in the initial positive abnormal event sequence. The data enhancement operator can be understood as an operator used to expand the diversity of the training dataset. The data enhancement operator creates new samples based on the original initial positive sample abnormal event sequence, but retains the core features of the initial positive sample abnormal event sequence, that is, enhances the positive sample abnormal event sequence.The first data augmentation operator based on contextual relationships can be understood as a data augmentation operator that performs data augmentation on the initial positive abnormal event sequence based on the contextual relationships between the initial positive abnormal events and the initial positive abnormal events in the initial positive abnormal event sequence. The first data augmentation operator based on word importance can be understood as a data augmentation operator that performs data augmentation on the initial positive abnormal event sequence based on the word importance of each initial positive abnormal event in the initial positive abnormal event sequence. Specifically, after the initial positive abnormal event sequence is determined as described above, the initial positive abnormal event sequence can be data augmented using the first data augmentation operator based on contextual relationships and / or the second data augmentation operator based on word importance to obtain an enhanced positive abnormal event sequence. The fault prediction method provided in this disclosure improves the availability of sample data and increases the number of positive samples by performing data augmentation on the initial positive abnormal event sequence based on contextual relationships and word importance, thereby increasing the accuracy of the subsequently trained model. In practical applications, the data enhancement operator may include a first data enhancement operator. In this case, the specific implementation of the above-mentioned data enhancement is as follows: When the data enhancement operator includes the first data enhancement operator, performing data enhancement on the initial positive sample abnormal event sequence according to the data enhancement operator to obtain an enhanced positive sample abnormal event sequence includes: determining a preset combination length, combining the multiple initial positive sample abnormal events according to the preset combination length to determine multiple sample abnormal event combinations, wherein the number of initial positive sample abnormal events included in each sample abnormal event combination is consistent with the preset combination length; counting the occurrence frequency of each sample abnormal event combination, and determining a frequency relationship matrix of the multiple sample abnormal event combinations based on the occurrence frequency; determining a target sample abnormal event from the multiple initial positive sample abnormal events whose occurrence frequency is greater than a preset number threshold; and performing first data enhancement on the initial positive sample abnormal event sequence according to the first data enhancement operator, the frequency relationship matrix, and the target sample abnormal event to obtain an enhanced positive sample abnormal event sequence. The preset combination length can be understood as the preset length of the sample abnormal event combination, such as 2, 3, etc.; the occurrence frequency of the sample abnormal event combination can be understood as the number of times the sample abnormal event combination appears in the initial positive sample abnormal event sequence; the frequency relationship matrix can be understood as a matrix that can reflect the occurrence frequency of each sample abnormal event combination, and each row or column of the matrix represents the occurrence frequency corresponding to a certain sample abnormal event and the combination of all sample abnormal events.The number of occurrences can be understood as the number of times an initial positive abnormal event appears in the initial positive abnormal event sequence. The preset number threshold can be set according to actual needs to screen initial positive abnormal events with a high number of occurrences. Combining multiple initial positive abnormal events according to a preset combination length to determine multiple sample abnormal event combinations can be understood as combining the multiple initial positive abnormal events so that the number of initial positive abnormal events included in each combination is consistent with the preset combination length. For example, when the preset combination length is 2, the multiple initial positive abnormal events are combined in pairs to obtain multiple sample abnormal event combinations, where each sample abnormal event combination contains two initial positive abnormal events. For another example, when the preset combination length is 3, the multiple initial positive abnormal events are combined in pairs to obtain multiple sample abnormal event combinations containing three initial positive abnormal events. After determining multiple positive sample abnormal event combinations, the number of times each positive sample abnormal event combination appears in the initial positive sample abnormal event sequence, i.e., the occurrence frequency of each sample abnormal event combination, is counted. Based on the occurrence frequency of each sample abnormal event combination, a frequency relationship matrix is ​​then generated. Before or after obtaining the frequency relationship matrix, initial positive sample abnormal events whose occurrence frequency in the initial positive sample abnormal event sequence exceeds a preset frequency threshold can be identified as target sample abnormal events. For example, if the initial positive sample abnormal event sequence is (32, 50, 70, 6, 8, 6, 4, 6, 4, 50), and the preset frequency threshold is 2, abnormal events 6 and 4 are identified as target sample abnormal events. Subsequently, insertion or enhancement processing can be performed on 6 and 4. After obtaining the frequency relationship matrix and determining the target sample abnormal event, first data enhancement can be performed on the initial positive sample abnormal event sequence based on the first data enhancement operator, the frequency relationship matrix, and the target sample abnormal event to obtain an enhanced positive sample abnormal event sequence. The fault prediction method provided herein, based on the frequency of abnormal event combinations, preserves semantic information in the sequence, thereby improving the semantic analysis capabilities of subsequently trained fault prediction models. Optionally, determining a preset combination length and combining the multiple initial positive sample abnormal events according to the preset combination length includes: using each initial positive sample abnormal event from the multiple initial positive sample abnormal events as a target positive sample abnormal event, and combining them with other positive sample abnormal events to obtain multiple sample abnormal event combinations that meet the preset combination length.Specifically, after obtaining multiple initial positive abnormal events as described above, each initial positive abnormal event can be used as a target positive abnormal event and combined with other positive abnormal events to obtain multiple abnormal event combinations that meet a preset combination length. For example, if the preset combination length is 2 and the multiple initial positive abnormal events are 32, 50, 70, and 6, 32 is used as the target positive abnormal event and combined with 50, 70, and 6 to obtain the abnormal event combinations (32, 50), (32, 70), and (32, 6). If 50 is used as the target positive abnormal event, it is combined with 32, 70, and 6 to obtain the abnormal event combinations (50, 32), (50, 70), and (50, 6), and so on. The fault prediction method provided in this disclosure ensures the accuracy of the frequency of abnormal event combinations by combining initial positive sample abnormal events, thereby ensuring the accuracy of the semantic analysis of the subsequent fault prediction model, enabling the model to better predict faults. Optionally, the first data augmentation operator includes an insertion data augmentation operator and / or a replacement data augmentation operator. The fault prediction method provided in this disclosure, by providing multiple context-based data augmentation operators, increases the diversity of samples subsequently augmented and improves the accuracy of the subsequently trained fault prediction model. In practical applications, when the first data enhancement operator includes an insertion data enhancement operator, sample amplification can be performed through insertion data processing. The specific implementation method is as follows: When the first data enhancement operator includes an insertion data enhancement operator, data enhancement is performed on the initial positive sample abnormal event sequence according to the first data enhancement operator and the frequency relationship matrix to obtain an enhanced positive sample abnormal event sequence, including: determining the neighboring sample abnormal events of the target sample abnormal event and the insertion position of the neighboring sample abnormal events according to the insertion data enhancement operator and the occurrence frequency of the target sample abnormal event combination in the frequency relationship matrix, wherein the target sample abnormal event combination is a sample abnormal event combination associated with the target sample abnormal event; and inserting the neighboring sample abnormal events into the initial positive sample abnormal event sequence according to the insertion position of the neighboring sample abnormal event to obtain an enhanced positive sample abnormal event sequence.Among them, the insertion data enhancement operator can be understood as a data processing operator that inserts the initial positive sample abnormal event into the initial positive sample abnormal event sequence; the insertion position can be understood as the back side or the front side of the target sample abnormal event in the initial positive sample abnormal event sequence. Specifically, if the target sample abnormal event and the neighboring sample abnormal event have a high frequency of adjacent occurrence, the neighboring sample abnormal event can be inserted into the initial positive sample abnormal event sequence, behind the target sample abnormal event; if the neighboring sample abnormal event and the target sample abnormal event have a high frequency of adjacent occurrence, the neighboring sample abnormal event can be inserted into the initial positive sample abnormal event sequence, in front of the target sample abnormal event. For example, when the insertion position is understood to be in front of the initial positive sample abnormal event in the initial positive sample abnormal event sequence, for example, 32 is the target sample abnormal event and 50 is the neighboring sample abnormal event of 32, then 50 is inserted in front of or behind 32 in the initial positive sample abnormal event sequence. If (50, 32) occurs more frequently, 50 is inserted in front of 32 in the initial positive sample abnormal event sequence. If (32, 50) occurs more frequently, 50 is inserted in front of 32 in the initial positive sample abnormal event sequence. oIt should be noted that since the initial positive sample abnormal event sequence may contain multiple target sample abnormal events, in practical applications, the neighboring sample abnormal events of each target sample abnormal event can be inserted after the corresponding target sample abnormal event. After inserting the neighboring sample abnormal events into the initial positive sample abnormal event sequence, the resulting new abnormal event sequence is called the enhanced positive sample abnormal event sequence. The fault prediction method provided in this disclosure uses insertion to perform data augmentation on the initial positive sample abnormal event sequence, amplifying the positive