Method and system for identifying abnormal link data, and abnormality prompt page

Abstract

Provided in the embodiments of the present disclosure are a method for identifying abnormal link data, and an abnormality prompt page, a computing device, a computer-readable storage medium and a computer program product. The method for identifying abnormal link data comprises: acquiring a plurality of pieces of link data generated by at least one service node; performing bucketing on the plurality of pieces of link data according to a plurality of data ranges, so as to obtain a plurality of data buckets; and on the basis of the data ranges respectively corresponding to the plurality of data buckets, generating a display diagram, wherein the display diagram is used for determining an abnormal data bucket from among the plurality of data buckets, and determining link data in the abnormal data bucket to be abnormal data. The technical solution provided in the embodiments of the present disclosure can reduce the amount of data that needs to be processed, thereby reducing the display cost.

Description

[0001] The application relates to the technical field of data visualization, in particular to an abnormal link data identification method, an abnormal prompt page, an abnormal link data identification system, a computing device, a computer storage medium, a computer program product and a computer program product. Background technology Trace data can be used to record processing data within a single request range of a system, which includes data such as service calls and processing time. With the increase in the complexity of the system, for example, the popularity of microservice architecture, communication between each microservice can generate a link data; for another example, with the increase in the number of users and the system load, the number of requests processed by the system also increases, and a large amount of link data is also generated. In the related art, a scatter plot is usually used to display link data, and each link data corresponds to a data point in the scatter plot. The inventors have found that, in the scatter plot, each data point represents a link data, and displaying all the link data in the scatter plot requires processing a large amount of data, which is costly. Invention content The application provides an abnormal link data identification method, an abnormal prompt page, a computing device, a computer readable storage medium, a computer program product. In a first aspect, the application provides an abnormal link data identification method, which comprises: obtaining a plurality of link data generated by at least one service node; performing bucketing on the plurality of link data according to a plurality of data ranges to obtain a plurality of data buckets, wherein the plurality of data ranges are determined based on index data values of the plurality of link data; generating a display graph based on the data ranges corresponding to the plurality of data buckets respectively, the display graph is used to determine an abnormal data bucket from the plurality of data buckets, and link data in the abnormal data bucket is determined as abnormal data. In a second aspect, the application provides an abnormal prompt page, which comprises a selection control configured to determine an abnormal data bucket from a display graph displayed on the abnormal prompt page in response to a selection instruction; wherein the display graph is generated by the abnormal link data identification method provided by the application.In a third aspect, the disclosure provides an abnormal link data identification system, including: a probe configured to obtain a plurality of link data generated by at least one service node; a processor configured to: perform bucketing on the plurality of link data obtained by the probe according to a plurality of data ranges, to obtain a plurality of data buckets, wherein the plurality of data ranges are determined based on index data values of the plurality of link data; generate a display graph based on the respective data ranges of the plurality of data buckets, to determine an abnormal data bucket from the plurality of data buckets, and determine link data in the abnormal data bucket as abnormal link data. In a fourth aspect, the disclosure provides an abnormality identification apparatus, including: a first obtaining module configured to obtain a plurality of link data; a bucketing module configured to perform bucketing on the plurality of link data according to a plurality of data ranges, to obtain a plurality of data buckets; a display module configured to visually display the plurality of data buckets according to the respective data ranges of the plurality of data buckets, to generate a display graph; the display graph is used to determine an abnormal data bucket from the plurality of data buckets, and determine link data in the abnormal data bucket as abnormal data. In a fifth aspect, the disclosure provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component, to implement the abnormal link data identification method provided by the disclosure. In a sixth aspect, the disclosure provides a computer-readable storage medium, which stores a computer program; when the computer program is executed by a processing component, the abnormal link data identification method provided by the disclosure is implemented. In a seventh aspect, the disclosure provides a computer program product, including computer programs / instructions; when the computer programs / instructions are executed by a processing component, the abnormal link data identification method provided by the disclosure is implemented. In the disclosure, a plurality of link data generated by at least one service node is obtained, the plurality of link data is bucketed according to a plurality of data ranges, to obtain a plurality of data buckets, wherein the plurality of data ranges are determined based on index data values of the plurality of link data, a display graph is generated based on the respective data ranges of the plurality of data buckets; the display graph is used to determine an abnormal data bucket from the plurality of data buckets, and determine link data in the abnormal data bucket as abnormal link data. Since a data bucket can include a plurality of link data, the number of data buckets is less than the number of link data, so that when the plurality of link data is displayed in units of data buckets instead of individual link data, the amount of data to be processed can be reduced, and the display cost can be reduced.Aspects of the present disclosure are more fully described in the following description of embodiments. Description of Drawings In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings needed in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present disclosure, and for those skilled in the art, other drawings can also be obtained from these drawings without creative effort. FIG. 1 schematically shows a schematic diagram of an abnormal link data identification method provided by an embodiment of the present disclosure; FIG. 2 schematically shows a schematic diagram of generating a data bucket; FIG. 3 schematically shows a schematic diagram of generating a display graph provided by an embodiment of the present disclosure; FIG. 4 schematically shows a schematic diagram of a data table provided by an embodiment of the present disclosure; and FIG. 5 shows a block diagram of an abnormality identification device provided by the present disclosure. Specific implementation In order for those skilled in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be described clearly and completely in the following with reference to the drawings in the embodiments of the present disclosure. In some processes described in the specification and claims of the present disclosure and the above drawings, a plurality of operations appearing in a specific order are included, but it should be clearly understood that these operations can be executed or in parallel without the order appearing in the present disclosure. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes can include more or fewer operations, and the operations can be executed in sequence or in parallel. It should be noted that the descriptions of “first”, “second”, etc. in the present disclosure are used to distinguish different messages, devices, modules, etc., and do not represent the order of sequence, nor do “first” and “second” represent different types. In order to facilitate understanding of the technical solutions of the present disclosure, the following first explains the technical terms that can be involved in the present disclosure: A distributed tracing system is a system for monitoring and debugging request flows in a distributed computing environment. It can track the path of a single request between multiple service nodes, collect and record the processing information of each service node. The system helps developers and operation and maintenance personnel to locate performance bottlenecks, detect errors and optimize system performance by generating and analyzing request link data. A service node is a node that provides specific services or functions in a computer network or distributed system. The service node can be a server, a computing device or other devices in the network, responsible for performing specific service tasks or functions, such as data processing, storage, communication, routing, etc.Service nodes work together in the system to ensure efficient operation and reliability of services. Agents are small programs or code snippets used in distributed link tracing systems to collect data and monitor information. Agents are embedded in the code of applications and are responsible for capturing request flows, generating spans, and sending data to the tracing system. Agents can be automatically or manually deployed on different service nodes, providing real-time system status and performance data.

[0002] Trace (link data) is a key concept in distributed link tracing systems, referring to the complete path of a single request from start to finish throughout its entire lifecycle across various service nodes in the system. A Trace is composed of multiple Spans, each representing an independent unit of work or service call within the Trace. Traces help developers understand the flow of requests throughout the system.

[0003] Dimensional characteristics of a Trace refer to various attributes and indicators that describe Trace data, used for analyzing and monitoring system performance. These dimensional characteristics may include:

[0004] Trace ID (a globally unique identifier for tracing requests or transactions): uniquely identifies a Trace Start time and end time: records the start and end times of the request Service name: the name of the service node involved in processing the request.

[0005] Span ID: A unique identifier for each Span in a Trace. Duration: The execution time of each Span. Status Code: The result status of the request processing (e.g., success or failure). Tags / Attributes: Custom key-value pairs that record additional context information, such as request type, user ID, etc. These dimensions help operations and development teams gain insights into system performance and request behavior, enabling performance optimization and troubleshooting. Display Graphs in distributed link tracing systems refer to visual charts or graphs that display Trace data. Through these visualization tools, users can intuitively understand the system's running state and issues. Bucketing: Bucketing is a data organization method commonly used in database management and data analysis, aiming to improve query efficiency and facilitate data management. The basic idea is to divide a dataset into multiple small, logically continuous "buckets" (or "groups," "intervals"), each containing a portion of data records. Bucketing can be performed based on certain rules, such as value ranges of a certain field, hash values, etc. It should be noted that the embodiments of the present disclosure may involve the use of user data. In actual applications, user-specific personal data can be used in the schemes described herein within the scope permitted by applicable laws and regulations (e.g., with the explicit consent of the user, adequate notification to the user, etc.). It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with relevant laws, regulations, and standards in relevant countries and regions, and provide appropriate operation portals for users to choose authorization or refusal. It should be noted that the technical solutions of the embodiments of the present disclosure are applicable to a network virtual environment, and the described users generally refer to "virtual users." Real users can register user accounts on the server side through registration to obtain user identities in the network environment. In the embodiments of the present disclosure, the same user account can be logged into the server through different types of clients, so that the server can identify the same user. Of course, different user accounts can also be logged into the server through different types of clients, and the server stores the binding relationship of different user accounts, so that different user accounts with a binding relationship can be considered as the same user.The technical solutions in the embodiments of the present disclosure will be clearly and completely described in combination with the drawings in the embodiments of the present disclosure. Apparently, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present disclosure. FIG. 1 schematically shows a schematic diagram of an abnormal link data identification method provided by one embodiment of the present disclosure. As shown in FIG. 1, the abnormal link data identification method can specifically include the following steps.

[0006] 101: Obtain a plurality of link data generated by at least one service node. The link data can be composed of a plurality of span data, the plurality of span data can have the same call identifier, and the span data can be generated at the corresponding service node respectively, and then obtained by a probe deployed in the service node. After the probe obtains the span data, the span data can be converged to an execution end of an embodiment of the present disclosure, for example, a processor of a distributed link tracking system. After the processor of the distributed link tracking system receives the span data sent by the probe, a plurality of span data with the same call identifier can be generated to obtain link data.

[0007] 102: Perform bucketing on the plurality of link data according to a plurality of data ranges to obtain a plurality of data buckets, wherein the plurality of data ranges are determined based on index data values of the plurality of link data. Each link data can have its own index data value. In one embodiment of the present disclosure, the plurality of data ranges can be obtained by dividing the index data values of the plurality of link data. In another embodiment of the present disclosure, the plurality of data ranges can be predefined data ranges. The data bucket can be an abstract data collection for storing link data. The plurality of data buckets can correspond to the plurality of data ranges one by one, and each data range corresponds to at least one data bucket. The number of data buckets is less than the number of link data. At least one data bucket can be used to store a plurality of link data.