samples and reducing the impact of perturbations on the semantic information in the original samples, thereby ensuring the usability of the amplified positive samples. In practical applications, insertion can be performed on abnormal event combinations that occur frequently. For example, if the combination "we" appears frequently in a text, when inserting abnormal events to increase perturbation, to maximize the preservation of the semantic information of the original abnormal event sequence, "we" can be inserted after "I" or before "we." The specific implementation method is as follows: Determining the neighboring sample abnormal events of the target sample abnormal event and the insertion position of the neighboring sample abnormal event based on the insertion data enhancement operator and the occurrence frequency of the target sample abnormal event combination in the frequency relationship matrix includes: determining at least two target sample abnormal event combinations associated with the target sample abnormal event from the sample abnormal event combination based on the target sample abnormal event; determining an initial neighboring sample abnormal event based on the at least two target sample abnormal event combinations; determining the sample abnormal event combination associated with the initial neighboring sample abnormal event and the occurrence frequency relative to the at least two target sample abnormal event combinations; determining the neighboring sample abnormal event of the target sample abnormal event and the insertion position of the neighboring sample abnormal event based on the occurrence frequency and the initial neighboring sample abnormal event. The target sample abnormal event combination associated with the target sample abnormal event can be understood as including the target abnormal event. The target sample abnormal event combination associated with a can be understood as including a among the sample abnormal event combinations, such as ab, ac, ad, ba, ca, da, etc. After determining the target sample abnormal event combination associated with the target sample abnormal event, the neighboring sample abnormal event can be determined from the target sample abnormal event combination. If there is only one target sample abnormal event combination, the neighboring sample abnormal event can be directly determined from the target sample abnormal event combination.When there are at least two target sample abnormal event combinations, it is necessary to determine the initial positive sample abnormal event that is different from the target sample abnormal event in each target sample abnormal event combination as the initial neighbor sample abnormal event from the at least two target sample abnormal event combinations. Furthermore, the initial neighboring sample abnormal event with the highest occurrence frequency of the corresponding target sample abnormal event combination among each initial neighboring sample abnormal event can be determined as the neighboring sample abnormal event, and the neighboring sample abnormal event can be inserted before or after the target sample abnormal event to obtain a new abnormal event sequence, namely, the enhanced positive sample abnormal event sequence. Continuing with the above example, for target sample abnormal event a, if the conditional probability P(b|a) is maximized, that is, (a, b) has the highest occurrence frequency, then b can be regarded as a's neighboring sample abnormal event and inserted after the target sample abnormal time a in the initial neighboring sample abnormal events. Alternatively, for target sample abnormal event a, if the conditional probability P(a|b) is maximized, that is, (b, a) has the highest occurrence frequency, then b can be regarded as a's neighboring sample abnormal event and inserted before the target sample abnormal time a in the initial neighboring sample abnormal events. In practical applications, when the first data augmentation operator includes a replacement data augmentation operator, sample augmentation can be performed through data replacement processing. The specific implementation is as follows: When the first data augmentation operator includes a replacement data augmentation operator, performing data augmentation on the initial positive sample abnormal event sequence based on the first data augmentation operator and the frequency relationship matrix to obtain an enhanced positive sample abnormal event sequence includes: determining the similarity of each sample abnormal event combination based on the replacement data augmentation operator and the frequency relationship matrix; determining similar sample abnormal events to each target sample abnormal event based on the similarity of each sample abnormal event combination; and performing replacement processing on each target sample abnormal event in the initial positive sample abnormal event sequence based on the similar sample abnormal events to obtain an enhanced positive sample abnormal event sequence. The similarity can be understood as vector similarity or cosine similarity. Vector similarity is used for explanation below. In practical applications, this can be achieved by solving cosine similarity or other methods, and this specification is not limited to this. Specifically, the vector similarity between each row and column in the frequency relationship matrix, the vector similarity between each row and each row, or the vector similarity between each column and each column can be calculated based on the replacement data enhancement operator, so as to determine the vector similarity between each sample abnormal event combination.Through the above method, the vector similarity between each target sample abnormal event and each of the other initial positive sample abnormal event sequences can be determined. This allows the initial positive sample abnormal event sequence with the highest vector similarity to each target sample abnormal event to be determined, which is the similar sample abnormal event for each target sample abnormal event. Then, by replacing the corresponding target sample abnormal event with the similar sample abnormal event, a new abnormal event sequence can be obtained, which is the enhanced positive sample abnormal event sequence. It should be noted that during the above replacement, the enhanced positive sample abnormal event sequence can be obtained by replacing one or more of the target sample abnormal events. This disclosure does not limit the number of abnormal events that can be replaced. For example, in a sequence (32, 50, 90, 6), the similar sample abnormal event for 32 is 6. Replacing 32 with 6 yields the new sequence (6, 50, 90, 6). (6, 50, 90, 6) is the enhanced positive sample abnormal event sequence. The fault prediction method provided herein performs data augmentation on an initial positive sample abnormal event sequence by replacing similar abnormal events, thereby amplifying positive samples, reducing the impact of disturbances on the semantic information in the original samples, and ensuring the usability of the amplified positive samples. Optionally, determining a preset combination length and combining the multiple initial positive sample abnormal events according to the preset combination length to determine multiple sample abnormal event combinations includes: determining sample position codes corresponding to the initial positive sample abnormal event sequence based on the initial positive sample abnormal event sequence; determining a sample mapping vector based on the initial positive sample abnormal event sequence and the sample position codes, and determining a sample mapping matrix based on the sample mapping vector; and combining the multiple initial positive sample abnormal events based on the preset combination length and the sample mapping matrix to determine the multiple sample abnormal event combinations. The fault prediction method provided herein utilizes the relationship between the positive sample abnormal event sequence and the corresponding sample position codes in the mapping matrix to transform text log processing into vector processing, reducing data processing complexity and improving the training efficiency of the fault prediction model.In practical applications, the data enhancement operator may include a second data enhancement operator. In this case, the data enhancement is specifically implemented as follows: When the data enhancement operator includes the second data enhancement operator, performing data enhancement on the initial positive abnormal event sequence according to the data enhancement operator to obtain an enhanced positive abnormal event sequence includes: determining the importance of each initial positive abnormal event in the initial positive abnormal event sequence based on each abnormal event and the importance corresponding to each abnormal event in an abnormal event importance library; and performing data enhancement on the initial positive abnormal event sequence according to the second data enhancement operator and the importance of each initial positive abnormal event to obtain an enhanced positive abnormal event sequence. The abnormal event importance library can be understood as a database containing a one-to-one correspondence between abnormal events and the importance corresponding to the abnormal events. Specifically, the importance of each abnormal event in the initial positive abnormal event sequence can be determined based on the abnormal event importance library. Subsequently, data enhancement can be performed on the initial positive abnormal event sequence based on the importance of each abnormal event in the initial positive abnormal event sequence and a second data enhancement operator to obtain an enhanced positive abnormal event sequence. In practical applications, the abnormal event importance library can be determined using historical logs of service processing units to improve the accuracy of data enhancement. A specific implementation method is as follows: the service processing units include multiple; before determining the importance of each initial positive abnormal event in the initial positive abnormal event sequence based on each abnormal event in the abnormal event importance library and the importance corresponding to each abnormal event, the method further includes: obtaining multiple historical abnormal log data from each service processing unit within a preset time period; determining multiple historical sample abnormal events based on the multiple historical abnormal log data; determining the importance of each historical sample abnormal event relative to the multiple historical sample abnormal events based on a preset abnormal event importance algorithm; and establishing an abnormal event importance library based on the correlation between each historical sample abnormal event and the importance corresponding to each historical sample abnormal event. The preset time period can be understood as a preset historical time period, such as three historical months, one historical year, etc.; the historical abnormal log data can be understood as abnormal log data of the service processing unit within a preset historical time end, such as abnormal log data within three historical months, abnormal log data within one historical year, etc.; the abnormal event importance algorithm includes but is not limited to the TF-IDF algorithm, a scoring algorithm based on influence and duration, etc.Specifically, abnormal log data of multiple service processing units within a preset historical time period can be determined, and each abnormal event contained therein can be identified as a historical sample abnormal event. Furthermore, the importance of each historical sample abnormal event can be determined based on a preset abnormal event importance algorithm. Thus, an abnormal event importance database can be established based on the historical sample abnormal events and the corresponding importance of each historical sample abnormal event. In specific implementation, determining the importance of each historical sample abnormal event based on the preset abnormal event importance algorithm can be implemented using the following formulas 1-3:

[0008] TF - IDF = TF x IDF (Formula 1). TF-IDF measures the importance of each abnormal event relative to the corpus. TF represents the word frequency of the abnormal event in a single NC abnormal event sequence. This calculation can be performed using Formula 2. IDF represents the inverse document word frequency of the abnormal event relative to the abnormal event sequence of each NC. This calculation can be performed using Formula 3.

[0009] P e . 1 = avgd f— x log 1+nd + 1)) \n a n b l+m e , ) Formula 2 Where, n represents the number of abnormal events that occur on each NC, an represents the total number of abnormal events that occur on each NC; nd represents the total number of days; and m% represents the number of days on which the abnormal event occurs.

[0010] P e = avgnc ( ― x (log 1+nnr + 1) ), that is, eight tons I; l+mei J) formula 3 represents the total number of NCs; n]ei represents the number of NCs that occurred for this abnormal event. The fault prediction method provided by this disclosure encodes abnormal events generated by abnormal logs by constructing an abnormal event library, eliminating the need for encoding using a model. This improves the execution speed of fault prediction model training, testing, and application, and enhances the efficiency of subsequent fault prediction by the fault prediction model. Optionally, the second data augmentation operator includes an occlusion data augmentation operator, a cropping data augmentation operator, and / or a reordering data augmentation operator. The fault prediction method provided by this disclosure, by providing multiple data augmentation operators based on word importance, increases the diversity of samples subsequently augmented and improves the accuracy of the subsequently trained fault prediction model. In practical applications, when the second data enhancement operator includes an occlusion data enhancement operator, data enhancement can be performed based on the importance of each initial positive abnormal event to obtain an enhanced positive abnormal event sequence. The specific implementation is as follows: When the second data enhancement operator includes an occlusion data enhancement operator, performing data enhancement on the initial positive abnormal event sequence based on the second data enhancement operator and the importance of each initial positive abnormal event to obtain an enhanced positive abnormal event sequence includes: determining, based on the occlusion data enhancement operator, a correlation between the importance of each initial positive abnormal event and a preset first importance threshold, thereby determining initial positive abnormal events to be occluded; and performing occlusion processing on the initial positive abnormal events to be occluded in the initial positive abnormal event sequence to obtain an enhanced positive abnormal event sequence. The preset first importance threshold can be understood as a preset importance threshold that indicates unimportance. Specifically, an enhanced positive sample abnormal event sequence can be obtained by masking unimportant initial positive sample abnormal events in the initial positive sample abnormal event sequence. The unimportant initial positive sample abnormal event can be determined by its magnitude relationship with a preset first importance threshold, and the specific mathematical relationship is not limited in this disclosure. Using the above example, for example, if 32 is the initial positive sample abnormal event to be masked, masking 32 yields the enhanced positive sample abnormal event sequence (50, 70, 6). oThe fault prediction method provided herein uses occlusion processing to block unimportant abnormal events, making the enhanced positive abnormal event sequence more accurate and subsequently improving the accuracy of the fault prediction model in identifying positive samples. In practical applications, when the second data enhancement operator includes an occlusion data enhancement operator, data enhancement can be performed based on the importance of each initial positive abnormal event to obtain an enhanced positive abnormal event sequence. This is specifically implemented as follows: When the second data enhancement operator includes a clipping data enhancement operator, data enhancement is performed on the initial positive abnormal event sequence based on the second data enhancement operator and the importance of each initial positive abnormal event to obtain an enhanced positive abnormal event sequence. This includes: determining, based on the clipping data enhancement operator, a correlation between the importance of each initial positive abnormal event and a preset second importance threshold, and determining the initial positive abnormal event to be clipped; and clipping the initial positive abnormal event to be clipped in the initial positive abnormal event sequence to obtain an enhanced positive abnormal event sequence. The preset second importance threshold can be understood as a preset importance threshold that indicates importance. Specifically, an enhanced positive abnormal event sequence can be obtained by clipping important initial positive abnormal events from the initial positive abnormal event sequence. Important initial positive abnormal events can be determined by their magnitude relationship with the preset second importance threshold, and the present disclosure does not limit the specific mathematical relationship. For example, if the initial positive abnormal event sequence is (5, 7, 80, 32, 50, 6, 32, 50, 6, 5, 61), where (32, 50, 6) is the determined initial positive abnormal event to be clipped, then (32, 50, 6) is clipped from the initial positive abnormal event sequence to obtain the enhanced positive abnormal event sequence (32, 50, 6). oThe fault prediction method provided herein extracts important abnormal event sequences through clipping, obtaining a more accurate enhanced positive abnormal event sequence, thereby improving the accuracy of positive sample identification by subsequent fault prediction models. In practical applications, when the second data enhancement operator includes an occlusion data enhancement operator, data enhancement can be performed based on the importance of each initial positive abnormal event to obtain an enhanced positive abnormal event sequence. This is specifically implemented as follows: When the data enhancement operator also includes a reordering data enhancement operator, clipping the initial positive abnormal events to be clipped from the initial positive abnormal event sequence to obtain an enhanced positive abnormal event sequence includes: clipping the initial positive abnormal event sequence based on the initial positive abnormal events to be clipped to obtain an initial positive abnormal event subsequence; and reordering the initial positive abnormal event subsequence based on the reordering data enhancement operator to obtain an enhanced positive abnormal event sequence. Specifically, after determining the initial positive abnormal events to be pruned, the pruned initial positive abnormal events can be pruned to obtain an initial positive abnormal event subsequence. The initial positive abnormal event subsequence is then reordered using the reordering data enhancement operator to obtain an enhanced positive abnormal event sequence. Continuing with the above example, if 32, 50, and 6 are the initial positive abnormal events to be pruned, 32, 50, and 6 are pruned to obtain the initial positive abnormal event subsequence (32, 50, 6). Furthermore, (32, 50, 6) is reordered to obtain enhanced positive abnormal event sequences such as (50, 32, 6), (50, 6, 32), (32, 6, 50), and so on. The fault prediction method provided herein improves data availability, further expands the number of positive samples, and enhances the accuracy of positive sample identification by subsequent fault prediction models by reordering the pruned abnormal event sequences. Step 308: Using the initial positive abnormal event sequences and the enhanced positive abnormal event sequences as positive samples, and the negative abnormal event sequences as negative samples, a fault prediction model is trained based on the positive samples, their corresponding sample labels, the negative samples, and their corresponding sample labels.Optionally, the training to obtain a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples includes: training an initial fault prediction model using a gradient descent algorithm based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples; and stopping model training to obtain a fault prediction model when a loss function of the initial fault prediction model satisfies a preset loss function condition, wherein the loss function is a cross-beam loss function. The fault prediction model training method provided herein reduces the degree of bias in fault prediction training by backpropagating the cross-beam loss function using a gradient descent algorithm, thereby improving the accuracy of fault prediction training. The fault prediction model training method provided herein performs data augmentation on the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence, thereby amplifying the positive samples for model training, achieving a better balance between positive and negative samples, improving the fault prediction capability of the trained fault prediction model, and ensuring more accurate fault prediction when the fault prediction model is subsequently applied. The following describes in detail the fault model training method provided by the present disclosure in conjunction with Figure 4. As shown in Figure 4, Figure 4 shows a schematic diagram of the processing process of a fault prediction model training method provided according to one embodiment of this specification. The fault model training method is applied to a cloud computing system, including a service processing unit, and is specifically implemented as follows:

[0011] (1) Data Preprocessing. The detector acquires exception logs reported by the NC in real time. Based on expert knowledge and regular expressions, each exception log is abstracted into a corresponding phrase. The abstracted phrase represents the exception event corresponding to each exception log. For example, the exception log "mce: [Hardware Error]: Machine check events logged" is abstracted into the exception event "dmesg_unrecover_mce." After obtaining the exception events corresponding to each exception log, the pre-built exception event library is used to identify each exception event and obtain the corresponding exception event code. The pre-built abnormal event library is similar to a corpus in natural language processing, containing various types of abnormal events. Each abnormal event has a corresponding numerical identifier, namely an integer. Because the abnormal events in the abnormal event library are presented in the form of phrases, it is not convenient to directly train the fault prediction model. To solve this problem, the input of the fault prediction model can be converted into a vector form. That is, based on the abnormal event library, each abnormal event is converted into a numerical identifier for training. For example, the abnormal event "dmesg_unrecover_mce" can be converted into the number 32. Furthermore, since log data is judgment-intensive and dense, in practical applications, the acquired abnormal logs can be sampled. Several sampling positions can be determined on the formed abnormal identification sequence at preset time intervals. Then, a target sampling position corresponding to the downtime sample is obtained from the several sampling positions, that is, the target sampling position at the moment of downtime. This target sampling position is used as the sampling starting position. Then, downtime samples within a preset sampling window length starting from the sampling starting position are retained as the positive sample abnormal event sequence. In addition, non-downtime samples on the formed abnormal identification sequence starting from any positive sample sampling starting position and randomly retained according to a preset ratio are used as the negative sample abnormal event sequence.

[0012] (2) Positive Sample Enhancement Based on Contextual Relationships. In practical applications, data enhancement can be performed on positive sample abnormal event sequences using contextual relationships or word importance. The specific implementation method for data enhancement of positive sample abnormal event sequences using contextual relationships is as follows: First, embedding encoding is performed on the positive sample abnormal event sequence. Specifically, based on the order of the positive sample abnormal event sequence, the position code corresponding to the positive sample abnormal event sequence is determined. The positive sample abnormal event sequence is mapped to a positive sample abnormal event sequence vector. The position code corresponding to the positive sample abnormal event sequence is mapped to a position code vector. The positive sample abnormal event sequence vector and the position code vector are then added to obtain a mapping matrix. After obtaining the mapping matrix, the occurrence frequency of multiple abnormal event combinations corresponding to the positive sample abnormal event sequence can be determined. Specifically, the length of the abnormal event combination can be pre-set. For ease of understanding, the following explanation uses an abnormal event combination length of 2 as an example. In practical applications, the length of the abnormal event combination can be set according to actual needs, for example, to 2, 3, etc. After determining the length of the abnormal event combination, the abnormal events can be combined according to the mapping matrix to obtain multiple abnormal event combinations. For example, if the length of the abnormal event combination is 2, the abnormal events can be combined in pairs according to the mapping matrix to obtain multiple abnormal event combinations. Furthermore, the frequency of occurrence of each abnormal event combination is counted, and based on the frequency of each abnormal event combination, a relationship matrix for the abnormal event combination is determined, i.e., the relationship matrix corresponding to the positive sample abnormal event sequence. Once the relationship matrix is ​​obtained, data enhancement can be implemented using a context-based data enhancement operator. Context-based data enhancement operators include, but are not limited to, insertion and replacement operators. If the data enhancement operator is an insertion operator, the frequency of occurrence of each abnormal event combination in the relationship matrix can be converted to a frequency to obtain the frequency of each abnormal event combination. Then, based on the frequency corresponding to each abnormal event, the maximum frequency of the combined abnormal event can be found. The nearest neighbor abnormal event of each abnormal event can be determined based on the abnormal event combination corresponding to the maximum frequency. In order to enhance the samples, the nearest neighbor abnormal event corresponding to the abnormal event can be inserted to the adjacent side of the abnormal event. For example, relative to a certain abnormal event, the frequency of the abnormal event combination is the maximum frequency of all abnormal event combinations containing the abnormal event. Then, the nearest neighbor abnormal event corresponding to the abnormal event is inserted to the back side of the abnormal event.To reduce sample distortion, the above process can be performed when the frequency of the abnormal event combination reaches a preset frequency threshold. If the data augmentation operator is a replacement operator, the vector similarities between the abnormal events in the relationship matrix can be used to obtain similar abnormal events corresponding to each abnormal event. Similar to the insertion operator, to enhance the sample, one or more abnormal events can be replaced with their corresponding similar abnormal events. To reduce sample distortion, the replacement step can also be performed only when the vector similarity meets a preset similarity threshold.