[0008] 103 : Based on the respective data ranges corresponding to the plurality of data buckets, a display graph is generated; the display graph is used to determine an abnormal data bucket from the plurality of data buckets, and determine the link data in the abnormal data bucket as abnormal link data. After the plurality of data buckets are generated, the plurality of link data can be displayed in units of data buckets instead of individual link data, and the display graph is generated. Since the data bucket can include a plurality of link data, the number of data buckets is less than the number of link data, so that when the plurality of link data is displayed in units of data buckets instead of individual link data, the amount of data to be processed can be reduced, and the display cost can be reduced. The inventors have found in the process of implementing the present concept that the abnormality of link data can often be reflected in the index data value of the link data. For example, when the link data is request response time, the abnormality of the link data may, for example, be slow response time, and the index data value reflected in the index data value may, for example, be higher than the index data value of other link data. Since the link data is divided into the corresponding data bucket according to the index data value, and the plurality of link data is displayed in units of data buckets in the display graph, the data bucket used to store the abnormal link data may deviate from other data buckets in the display graph, so that the data bucket deviating from other data buckets can be determined as an abnormal data bucket, and the link data in the abnormal data bucket can be determined as abnormal link data. In some embodiments, the plurality of link data is divided into a plurality of data buckets according to a plurality of data ranges, which can be implemented as follows: the plurality of link data is divided into corresponding data ranges, and a plurality of data buckets corresponding to the plurality of data ranges are generated. The plurality of data ranges can be equal in width, and the data processing process can be simplified by setting equal-width data ranges. However, the widths of the plurality of data ranges can also be different, and unequal-width data ranges can be more flexible in adapting to the actual distribution of data, which helps to accurately identify the abnormality of link data. After the plurality of data ranges are determined, the plurality of link data can be divided into corresponding data ranges according to the respective index data values, and data buckets are formed. Each data bucket can represent a data range, and include all link data whose index data values fall within the range. FIG. 2 schematically shows a schematic diagram of generating data buckets.As shown in FIG. 2, 201 can represent a time axis, and a plurality of link data are scattered on the time axis 201. The index data value of link data 1 is 983, the index data value of link data 2 is 999, the index data value of link data 3 is 1021, the index data value of link data 4 is 1033, the index data value of link data 5 is 1055, the index data value of link data 6 is 1058, the index data value of link data 7 is 1061, and the index data value of link data 8 is 2500. Based on the index data values of the plurality of link data, data range 1, data range 2, and data range 3 can be generated, wherein the data range 1 is 980-1020, the data range 2 is 1021-1061, and the data range 3 can be 2000-2501. oAccording to the index data value, link data 1, link data 2 and link data 3 can be divided into data range 1 to form data bucket 1; link data 4, link data 5, link data 6 and link data 7 can be divided into data range 2 to form data bucket 2; and link data 8 can be divided into data range 3 to form data bucket 3. In the above diagram, eight link data are taken as an example, and in this example, the eight link data can be compressed into three data buckets, so that only three data buckets can be displayed on the display diagram, which reduces the data processing amount by 5 units compared with the eight link data displayed in units of link data. However, in actual application, a large amount of link data is often generated, and accordingly, the method for identifying abnormal link data provided in the embodiments of the present disclosure can greatly reduce the amount of data to be processed, reduce the display cost, and improve the efficiency of abnormal identification. In some embodiments, obtaining the plurality of link data can be specifically implemented as: obtaining generation times of the plurality of link data. The plurality of link data can include link data generated in a target time interval. The target time interval can be a time period specified by a user or preset by a system for which abnormal analysis is required. For example, a specific time period or a time period before and after an event. For example, the target time interval can be set as 2024-06-01 00:00 to 2024-06-01 00:05. The length of the target time interval can be flexibly set by a person skilled in the art according to the application requirements of the time. When obtaining the link data, the generation time of each link data can be recorded, and the generation time can be determined by obtaining the timestamp of the link data. In some embodiments, the plurality of data buckets are visually displayed according to the data ranges corresponding to the data buckets, and generating the display diagram can be specifically implemented as: constructing a coordinate system with the generation time of the link data as a first coordinate axis and the index data value as a second coordinate axis; in the coordinate system, according to the time range and the data range corresponding to any data bucket, a block corresponding to the data bucket is drawn; obtaining the data quantity of the link data contained in the data bucket; determining the display mode of the block corresponding to the data bucket based on the data quantity, and displaying the block in the display diagram according to the determined display mode to generate the display diagram. The first coordinate axis can be a horizontal axis, and the second coordinate axis can be a vertical axis, but is not limited thereto. The first coordinate axis can be a vertical axis, and the second coordinate axis can be a horizontal axis. The generation time can include the generation time of the index data value. The time range can correspond to the target time interval. FIG. 3 schematically shows a schematic diagram of generating a display diagram provided in an embodiment of the present disclosure.The following is illustrated by taking the data bucket generated for FIG. 2 as an example. As shown in FIG. 3, the coordinate system can be constructed with the generation time as the horizontal axis and the indicator data value as the vertical axis. For example, the link data shown in FIG. 2 are all generated in the target time interval, so the data bucket 1, data bucket 2, data bucket 3, data bucket 4, data bucket 5, data bucket 6, data bucket 7, data bucket 8, data bucket 9, and data bucket 10 are generated at different times. Firstly, a tile corresponding to data bucket 1 can be plotted on a coordinate system with % as the horizontal coordinate and 980-1020 as the vertical coordinate. Then, a tile corresponding to data bucket 2 can be plotted on the coordinate system with % as the horizontal coordinate and 1021-1061 as the vertical coordinate. Then, a tile corresponding to data bucket 3 can be plotted on the coordinate system with % as the horizontal coordinate and 2000-2501 as the vertical coordinate. In an embodiment of the present disclosure, the number of data in the link data contained in each data bucket can also be obtained; based on the number of data, the display mode of the tile corresponding to each data bucket is determined, and the tile is displayed in the display diagram in the determined display mode, to generate the display diagram. In an embodiment of the present disclosure, tiles containing different numbers of data can have different display modes. The display mode may, for example, include display color, tile shape, tile border thickness, and the like. For example, the display color of the tile can become darker as the number of data contained increases. By setting different display modes for tiles containing different numbers of data, the readability of the display diagram can be improved, helping users quickly identify the differences between different tiles and improving the efficiency of identifying abnormal link data. In some embodiments, in the display diagram, determining the abnormal data bucket from the plurality of data buckets can be implemented as follows: determining the distance between any tile and an adjacent tile in the second coordinate axis direction; determining an abnormal tile based on the distance; and determining the data bucket corresponding to the abnormal tile as the abnormal data bucket. In an embodiment of the present disclosure, a tile that deviates significantly from other tiles can be determined as an abnormal tile. Whether a tile deviates from other tiles can be reflected by the distance between any tile and an adjacent tile in the second coordinate axis direction. For example, in the above FIG. 3, the distance between tile 2 and tile 1 is close, the distance between tile 3 and tile 2 is far, and tile 3 deviates significantly from tile 1 and tile 2, so that the data bucket 3 corresponding to tile 3 can be determined as an abnormal data bucket, and the link data contained in data bucket 3 can be determined as abnormal link data. The above distance can be the distance between a tile and a vertically adjacent tile. In a possible implementation manner, the distance between any tile and an adjacent tile below the tile can be determined as the distance value of the tile. In particular, for a tile closest to the first coordinate axis, the distance value of the tile can be configured as 0. In some embodiments, the abnormal tile can be determined based on the distance as follows: aggregating a plurality of tiles with a distance less than a preset threshold to generate at least one tile cluster; generating at least one tile cluster based on the distance, the tile cluster including a plurality of tiles with a distance less than a preset threshold; and determining a tile not belonging to any tile cluster as the abnormal tile.If distances of multiple tiles are all less than the preset threshold, it can be indicated that distances between each two tiles in the multiple tiles are relatively close, and then the multiple tiles can be generated into a tile cluster. As shown in FIG. 3, the distance between tile 2 and tile 1 is relatively close, and the distance between tile 3 and tile 1 is relatively far, and then tile 1 and tile 2 can be generated into a tile cluster. In another embodiment of the present disclosure, in the second coordinate axis direction, a tile often has two adjacent tiles, that is, a tile