[0013] (3) Positive Sample Enhancement Based on Word Importance. In practical applications, data enhancement can also be performed on positive sample abnormal event sequences using word importance. The specific implementation is as follows: Assume that in an abnormality log, a word represents an abnormal event, a sentence represents a sequence of abnormal events, an abnormality log document represents daily sequence data or sequence data on each NC, and a corpus represents the complete data of multiple NCs within a preset time period (e.g., three or four months). Based on the above assumptions, the importance index of each abnormal event sequence relative to the corpus is calculated. Specifically, the importance index of each abnormal event sequence relative to the corpus can be calculated using Formulas 1, 2, and 3. Furthermore, after determining the importance index of each abnormality relative to the corpus, data enhancement can be performed on the positive sample abnormal event sequence using the following data enhancement operator based on word importance. Data enhancement operators based on word importance include, but are not limited to, occlusion operators, cropping operators, and reordering operators. When the data augmentation operator is an occlusion operator, based on the importance index corresponding to each anomaly determined above, the anomaly events that are occluded in the positive anomaly event sequence and are below a preset occlusion importance index threshold are counted to obtain an enhanced positive anomaly event sequence. When the data augmentation operator is a pruning operator, based on the importance index corresponding to each anomaly determined above, the anomaly event sequences that are occluded in the positive anomaly event sequence and are above a preset pruning importance index threshold are counted to obtain an enhanced positive anomaly event sequence. Furthermore, when the data augmentation operator is a pruning operator and a reordering operator, the enhanced positive anomaly event sequence processed by the pruning operator can be reordered to obtain a reordered enhanced positive anomaly event sequence. It should be noted that in actual applications, any one or more of the five data augmentation operators described above can be selected to perform the positive sample augmentation step as needed. (IV) Model Training. According to the above positive sample enhancement step, an enhanced positive sample abnormal event sequence can be obtained after being enhanced based on the positive sample abnormal event sequence. Then, the positive sample abnormal event sequence and the enhanced positive sample abnormal event sequence can be used as positive samples, the negative sample abnormal event sequence can be used as negative samples, and the sample labels corresponding to each sample can be used as sample labels to train an initial fault prediction model to obtain an enhanced fault prediction model. The initial fault prediction model includes but is not limited to a BERT model and a TAAT model.The fault prediction model training method provided by the present disclosure encodes abnormal events generated by abnormal logs by building an abnormal event library, eliminating the need for model encoding. This improves the execution speed of model training, testing, and application, and enhances fault prediction efficiency. Data enhancement based on contextual information and word importance preserves semantic information in sequences, increases data availability, and expands the number of positive samples. Data enhancement using a relationship matrix instead of raw data analysis further enhances the model's data interpretation. Furthermore, by performing sample enhancement on samples, the method enables the model to be trained using a wider variety of samples, improving model generalization performance. In practical applications, due to the improved fault prediction capability of the trained fault prediction model, the fault prediction model trained according to this fault prediction model training method has a higher accuracy rate. This enables the cloud computing system to identify and maintain downtime failures faster, more frequently, and more accurately, thereby reducing the probability of subsequent cloud computing system downtime and the losses caused to users by cloud computing system downtime, significantly improving the stability and reliability of the cloud computing system. Corresponding to the above-mentioned method embodiments, this specification also provides an embodiment of a fault prediction device. FIG5 shows a schematic structural diagram of a fault prediction device provided according to one embodiment of this specification. As shown in FIG5 , the device is applied to a cloud computing system, which includes a service processing unit and comprises: a sequence determination module 502 configured to obtain abnormality log data from the service processing unit and determine an abnormal event sequence based on the abnormality log data; and a fault prediction module 504 configured to determine a fault prediction result for the service processing unit based on the abnormal event sequence using a fault prediction model. The fault prediction model is obtained by training with positive samples, sample labels corresponding to the positive samples, and negative samples, and sample labels corresponding to the negative samples. The positive samples include an initial positive abnormal event sequence and an enhanced positive abnormal event sequence obtained by data augmentation of the initial positive abnormal event sequence. The negative samples include a negative abnormal event sequence.Optionally, the fault prediction model 504 is trained and obtained through the following steps: obtaining sample abnormality log data from the service processing unit; determining a sample abnormal event sequence based on the sample abnormality log data; determining an initial positive abnormal event sequence and a negative abnormal event sequence based on the sample abnormal event sequence, and performing data augmentation on the initial positive abnormal event sequence to obtain an enhanced positive abnormal event sequence; using the initial positive abnormal event sequence and the enhanced positive abnormal event sequence as positive samples, and the negative abnormal event sequence as negative samples, and training a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples. Optionally, the sequence determination module 502 is further configured to: process abnormal information in the abnormality log data to determine abnormal events corresponding to the abnormal information; determine event identifiers corresponding to the abnormal events based on a matching relationship between reference abnormal events and reference event identifiers in an abnormal event library; and sort the event identifiers corresponding to the abnormal events based on the abnormal occurrence time of the abnormal information to generate the abnormal event sequence. Optionally, the sequence determination module 502 is further configured to: sort the event identifiers corresponding to the abnormal events using a preset sorting rule based on the abnormal occurrence time corresponding to the abnormal events, and generate an abnormal event sequence based on the sorted event identifiers. Optionally, the sequence determination module 502 is further configured to: obtain initial abnormality log data of the service processing unit, wherein the initial abnormality log data includes initial abnormality information and the abnormal occurrence time corresponding to the initial abnormality information; sort the initial abnormality log data using a preset sorting rule based on the abnormal occurrence time corresponding to the initial abnormality information to obtain sorted initial abnormality log data; and sample the sorted initial abnormality log data based on a sampling time interval and a sampling time length to obtain the abnormality log data. Optionally, the fault prediction module 504 is further configured to: input the abnormal event sequence into a fault prediction model, obtain a confidence level output by the fault prediction model, and determine a fault prediction result indicating whether the service processing unit has experienced a downtime based on the confidence level and a preset confidence threshold. The above is a schematic diagram of a fault prediction device according to this embodiment. It should be noted that the technical solution of the fault prediction device and the technical solution of the aforementioned fault prediction method share the same concept. For details not described in detail in the technical solution of the fault prediction device, refer to the description of the technical solution of the aforementioned fault prediction method.Corresponding to the above-mentioned method embodiments, this specification also provides an embodiment of a fault prediction model training device. FIG6 shows a schematic structural diagram of a fault prediction model training device provided in one embodiment of this specification. As shown in FIG6 , the device is applied to a cloud computing system, which includes a service processing unit and comprises: a sample acquisition module 602 configured to acquire sample abnormality log data from the service processing unit; a sample sequence determination module 604 configured to determine a sample abnormality event sequence based on the sample abnormality log data; an enhanced sequence acquisition module 606 configured to determine an initial positive abnormality event sequence and a negative abnormality event sequence based on the sample abnormality event sequence, and perform data enhancement on the initial positive abnormality event sequence to obtain an enhanced positive abnormality event sequence; and a model training module 608 configured to use the initial positive abnormality event sequence and the enhanced positive abnormality event sequence as positive samples, and the negative abnormality event sequence as negative samples, and train a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples. Optionally, the enhanced sequence acquisition module 606 is further configured to: determine the initial positive abnormal event sequence from the sample abnormal event sequence based on a preset sampling time and a preset sampling length; and determine the negative abnormal event sequence from the sample abnormal event sequence based on a preset negative sampling rule. Optionally, the enhanced sequence acquisition module 606 is further configured to: determine a data enhancement operator, and perform data enhancement on the initial positive abnormal event sequence based on the data enhancement operator to obtain an enhanced positive abnormal event sequence. The initial positive abnormal event sequence includes multiple initial positive abnormal events, and the data enhancement operator includes a first data enhancement operator based on contextual relationships and / or a second data enhancement operator based on word importance.Optionally, when the data enhancement operator includes the first data enhancement operator, the enhanced sequence obtaining module 606 is further configured to: determine a preset combination length, combine the multiple initial positive sample abnormal events according to the preset combination length to determine multiple sample abnormal event combinations, wherein the number of initial positive sample abnormal events included in each sample abnormal event combination is consistent with the preset combination length; count the occurrence frequencies of each sample abnormal event combination, and determine a frequency relationship matrix for the multiple sample abnormal event combinations based on the occurrence frequencies; determine, from the multiple initial positive sample abnormal events, a target sample abnormal event whose occurrence frequency exceeds a preset threshold; and perform first data enhancement on the initial positive sample abnormal event sequence based on the first data enhancement operator, the frequency relationship matrix, and the target sample abnormal event to obtain an enhanced positive sample abnormal event sequence. Optionally, the first data enhancement operator includes an insertion data enhancement operator and / or a replacement data enhancement operator. Optionally, when the first data enhancement operator includes an insertion data enhancement operator, the enhanced sequence acquisition module 606 is further configured to: determine the neighboring sample abnormal events of the target sample abnormal event and the insertion position of the neighboring sample abnormal events based on the insertion data enhancement operator and the occurrence frequency of the target sample abnormal event combination in the frequency relationship matrix, wherein the target sample abnormal event combination is a sample abnormal event combination associated with the target sample abnormal event; and insert the neighboring sample abnormal events into the initial positive sample abnormal event sequence based on the insertion position of the neighboring sample abnormal event to obtain an enhanced positive sample abnormal event sequence. Optionally, the enhanced sequence acquisition module 606 is further configured to: determine, based on the target sample abnormal event, at least two target sample abnormal event combinations associated with the target sample abnormal event from the sample abnormal event combinations; determine an initial neighboring sample abnormal event based on the at least two target sample abnormal event combinations; determine the sample abnormal event combination associated with the initial neighboring sample abnormal event and its occurrence frequency relative to the at least two target sample abnormal event combinations; and determine, based on the occurrence frequency and the initial neighboring sample abnormal event, a neighboring sample abnormal event of the target sample abnormal event and an insertion position of the neighboring sample abnormal event.Optionally, when the first data enhancement operator includes a replacement data enhancement operator, the enhanced sequence obtaining module 606 is further configured to: determine the similarity of each sample abnormal event combination based on the replacement data enhancement operator and the frequency relationship matrix; determine similar sample abnormal events to each target sample abnormal event based on the similarity of each sample abnormal event combination; and replace each target sample abnormal event in the initial positive sample abnormal event sequence based on the similar sample abnormal events to obtain an enhanced positive sample abnormal event sequence. Optionally, when the data enhancement operator includes the second data enhancement operator, the enhanced sequence obtaining module 606 is further configured to: determine the importance of each initial positive sample abnormal event in the initial positive sample abnormal event sequence based on each abnormal event in the abnormal event importance library and the importance corresponding to each abnormal event; and perform data enhancement on the initial positive sample abnormal event sequence based on the second data enhancement operator and the importance of each initial positive sample abnormal event to obtain an enhanced positive sample abnormal event sequence. Optionally, the service processing unit includes multiple units; the apparatus further includes an abnormal event importance library establishment module configured to: obtain multiple historical abnormality log data from each service processing unit within a preset time period; determine multiple historical sample abnormal events based on the multiple historical abnormality log data; determine the importance of each historical sample abnormal event relative to the multiple historical sample abnormal events based on a preset abnormal event importance algorithm; and establish an abnormal event importance library based on the correlation between each historical sample abnormal event and the importance corresponding to each historical sample abnormal event. Optionally, the second data enhancement operator includes an occlusion data enhancement operator, and / or a cropping data enhancement operator, and / or a reordering data enhancement operator. Optionally, when the second data enhancement operator includes an occlusion data enhancement operator, the enhanced sequence obtaining module 606 is further configured to: determine, based on the occlusion data enhancement operator, a correlation between the importance of each initial positive sample abnormal event and a preset first importance threshold, and determine the initial positive sample abnormal event to be occluded; and perform occlusion processing on the initial positive sample abnormal event to be occluded in the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence.Optionally, when the second data enhancement operator includes a trimming data enhancement operator, the enhanced sequence obtaining module 606 is further configured to: determine, based on the trimming data enhancement operator, a correlation between the importance of each initial positive abnormal event and a preset second importance threshold, to determine the initial positive abnormal event to be trimmed; and trim the initial positive abnormal events to be trimmed in the initial positive abnormal event sequence to obtain an enhanced positive abnormal event sequence. Optionally, when the data enhancement operator also includes a reordering data enhancement operator, the enhanced sequence obtaining module 606 is further configured to: trim the initial positive abnormal event sequence based on the initial positive abnormal events to be trimmed to obtain an initial positive abnormal event subsequence; and reorder the initial positive abnormal event subsequence based on the reordering data enhancement operator to obtain an enhanced positive abnormal event sequence. Optionally, the enhanced sequence acquisition module 606 is further configured to: train an initial fault prediction model using a gradient descent algorithm based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples; and, when the loss function of the initial fault prediction model satisfies a preset loss function condition, stop model training to obtain a fault prediction model, wherein the loss function is a cross-beam loss function. The above is a schematic diagram of a fault prediction model training device according to this embodiment. It should be noted that the technical solution of the fault prediction model training device and the technical solution of the fault prediction model training method described above are based on the same concept. Details not described in detail in the technical solution of the fault prediction model training device can be found in the description of the technical solution of the fault prediction model training method described above. Figure 7 shows a block diagram of a computing device 700 according to one embodiment of this specification. Components of the computing device 700 include, but are not limited to, a memory 710 and a processor 720. The processor 720 and the memory 710 are connected via a bus 730. A database 750 is used to store data. Computing device 700 also includes an access device 740 that enables computing device 700 to communicate via one or more networks 760. Examples of these networks include a combination of a Public Switched Telephone Network (PSTN) > a Local Area Network (LAN) > a Wide Area Network (WAN) > a Personal Area Network (PAN) or a communication network such as the Internet.Access device 740 may include one or more of any type of wired or wireless network interface (e.g., a network interface card (NIC)), such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a Worldwide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a Universal Serial Bus (USB) interface, a cellular network interface, a Bluetooth interface, a Near Field Communication (NFC) interface, and the like. In one embodiment of this specification, the aforementioned components of computing device 700 and other components not shown in FIG. 7 may also be connected to each other, for example, via a bus. It should be understood that the computing device structure block diagram shown in FIG. 7 is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art may add or replace other components as needed. The computing device 700 can be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, personal digital assistant, laptop computer, notebook computer, netbook, etc.), a mobile phone (e.g., a smartphone), a wearable computing device (e.g., a smartwatch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or personal computer (PC). The computing device 700 can also be a mobile or stationary server. The processor 720 is configured to execute the following computer program / instructions, which, when executed by the processor, implement the steps of the aforementioned fault prediction method or fault prediction model training method. The various embodiments in this specification are described in a progressive manner. Reference will be made to the sections of the embodiments that are similar or identical between the various embodiments. Each embodiment focuses on the differences from the other embodiments. In particular, the computing device embodiment, because it is substantially similar to the fault prediction method or fault prediction model training method embodiment, is described briefly. For relevant details, reference will be made to the description of the fault prediction method or fault prediction model training method embodiment.One embodiment of this specification also provides a computer-readable storage medium storing a computer program / instructions. When executed by a processor, these computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced to each other. Each embodiment focuses on the differences from other embodiments. In particular, since the computer-readable storage medium embodiment is substantially similar to the fault prediction method or fault prediction model training method embodiment, the description is relatively simple. For relevant parts, reference can be made to the description of the fault prediction method or fault prediction model training method embodiment. One embodiment of this specification also provides a computer program product, including a computer program / instructions. When executed by a processor, these computer program / instructions implement the steps of the aforementioned fault prediction method or fault prediction model training method. The above is an illustrative embodiment of a computer program product of this embodiment. It should be noted that the technical solution of this computer program product shares the same concept as the technical solution of the aforementioned fault prediction method or fault prediction model training method. Details not described in detail in the technical solution of the computer program product can be found in the description of the technical solution of the aforementioned fault prediction method or fault prediction model training method. The above description of specific embodiments of this specification describes other embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the figures do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous. The computer instructions include computer program code, which may be in source code form, object code form, executable files, or some intermediate form. The computer-readable medium may include any entity or device capable of carrying the computer program code, recording media, USB flash drives, removable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media. It should be noted that the content of the computer-readable medium may be appropriately increased or decreased based on the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media does not include electrical carrier signals and telecommunication signals.It should be noted that, for ease of description, the aforementioned method embodiments are presented as a series of actions. However, those skilled in the art should understand that the present disclosure is not limited by the order of the actions described, as certain steps may be performed in a different order or simultaneously, according to the present disclosure. Furthermore, those skilled in the art should also understand that the embodiments described in this specification are preferred embodiments, and the actions and modules described are not necessarily required for the present disclosure. In the above embodiments, the description of each embodiment has its own emphasis. For portions not described in detail in a particular embodiment, reference should be made to the relevant descriptions of other embodiments. The preferred embodiments disclosed above are merely intended to help illustrate this specification. The optional embodiments do not describe all details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and variations are possible based on the content of this disclosure. This specification selects and describes these embodiments in detail to better explain the principles and practical applications of the present disclosure, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