below and a tile above. Then the distance between any tile and the adjacent tile in the second coordinate axis direction can have a first distance and a second distance, wherein the first distance can be the distance between the tile and the tile below, and the second distance can be the distance between the tile and the tile above. The determining of the abnormal tile based on the distance can also be implemented as follows: aggregating multiple tiles with at least one distance less than the preset threshold to generate at least one tile cluster; and determining a tile not belonging to any tile cluster as an abnormal tile. In the above FIG. 3, for tile 2, tile 1 is the tile below tile 2, the distance between tile 2 and tile 1 is the first distance, tile 3 is the tile above tile 2, and the distance between tile 2 and tile 3 is the second distance. Assuming that the first distance is less than the preset threshold, and the second distance is greater than the preset threshold, the distance of tile 1 is 0, which is less than the preset threshold, and then tile 1 and tile 2 can be aggregated to generate a tile cluster, and then tile 3 not in the tile cluster can be determined as an abnormal tile. In some embodiments, in the display graph, the determining of the abnormal data bucket from the multiple data buckets can be implemented as follows: receiving a selection instruction, the selection instruction being triggered for any tile in the display graph; determining an abnormal tile selected by the selection instruction; and determining a data bucket corresponding to the abnormal tile as an abnormal data bucket. The selection instruction can be realized through clicking or selecting operation on the user interface. When a user views the display graph on the graphical interface, the user can click or select any tile to generate a selection instruction for the tile. In response to the selection instruction, the user-selected tile can be determined, and the user-selected tile can be marked as an abnormal tile, which means that the user considers that the data bucket corresponding to the tile is abnormal. In the embodiment of the present disclosure, the abnormal tile can be specified by the user, so that the tile specified by the user can be determined as an abnormal tile, and the flexibility of abnormal link data identification is improved.In some embodiments, the method for identifying abnormal link data further comprises: receiving a timestamp selection instruction, the timestamp selection instruction triggering for a first coordinate axis of a coordinate system; in response to the timestamp selection instruction, determining a selected timestamp corresponding to a tile on a second coordinate axis, and determining a data range of the tile and a data amount contained therein; generating a tile display area in a display graph, and displaying the data range of each tile displayed on the second coordinate axis and the data amount contained therein selected by the timestamp selection instruction on the tile display area. A user can select one or more timestamps on the first coordinate axis of the coordinate system, and this selection operation can generate a corresponding timestamp selection instruction to inform the system which time point or time period is selected by the user. In response to the timestamp selection instruction, the selected timestamp is analyzed, and a plurality of tiles corresponding to the selected timestamp on the second coordinate axis are determined. Further, all tiles corresponding to the selected timestamp on the second coordinate axis can be identified, each tile can represent a specific data range and a data amount contained therein, and then a tile display area can be created in a display graph to display detailed information of the tile at the selected timestamp. By displaying the data range of each tile displayed on the second coordinate axis and the data amount contained therein selected by the timestamp selection instruction on the tile display area, the distribution of link data corresponding to the timestamp can be viewed, so that the user can intuitively understand the detailed information of the tile at the selected timestamp. In some embodiments, determining a plurality of data ranges based on a plurality of link data indicator data values can be implemented as follows: determining a maximum value and a minimum value of the indicator data values in the plurality of link data; obtaining a precision requirement parameter, the precision requirement parameter being used to indicate a deviation precision between any two link data in a data bucket; determining a number of required data ranges based on a difference between the maximum value and the minimum value and the precision requirement parameter, and numbering each data range; and determining a boundary value of each data range based on the number of each data range. The maximum value and the minimum value of the indicator data values can be determined by traversing all the obtained link data and comparing the indicator data values of each link data. In a possible implementation, all the link data can be collected in a data structure, such as a list or a dictionary. Before traversing the link data, the maximum value and the minimum value variables can be initialized, where the maximum value can be initialized as a small value, such as negative infinity, and the minimum value can be initialized as a large value, such as positive infinity. Then, the indicator data values of each link data can be checked one by one, and the maximum value and the minimum value can be compared and updated. After traversing all the link data, the maximum value and the minimum value saved in the maximum value and the minimum value variables are the maximum value and the minimum value of the indicator data values. The precision requirement parameter can be set by the user.By calculating the maximum and minimum values of the index data values in the link data, and determining the data range according to the accuracy requirement parameter, each data range will be numbered and its boundary value will be determined, which is helpful for the bucket processing of the link data, so as to facilitate further analysis and operation. In some embodiments, based on the number of each data range, the determination of the boundary value of each data range can be implemented as follows: based on the accuracy requirement parameter, a boundary parameter is determined, which is used to calculate the boundary value of the data range; according to the boundary parameter and the number of each data range, the boundary value of each data range is determined. Wherein, a plurality of link data can be sorted according to the index data value, and the index data is determined from the sorting result. The body can be implemented as follows: determining a first parameter and a second parameter based on the number of the data range; calculating the maximum boundary value based on the first parameter and the boundary parameter; calculating the minimum boundary value based on the second parameter and the boundary parameter. The number of the data range can be i, and the data value range of the data range can be Y i ~ 1 < x < Y iwherein x can represent an index data value. Wherein i can represent a number, and i can be directly determined as a first parameter, i-1 can represent a second parameter. The boundary minimum value can be t, and the boundary maximum value can be T. In some embodiments, each link data comprises at least one dimension feature. Wherein the dimension feature refers to various attributes and indicators describing the Trace data. In embodiments of the present disclosure, after determining the abnormal link data in the display graph, there is often also a need to locate the root cause of the abnormal link data, that is, to determine which dimension feature among the multiple dimension features of the abnormal link data causes the abnormal link data. In some embodiments, the method for identifying abnormal link data further comprises: determining a target dimension feature causing the abnormality from the multiple dimension features of the abnormal link data; and outputting the target dimension feature. By determining the target dimension feature causing the abnormality from the multiple dimension features of the abnormal link data, it can be found out which dimension feature contributes most to the abnormality of the link data. Wherein the target dimension feature can be output to a console, or the target dimension feature can be saved to a file, such as CSV (Comma-Separated Values), Excel (electronic spreadsheet software), or JSON (JavaScript Object Notation), for subsequent processing and analysis; The target dimension feature can also be displayed in a chart visualization manner, making the result more intuitive. In some embodiments, determining a target dimension feature causing the abnormality from the multiple dimension features of the abnormal link data can be specifically implemented as: determining link data other than the abnormal link data as baseline link data; determining a first number of times that the multiple dimension features appear in the abnormal link data, and a second number of times that the multiple dimension features appear in the baseline link data; and determining the target dimension feature based on the first number and the second number. In embodiments of the present disclosure, the baseline link data can be regarded as a normal reference point, and the abnormal link data is the object to be analyzed. Abnormality can mean a significant deviation from normal. The number of times that a dimension feature appears in the abnormal link data and the baseline link data can reflect the distribution pattern of the dimension feature in the baseline link data and the abnormal link data. If the number of times that a dimension feature appears in the abnormal link data deviates significantly from the number of times that the dimension feature appears in the baseline link data, it can mean that the dimension feature is associated with the abnormality of the link data. Wherein the first number and the second number can be the number of times that a same dimension feature appears in the baseline link data and the abnormal link data.By counting the number of times of each dimension feature in the abnormal link data and the benchmark link data, it can be accurately identified which dimension feature frequently appears in the abnormal link data, so as to more intuitively determine the dimension feature causing the abnormality. In some embodiments, determining the target dimension feature based on the first number and the second number can be implemented as follows: determining the difference between the first number and the second number of each dimension feature in turn; and determining the dimension feature with a difference greater than a preset threshold as the target dimension feature. The specific value of the preset threshold can be flexibly set by a person skilled in the art based on actual