28 Claims 1. A fault prediction method, applied to a cloud computing system, wherein the cloud computing system includes a service processing unit, and comprising: Acquiring abnormal log data of the service processing unit, and determining an abnormal event sequence based on the abnormal log data; A fault prediction result of the service processing unit is determined based on the abnormal event sequence using a fault prediction model, wherein the fault prediction model is obtained by training with positive samples, sample labels corresponding to the positive samples, negative samples, and sample labels corresponding to the negative samples; the positive samples include an initial positive sample abnormal event sequence and an enhanced positive sample abnormal event sequence obtained by performing data enhancement on the initial positive sample abnormal event sequence; and the negative samples include a negative sample abnormal event sequence.

2. The fault prediction method according to claim 1, wherein the fault prediction model is obtained by training through the following steps: obtaining sample abnormality log data of the service processing unit; determining a sample abnormality event sequence based on the sample abnormality log data; determining an initial positive sample abnormality event sequence and a negative sample abnormality event sequence based on the sample abnormality event sequence, and performing data enhancement on the initial positive sample abnormality event sequence to obtain an enhanced positive sample abnormality event sequence; using the initial positive sample abnormality event sequence and the enhanced positive sample abnormality event sequence as positive samples, using the negative sample abnormality event sequence as negative samples, and training a fault prediction model based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

3. The fault prediction method according to claim 1, wherein determining the abnormal event sequence based on the abnormal log data comprises: Processing the abnormal information in the abnormal log data to determine the abnormal event corresponding to the abnormal information; According to the matching relationship between the reference abnormal events and the reference event identifiers in the abnormal event library, the event identifiers corresponding to the abnormal events are determined; according to the abnormal occurrence time of the abnormal information, the event identifiers corresponding to the abnormal events are sorted to generate the abnormal event sequence.

4. The fault prediction method according to claim 3, wherein the step of sorting the event identifiers corresponding to the abnormal events according to the abnormal occurrence time of the abnormal information to generate the abnormal event sequence comprises: According to the abnormal occurrence time corresponding to the abnormal event, the event identifiers corresponding to the abnormal event are sorted using a preset sorting rule, and an abnormal event sequence is generated according to the sorted event identifiers.

5. The fault prediction method according to claim 1, wherein the acquiring of the abnormality log data of the service processing unit comprises: acquiring initial abnormality log data of the service processing unit, wherein: The initial exception log data includes initial exception information and an exception occurrence time corresponding to the initial exception information; sorting the initial exception log data using a preset sorting rule according to the exception occurrence time corresponding to the initial exception information to obtain sorted initial exception log data; The sorted initial abnormal log data is sampled according to a sampling time interval and a sampling time length to obtain the abnormal log data.

6. The fault prediction method according to claim 1, wherein the fault prediction model is used according to the abnormal event sequence. type, determining a fault prediction result of the service processing unit, comprising: The abnormal event sequence is input into a fault prediction model to obtain a confidence level output by the fault prediction model, and a fault prediction result of whether the service processing unit has experienced a downtime is determined based on the confidence level and a preset confidence threshold.

7. A fault prediction model training method, applied to a cloud computing system, the cloud computing system including a service processing unit, the method comprising: Obtaining sample abnormality log data of the service processing unit; Determining a sample abnormal event sequence according to the sample abnormal log data; Determining an initial positive sample abnormal event sequence and a negative sample abnormal event sequence according to the sample abnormal event sequence, and performing data enhancement on the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence; The initial positive sample abnormal event sequence and the enhanced positive sample abnormal event sequence are used as positive samples, and the negative sample abnormal event sequence is used as negative samples. A fault prediction model is trained based on the positive samples, the sample labels corresponding to the positive samples, the negative samples, and the sample labels corresponding to the negative samples.

8. The fault prediction model training method according to claim 7, wherein determining an initial positive sample abnormal event sequence and a negative sample abnormal event sequence based on the sample abnormal event sequence comprises: Determining the initial positive sample abnormal event sequence from the sample abnormal event sequence according to a preset sampling time and a preset sampling length; According to a preset negative sample sampling rule, the negative sample abnormal event sequence is determined from the sample abnormal event sequence.

9. The fault prediction model training method according to claim 7, wherein the step of performing data enhancement on the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence comprises: Determine a data enhancement operator, perform data enhancement on the initial positive sample abnormal event sequence according to the data enhancement operator to obtain an enhanced positive sample abnormal event sequence, The initial positive sample abnormal event sequence includes multiple initial positive sample abnormal events, and the data enhancement operator includes a first data enhancement operator based on contextual relationship and / or a second data enhancement operator based on word importance.