application requirements. If the difference is greater than the preset threshold, it can be indicated that the frequency of a certain dimension feature appearing in the abnormal link data is significantly deviated from the frequency of the dimension feature appearing in the benchmark link data, and then the dimension feature can be the target dimension feature causing the abnormality of the link. In the embodiments of the present disclosure, further, after the first number and the second number are determined, the first ratio and the second ratio can also be calculated, wherein the first ratio can be the ratio of the first number of a certain dimension feature appearing in the abnormal link data to the total number of the abnormal link data, and the second ratio can be the ratio of the first number of the certain dimension feature appearing in the benchmark link data to the total number of the benchmark link data. After the first ratio and the second ratio are calculated, the target dimension feature can also be determined according to the difference between the first ratio and the second ratio. For example, the dimension feature with a difference between the first ratio and the second ratio greater than a preset threshold can be determined as the target dimension feature. In actual application, a large amount of link data is often collected. If all the link data except the abnormal link data is taken as the benchmark link data, the number of the benchmark link data will be large, and the amount of data to be processed in the comparison of the dimension features will also be large, resulting in a low processing efficiency. In some embodiments, determining the link data except the abnormal link data as the benchmark link data can be implemented as follows: down-sampling the first number of link data except the abnormal link data to obtain the second number of link data; and taking the second number of link data as the benchmark link data. The second number can be less than the first number. By down-sampling the link data, the number of the benchmark link data can be reduced, so that the resource consumption of calculation and storage can be reduced, the efficiency of data processing can be improved, and meanwhile, the representativeness of the link data can be maintained. The inventors have found in the implementation of the present concept that a data bucket can include a large amount of link data, so as to map a large number of dimension features. In order to improve the efficiency of data processing, the link data contained in each data bucket can be down-sampled respectively, so that only a predetermined number of dimension features are retained in each data bucket, and in the process of down-sampling, the probability of retaining each dimension feature needs to be equal.In some embodiments, the downsampling of the first quantity of link data to obtain the second quantity of link data can be implemented as follows: determining data buckets to which the second quantity of link data respectively belongs; and downsampling the second quantity of link data to obtain a third quantity of link data, with the requirement that each data bucket includes only a predetermined quantity of dimension features. When downsampling the link data, an empty reservoir list can be created first, with the list length being k max, where k max can be the predetermined quantity. The dimension features in the data buckets are written into the reservoir list one by one, and the number of dimension features written into the reservoir list is recorded; when the number of dimensions written into the reservoir list is less than k max, the dimension features continue to be written into the reservoir list; when the number of dimensions written into the reservoir list is equal to k max, the dimension features in the reservoir list can be sampled and replaced. When sampling and replacing, a random number can be generated, with the range of the random number being 0-k max-l, and then the dimension feature corresponding to the random number in the reservoir list is replaced, until each dimension feature in the data bucket is traversed. In the above downsampling process, when k max is 1, for each dimension feature in the data bucket, after the first dimension feature is written into the reservoir list, the probability of replacing the dimension feature in the reservoir list for the same dimension feature in the data bucket is 1 / n, where n can represent the number of occurrences of the same dimension feature in the data bucket. When k max> 1, the first k max dimension features in the data bucket are written into the reservoir list first, and for the i th dimension feature, it is retained with a probability of 1 / (k max-i). When the i th dimension feature is retained, a random one of the k max-i+1 dimension features in the reservoir list can be randomly replaced. In some embodiments, the method for identifying abnormal link data further includes: generating a data table based on the first quantity and the second quantity, and the data table can compare the first quantity and the second quantity. FIG. 4 schematically shows a schematic diagram of a data table provided by an embodiment of the present disclosure. As shown in FIG. 4, the data table can display the first quantity and the second quantity in the form of a column chart, and the comparison of the first quantity and the second quantity by the data table can intuitively reflect the difference between the first quantity and the second quantity. It should be noted that the column chart shown in FIG. 4 is only one possible implementation of the data table, and the data table can also be implemented as a pie chart, a heat map, etc. In some embodiments, the obtaining of the link data set can be implemented as follows: receiving a graph generation instruction; and in response to the graph generation instruction, obtaining a plurality of link data, so as to generate the display graph based on the plurality of link data. The graph generation instruction can be generated and sent by a user or other systems.In some embodiments, the graph generation instruction can include identification information of a subject to be identified. The subject to be identified can refer to an object that needs to be identified and analyzed, such as a specific service node, a service object, a computer, a server, a network device, and the like. In response to the graph generation instruction, a plurality of link data of the subject to be identified can be obtained. By automatically processing the graph generation instruction and obtaining the plurality of link data, the required display graph can be quickly responded and generated, and the efficiency and response speed of the display graph generation can be improved. In some embodiments, in response to the abnormality identification instruction, the plurality of link data can be obtained based on the identification information. The present disclosure further provides an abnormality prompt page, which includes a selection control configured to determine an abnormal data bucket from a display graph displayed on the abnormality prompt page in response to a selection instruction. The display graph is generated by the abnormal link data identification method provided by the present disclosure. The generation process of the display graph can refer to the abnormal link data identification method shown in FIG. 1, which will not be repeated here. The present disclosure further provides an identification system for normal link data, which includes: a probe configured to obtain a plurality of link data generated by at least one service node; a processor configured to perform bucketing on the plurality of link data obtained by the probe according to a plurality of data ranges to obtain a plurality of data buckets, wherein the plurality of data ranges are determined based on index data values of the plurality of link data; and generate a display graph based on the data ranges corresponding to the plurality of data buckets respectively, wherein the display graph is used to determine an abnormal data bucket from the plurality of data buckets, and link data in the abnormal data bucket is determined as abnormal link data. The generation process of the display graph can refer to the abnormal link data identification method shown in FIG. 1, which will not be repeated here. FIG. 5 schematically shows a block diagram of an abnormality identification apparatus according to an embodiment of the present disclosure. As shown in FIG. 5, the abnormality identification apparatus can specifically include: a first obtaining module 501 configured to obtain a plurality of link data generated by at least one service node; a bucketing module 502 configured to perform bucketing on the plurality of link data according to a plurality of data ranges to obtain a plurality of data buckets, wherein the plurality of data ranges are determined based on index data values of the plurality of link data; and a display module 503 configured to generate a display graph based on the data ranges corresponding to the plurality of data buckets respectively, wherein the display graph is used to determine an abnormal data bucket from the plurality of data buckets, and link data in the abnormal data bucket is determined as abnormal link data.In some embodiments, the bucketing module is specifically configured to: divide the plurality of link data into corresponding data ranges according to the index data values, respectively, to generate a plurality of data buckets corresponding to the plurality of data ranges. In some embodiments, the first obtaining module is specifically configured to: obtain the generation time of the plurality of link data. In some embodiments, the displaying module is specifically configured to: construct a coordinate system with the generation time of the link data as a first coordinate axis and with the index data value as a second coordinate axis; in the coordinate system, draw a tile corresponding to any data bucket according to the time range and the data range corresponding to the data bucket; the second obtaining module is configured to obtain the data quantity of the link data contained in each data bucket; the display mode determining module is configured to determine the display mode of the tile corresponding to each data bucket based on the data quantity, and display the tile in the display graph in the determined display mode to generate a display graph. In some embodiments, the displaying module is specifically configured to: determine the distance between any tile and an adjacent tile in the direction of the second coordinate axis; determine an abnormal tile based on the distance; determine the data bucket corresponding to the abnormal tile as an abnormal data bucket. In some embodiments, the distance includes a first distance between any tile and an adjacent tile below and a second distance between any tile and an adjacent tile above; the displaying module is specifically configured to: aggregate a plurality of tiles in which at least one of the first distance and the second distance is less than a preset threshold to generate at least one tile cluster; determine a tile that does not belong to any tile cluster as the abnormal tile. In some embodiments, the displaying module is specifically configured to: receive a selection instruction triggered for any tile in the display graph; determine the abnormal tile selected by the selection instruction; determine the data bucket corresponding to the abnormal tile as an abnormal data bucket. In some embodiments, the abnormality identification apparatus further includes: a first receiving module configured to receive a timestamp selection instruction triggered for the first coordinate axis of the coordinate system; a responding module configured to determine the tile corresponding to the selected timestamp on the second coordinate axis and determine the data range and the data quantity contained in each tile in response to the timestamp selection instruction; a region generating module configured to generate a tile display region in the display graph, and display the data range and the data quantity contained in each tile displayed on the second coordinate axis by the timestamp selected by the timestamp selection instruction on the tile display region.In some embodiments, the bucketing module is specifically configured to: determine a maximum value and a minimum value of the indicator data values in the plurality of link data; obtain a precision requirement parameter, the precision requirement parameter being configured to indicate a precision of difference between any two link data in a data bucket; determine a number of data ranges required based on a difference between the maximum value and the minimum value and the precision requirement parameter, and number each data range; determine a boundary value of each data range based on the number of each data range. In some embodiments, the bucketing module is specifically configured to: determine a boundary parameter based on the precision requirement parameter, the boundary parameter being configured to calculate the boundary value of a data range; determine the boundary value of each data range according to the boundary parameter and the number of each data range. In some embodiments, the boundary value includes a boundary maximum value and a boundary minimum value. In some embodiments, the bucketing module is specifically configured to: determine a first boundary parameter and a second boundary parameter based on the boundary parameter; calculate the boundary maximum value based on the first boundary parameter and the number; calculate the boundary minimum value based on the second boundary parameter and the number. In some embodiments, each of the link data includes at least one dimension feature. In some embodiments, the anomaly identification device further includes: an attribution module configured to determine a target dimension feature causing the anomaly from a plurality of dimension features of the abnormal link data; and an output module configured to output the target dimension feature. In some embodiments, the attribution module is specifically configured to: determine link data other than the abnormal link data as reference link data; determine a first number of occurrences of the plurality of dimension features in the abnormal link data and a second number of occurrences of the plurality of dimension features in the reference link data; and determine the target dimension feature based on the first number and the second number. In some embodiments, the attribution module is specifically configured to: sequentially determine a difference between the first number and the second number of each of the dimension features; and determine a dimension feature with a difference greater than a preset threshold as the target dimension feature. In some embodiments, the attribution module is specifically configured to: down-sample a first number of link data other than the abnormal link data to obtain a second number of link data; and use the second number of link data as the reference link data. In some embodiments, the attribution module is specifically configured to: determine data buckets to which the second number of link data respectively belong; and down-sample the second number of link data to obtain a third number of link data according to a sampling requirement that each data bucket includes only a predetermined number of dimension features.In some embodiments, the attribution module is specifically configured to: obtain a first number of occurrences of the abnormal dimension feature in the abnormal link data, and a second number of occurrences in the reference link data; generate a data table based on the first number and the second number, the data table being used to display a comparison between the first number and the second number. In some embodiments, the first obtaining module is specifically configured to: receive a graph generation instruction; and in response to the graph generation instruction, obtain the plurality of link data so as to generate the display graph based on the plurality of link data. In some embodiments, the first obtaining module is specifically configured to: in response to the abnormality identification instruction, obtain the plurality of link data corresponding to the to-be-identified subject based on the identification information. The abnormality identification apparatus shown in FIG. 5 can perform the abnormal link data identification method shown in the embodiment of FIG. 1, and the implementation principle and technical effects thereof will not be repeated. The specific manner in which each module or unit of the abnormality identification apparatus in the above embodiments performs an operation has been described in detail in the embodiments related to the method, and will not be described in detail here. The embodiments of the present disclosure further provide a computing device, which can include a storage component and a processing component; the storage component stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component to implement the abnormal link data identification method provided by the embodiments of the present disclosure. Of course, the computing device can also include other components, such as an input / output interface, a display component, a communication component, and the like. In the case where the processing component in the computing device is used to implement the information display method shown in FIG. 1, the computing device can also include a display component to perform corresponding display operations. The input / output interface provides an interface between the processing component and a peripheral interface module, and the peripheral interface module can be an output device, an input device, and the like. The communication component is configured to facilitate wired or wireless communication between the computing device and other devices. The processing component can include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component can also be an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a controller, a microcontroller, a microprocessor, or other electronic elements, for executing the above method. The storage component is configured to store various types of data to support the operation of the terminal.The storage component can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The display component can be an electroluminescent but L) element, a liquid crystal display or a micro display with a similar structure, or a retinal display or a similar laser scanning display. It should be noted that the above computing device for implementing the abnormal link data identification method shown in FIG. 1 can be a physical device or an elastic computing host provided by a cloud computing platform. It can be implemented as a distributed cluster composed of multiple servers or terminal devices, or as a single server or a single terminal device. In the case of the above computing device for implementing the information display method shown in FIG. 1, it can be specifically implemented as an electronic device, which can be a device used by a user and having functions of computing, surfing the Internet, communication and the like required by the user, such as a mobile phone, a tablet computer, a personal computer, a wearable device and the like. It should be noted that the above computing device can be a physical device or an elastic computing host provided by a cloud computing platform. It can be implemented as a distributed cluster composed of multiple servers or terminal devices, or as a single server or a single terminal device. The embodiment of the present disclosure also provides a computer readable storage medium storing a computer program, and the computer program can implement the abnormal link data identification method of the above embodiment shown in FIG. 1 when executed by a computer. The computer readable medium can be included in the electronic device described in the above embodiment; or it can exist separately and not be assembled into the electronic device. The embodiment of the present disclosure also provides a computer program product comprising a computer program carried on a computer readable storage medium, and the computer program can implement the abnormal link data identification method of the above embodiment shown in FIG. 1 when executed by a computer. In such an embodiment, the computer program can be downloaded and installed from a network, and / or installed from a removable medium. When the computer program is executed by a processor, various functions defined in the system of the present disclosure are executed. It should be noted that the embodiments of the present disclosure can involve the use of user data, and in actual applications, user-specific personal data can be used in the schemes described herein within the scope allowed by applicable laws and regulations (for example, user's explicit consent, user's actual notification, etc.).Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the system, device and unit described above can refer to the corresponding processes in the foregoing method embodiments, and will not be repeated here. The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment scheme according to actual needs. Those skilled in the art can understand and implement without creative labor. Through the foregoing description of the embodiments, those skilled in the art can clearly understand that the embodiments can be realized by means of software and the necessary general hardware platform, and of course can also be realized by hardware. Based on such understanding, the foregoing technical solutions can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in each embodiment or some parts of the embodiments. Finally, it should be noted that: the foregoing embodiments are merely used to illustrate the technical solutions of the present disclosure, rather than limit them; although the present disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.