10. The fault prediction model training method according to claim 9, wherein, when the data enhancement operator includes the first data enhancement operator, performing data enhancement on the initial positive sample abnormal event sequence according to the data enhancement operator to obtain an enhanced positive sample abnormal event sequence comprises: Determining a preset combination length, combining the multiple initial positive sample abnormal events according to the preset combination length to determine multiple sample abnormal event combinations, wherein the number of initial positive sample abnormal events included in each sample abnormal event combination is consistent with the preset combination length; counting the occurrence frequencies of each sample abnormal event combination, and determining a frequency relationship matrix of the multiple sample abnormal event combinations based on the occurrence frequencies; determining, from the multiple initial positive sample abnormal events, a target sample abnormal event whose occurrence frequency is greater than a preset number threshold; and performing first data enhancement on the initial positive sample abnormal event sequence according to the first data enhancement operator, the frequency relationship matrix, and the target sample abnormal event to obtain an enhanced positive sample abnormal event sequence.

11. The fault prediction model training method according to claim 10, wherein the first data enhancement operator includes inserting data data augmentation operators and / or replacement data augmentation operators.

12. The fault prediction model training method according to claim 11, wherein when the first data enhancement operator includes an insertion data enhancement operator, performing data enhancement on the initial positive sample abnormal event sequence based on the first data enhancement operator and the frequency relationship matrix to obtain an enhanced positive sample abnormal event sequence comprises: Based on the insertion data enhancement operator and the occurrence frequency of the target sample abnormal event combination in the frequency relationship matrix, the neighboring sample abnormal events of the target sample abnormal event and the insertion position of the neighboring sample abnormal events are determined, wherein the target sample abnormal event combination is a sample abnormal event combination associated with the target sample abnormal event; and based on the insertion position of the neighboring sample abnormal events, the neighboring sample abnormal events are inserted into the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence.

13. The fault prediction model training method according to claim 12, wherein determining the neighboring sample abnormal events of the target sample abnormal event and the insertion position of the neighboring sample abnormal events based on the inserted data enhancement operator and the occurrence frequency of the target sample abnormal event combination in the frequency relationship matrix comprises: According to the target sample abnormal event, determining at least two target sample abnormal event combinations associated with the target sample abnormal event from the sample abnormal event combinations; Determining an initial neighboring sample abnormal event based on the combination of the at least two target sample abnormal events; Determine a sample abnormal event combination associated with the initial neighboring sample abnormal event and its frequency of occurrence relative to the combination of at least two target sample abnormal events; and determine a neighboring sample abnormal event of the target sample abnormal event and an insertion position of the neighboring sample abnormal event based on the frequency of occurrence and the initial neighboring sample abnormal event.

14. The fault prediction model training method according to claim 11, wherein when the first data enhancement operator includes a replacement data enhancement operator, performing data enhancement on the initial positive sample abnormal event sequence based on the first data enhancement operator and the frequency relationship matrix to obtain an enhanced positive sample abnormal event sequence comprises: Determining the similarity of each sample abnormal event combination according to the replacement data enhancement operator and the frequency relationship matrix; Determine, based on the similarity of the combinations of the sample abnormal events, similar sample abnormal events to the target sample abnormal events; and replace the target sample abnormal events in the initial positive sample abnormal event sequence based on the similar sample abnormal events to obtain an enhanced positive sample abnormal event sequence.

15. The fault prediction model training method according to claim 9, wherein when the data enhancement operator includes the second data enhancement operator, performing data enhancement on the initial positive sample abnormal event sequence according to the data enhancement operator to obtain an enhanced positive sample abnormal event sequence comprises: Determining the importance of each initial positive sample abnormal event in the initial positive sample abnormal event sequence according to each abnormal event in the abnormal event importance database and the importance corresponding to each abnormal event; According to the second data enhancement operator and the importance of each initial positive sample abnormal event, data enhancement is performed on the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence.

16. The fault prediction model training method according to claim 15, wherein the service processing unit comprises a plurality of; Before determining the importance of each initial positive sample abnormal event in the initial positive sample abnormal event sequence according to each abnormal event in the abnormal event importance database and the importance corresponding to each abnormal event, the method further includes: Acquire a plurality of historical abnormal log data of each service processing unit within a preset time period; Determining a plurality of historical sample abnormal events according to the plurality of historical abnormal log data; Determining the importance of each historical sample abnormal event relative to the plurality of historical sample abnormal events according to a preset abnormal event importance algorithm; An abnormal event importance database is established based on the association between the historical sample abnormal events and the importance levels corresponding to the historical sample abnormal events.

17. The fault prediction model training method according to claim 15, wherein the second data enhancement operator comprises an occlusion data enhancement operator, and / or a cropping data enhancement operator, and / or a reordering data enhancement operator.

18. The fault prediction model training method according to claim 17, wherein when the second data enhancement operator includes an occlusion data enhancement operator, performing data enhancement on the initial positive sample abnormal event sequence based on the second data enhancement operator and the importance of each initial positive sample abnormal event to obtain an enhanced positive sample abnormal event sequence comprises: Determining, according to the occlusion data enhancement operator, a correlation between the importance of each of the initial positive sample abnormal events and a preset first importance threshold, and determining the initial positive sample abnormal events to be occluded; Occlusion processing is performed on the to-be-occluded initial positive sample abnormal event in the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence.

19. The fault prediction model training method according to claim 17, wherein when the second data enhancement operator includes a pruning data enhancement operator, performing data enhancement on the initial positive sample abnormal event sequence based on the second data enhancement operator and the importance of each initial positive sample abnormal event to obtain an enhanced positive sample abnormal event sequence comprises: Determining, according to the clipping data enhancement operator, a correlation between the importance of each of the initial positive sample abnormal events and a preset second importance threshold, and determining the initial positive sample abnormal events to be clipped; The initial positive sample abnormal events to be cropped in the initial positive sample abnormal event sequence are cropped to obtain an enhanced positive sample abnormal event sequence.

20. The fault prediction model training method according to claim 19, wherein when the data enhancement operator further includes a reordering data enhancement operator, the step of performing a trimming process on the to-be-trimmed initial positive sample abnormal event sequence in the initial positive sample abnormal event sequence to obtain an enhanced positive sample abnormal event sequence comprises: According to the initial positive sample abnormal events to be trimmed, trimming the initial positive sample abnormal event sequence to obtain an initial positive sample abnormal event subsequence; The initial positive sample abnormal event subsequence is reordered according to the reordering data enhancement operator to obtain an enhanced positive sample abnormal event sequence.

21. A computing device comprising: memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions.

32. The computer program / instruction, when executed by a processor, implements the steps of the fault prediction method according to any one of claims 1 to 6 or the fault prediction model training method according to any one of claims 7 to 20.

22. A computer-readable storage medium storing a computer program / instruction, wherein the computer program / instruction, when executed by a processor, implements the steps of the fault prediction method according to any one of claims 1 to 6 or the fault prediction model training method according to any one of claims 7 to 20.

23. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the fault prediction method according to any one of claims 1 to 6 or the fault prediction model training method according to any one of claims 7 to 20.

Images