Claims

Claims 1. A method for identifying abnormal link data, comprising: Acquire multiple link data generated by at least one service node; The multiple link data are divided into multiple data ranges to obtain multiple data buckets, wherein the multiple data ranges are determined based on the indicator data values ​​of the multiple link data; based on the data ranges corresponding to each of the multiple data buckets, a display diagram is generated, which is used to identify abnormal data buckets from the multiple data buckets, and the link data in the abnormal data buckets is identified as abnormal link data.

2. The method according to claim 1, wherein, The step of dividing the multiple link data into multiple data ranges to obtain multiple data buckets includes: dividing the multiple link data into corresponding data ranges according to the indicator data values, and generating multiple data buckets corresponding to the multiple data ranges.

3. The method according to claim 1, wherein, The acquisition of multiple link data includes: acquiring the generation time of multiple link data; the generation of a display diagram based on the data range corresponding to each of the multiple data buckets includes: constructing a coordinate system with the generation time of the link data as the first coordinate axis and the index data value as the second coordinate axis; in the coordinate system, drawing the tile corresponding to the data bucket according to the time range and data range corresponding to any data bucket; acquiring the number of link data contained in the data bucket; based on the number of data, determining the display method of the tile corresponding to the data bucket, and displaying the tile in the display diagram according to the determined display method to generate the display diagram.

4. The method according to claim 3, wherein, The step of identifying abnormal data buckets from multiple data buckets includes: determining the distance between any tile and its adjacent tiles along the second coordinate axis; identifying abnormal tiles based on the distance; and identifying the data bucket corresponding to the abnormal tile as an abnormal data bucket.

5. The method according to claim 4, wherein, The distance includes a first distance between any tile and its adjacent tile below it, and a second distance between any tile and its adjacent tile above it; the step of determining abnormal tiles based on the distance includes: aggregating multiple tiles whose first distance and second distance are at least less than a preset threshold to generate at least one tile cluster; and determining tiles that do not belong to any tile cluster as the abnormal tiles.

6. The method according to claim 3, wherein, The step of determining the abnormal data bucket from multiple data buckets includes: receiving a selection instruction, the selection instruction being triggered for any tile in the display diagram; determining the abnormal tile selected by the selection instruction; and determining the data bucket corresponding to the abnormal tile as the abnormal data bucket.

7. The method according to claim 3, wherein, The method further includes: receiving a timestamp selection instruction, the timestamp selection instruction being triggered against a first coordinate axis of the coordinate system; In response to the timestamp selection instruction, the tile corresponding to the selected timestamp on the second coordinate axis is determined, and the data range and the number of data contained in the tile are determined; a tile display area is generated in the display diagram, and the data range and the number of data contained in each tile displayed on the second coordinate axis for the timestamp selected by the timestamp selection instruction are displayed in the tile display area.

8. The method according to claim 1, wherein, The step of determining multiple data ranges based on the indicator data values ​​of the multiple link data includes: determining the maximum and minimum values ​​of the indicator data values ​​among the multiple link data; obtaining a precision requirement parameter, which indicates the deviation precision between any link data in the data bucket; determining the number of required data ranges based on the difference between the maximum and minimum values ​​and the precision requirement parameter, and numbering each data range; and determining the boundary values ​​of each data range based on the number of each data range.

9. The method according to claim 8, wherein, The step of determining the boundary value of each data range based on the number of each data range includes: determining boundary parameters based on the accuracy requirement parameters, wherein the boundary parameters are used to calculate the boundary value of the data range; and determining the boundary value of each data range according to the boundary parameters and the number of each data range.

10. The method according to claim 9, wherein, The boundary values ​​include a maximum boundary value and a minimum boundary value; determining the boundary value of each data range based on the boundary parameters and the number of each data range includes: determining a first boundary parameter and a second boundary parameter based on the boundary parameters; calculating the maximum boundary value based on the first boundary parameter and the number; and calculating the minimum boundary value based on the second boundary parameter and the number.

11. The method according to claim 1, wherein, Each of the link data includes at least one dimension feature; the method further includes: determining the target dimension feature causing the anomaly from the multiple dimension features of the abnormal link data; and outputting the target dimension feature.

12. The method according to claim 11, wherein, The step of determining the target dimension feature causing the anomaly from multiple dimension features of the abnormal link data includes: determining link data other than the abnormal link data as baseline link data; determining the first occurrence number of the multiple dimension features in the abnormal link data and the second occurrence number in the baseline link data; and determining the target dimension feature based on the first occurrence number and the second occurrence number.

13. The method according to claim 12, wherein, The step of determining the target dimension feature based on the first count and the second count includes: sequentially determining the difference between the first count and the second count for each dimension feature; and determining the dimension feature whose difference is greater than a preset threshold as the target dimension feature.

14. The method according to claim 12, wherein, The step of determining the link data other than the abnormal link data as the reference link data includes: downsampling a first number of link data other than the abnormal link data to obtain a second number of link data; and using the second number of link data as the reference link data.

15. The method according to claim 14, wherein, The step of downsampling the first number of link data to obtain the second number of link data includes: determining the data bucket to which the first number of link data belong; and downsampling the first number of link data with each data bucket including a predetermined number of dimensional features as a sampling requirement to obtain the second number of link data.

16. The method according to claim 12, wherein, The method further includes: generating a data table based on the first number and the second number, wherein the data table is used to compare and display the first number and the second number.

17. The method according to claim 1, wherein, The process of acquiring the link dataset includes: receiving a graph generation instruction; and in response to the graph generation instruction, acquiring the multiple link data to generate the display graph based on the multiple link data.

18. The method according to claim 17, wherein, The image generation instruction includes the identification information of the subject to be identified; The step of obtaining the multiple link data in response to the graph generation instruction includes: obtaining multiple link data corresponding to the subject to be identified based on the identification information in response to the graph generation instruction.

19. An error notification page, including a selection control, wherein the selection control is configured to determine an error data bucket from a display image shown on the error notification page in response to a selection instruction; wherein, The illustration is generated using the abnormal link data identification method according to any one of claims 1 to 18.

20. A system for identifying abnormal link data, comprising: A probe, configured to acquire multiple link data generated by at least one service node; The processor is configured to divide the multiple link data acquired by the probe into multiple data ranges to obtain multiple data buckets, wherein the multiple data ranges are determined based on the indicator data values ​​of the multiple link data; and generate a display diagram based on the data ranges corresponding to each of the multiple data buckets, the display diagram being used to identify abnormal data buckets from the multiple data buckets, and to identify the link data in the abnormal data buckets as abnormal link data.

21. A computing device, comprising a processing component and a storage component; the storage component storing one or more computer instructions; the one or more computer instructions being invoked and executed by the processing component to implement the method for identifying abnormal link data as described in any one of claims 1 to 18.

22. A computer-readable storage medium having a computer program stored thereon, the computer program being processed by a component. During execution, the method for identifying abnormal link data as described in any one of claims 1 to 18 is implemented.

23. A computer program product comprising a computer program / instructions, wherein the computer program / instructions, when executed by a processing component, implement the method for identifying abnormal link data as described in any one of 1 to 18. 21

Images