CN110222936B - Root cause positioning method and system of business scene and electronic equipment - Google Patents
Root cause positioning method and system of business scene and electronic equipment Download PDFInfo
- Publication number
- CN110222936B CN110222936B CN201910383396.5A CN201910383396A CN110222936B CN 110222936 B CN110222936 B CN 110222936B CN 201910383396 A CN201910383396 A CN 201910383396A CN 110222936 B CN110222936 B CN 110222936B
- Authority
- CN
- China
- Prior art keywords
- root cause
- scene
- current alarm
- historical
- alarm
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 55
- 238000009826 distribution Methods 0.000 claims abstract description 50
- 238000012549 training Methods 0.000 claims abstract description 19
- 238000004590 computer program Methods 0.000 claims description 17
- 238000003860 storage Methods 0.000 claims description 14
- 238000012545 processing Methods 0.000 description 14
- 238000010586 diagram Methods 0.000 description 10
- 238000004519 manufacturing process Methods 0.000 description 9
- 238000004422 calculation algorithm Methods 0.000 description 8
- 230000008569 process Effects 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- 230000003287 optical effect Effects 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 230000008859 change Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000004075 alteration Effects 0.000 description 1
- 238000004458 analytical method Methods 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004364 calculation method Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000011022 operating instruction Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q10/063—Operations research, analysis or management
- G06Q10/0637—Strategic management or analysis, e.g. setting a goal or target of an organisation; Planning actions based on goals; Analysis or evaluation of effectiveness of goals
Landscapes
- Business, Economics & Management (AREA)
- Human Resources & Organizations (AREA)
- Engineering & Computer Science (AREA)
- Strategic Management (AREA)
- Educational Administration (AREA)
- Economics (AREA)
- Entrepreneurship & Innovation (AREA)
- Development Economics (AREA)
- Game Theory and Decision Science (AREA)
- Marketing (AREA)
- Operations Research (AREA)
- Quality & Reliability (AREA)
- Tourism & Hospitality (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Alarm Systems (AREA)
- Debugging And Monitoring (AREA)
Abstract
The embodiment of the specification provides a root cause positioning method, a system and electronic equipment of a service scene, wherein the root cause positioning method of the service scene comprises the following steps: determining scene data of a current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located; taking the scene data of the current alarm as input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained based on the scene data of historical alarms and corresponding root cause training; and determining the root cause corresponding to the current alarm based on the root cause conditional probability distribution corresponding to the current alarm.
Description
Technical Field
The embodiment of the specification relates to the technical field of data processing, in particular to a root cause positioning method and system of a business scene and electronic equipment.
Background
With the rapid development of the information age, the business of each enterprise is more and more varied, and the variety of platforms for supporting each business is wide. With frequent code alternation on each platform, platform function update, platform configuration parameter change and the like, an infinite abnormal alarm is generated, and potential economic loss and potential safety hazard are brought to enterprises. Therefore, the root cause of the business scenario is crucial.
According to the conventional root cause positioning method of the service scene, similar reasons in a plurality of alarm scenes are analyzed, and the frequently occurring reasons in the alarm scenes are determined to be the alarm root causes from the perspective of commonality. However, this solution has the following drawbacks: various frequent item sets need to be counted, and the algorithm complexity is high. Therefore, the existing root cause positioning method of the service scene has higher algorithm complexity, and the alarm root cause cannot be positioned in time.
Disclosure of Invention
The embodiment of the specification provides a root cause positioning method, a root cause positioning system and electronic equipment of a service scene, so as to solve the problem that the existing root cause positioning method of the service scene is high in algorithm complexity and cannot position an alarm root cause in time.
The embodiment of the specification adopts the following technical scheme:
in a first aspect, a root cause positioning method of a service scenario is provided, including:
determining scene data of a current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located;
taking the scene data of the current alarm as input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained by training based on the scene data of historical alarms and the corresponding root cause conditional probability distribution;
and determining the root cause corresponding to the current alarm based on the root cause conditional probability distribution corresponding to the current alarm.
In a second aspect, a root cause positioning system of a service scene is provided, including:
the first data determining module is used for determining scene data of the current alarm based on at least one data dimension of a service instance in a first preset time period where the occurrence time point of the current alarm is located;
the input module is used for taking the scene data of the current alarm as the input of a root cause positioning model to acquire the root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained by training based on the scene data of the historical alarm and the corresponding root cause conditional probability distribution;
and the first root cause determining module is used for determining the root cause corresponding to the current alarm based on the root cause conditional probability distribution corresponding to the current alarm.
In a third aspect, an electronic device is provided, comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program when executed by the processor implementing the steps of:
determining scene data of a current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located;
taking the scene data of the current alarm as input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained by training based on the scene data of historical alarms and the corresponding root cause conditional probability distribution;
and determining the root cause corresponding to the current alarm based on the root cause conditional probability distribution corresponding to the current alarm.
In a fourth aspect, there is provided a computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of:
determining scene data of a current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located;
taking the scene data of the current alarm as input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained by training based on the scene data of historical alarms and the corresponding root cause conditional probability distribution;
and determining the root cause corresponding to the current alarm based on the root cause conditional probability distribution corresponding to the current alarm.
The above-mentioned at least one technical scheme that this description embodiment adopted can reach following beneficial effect:
according to the embodiment of the specification, the scene data of the current alarm is determined based on at least one data dimension of the service instance in the first preset time period where the occurrence time point of the current alarm is located, so that more alarm scene information can be provided for the subsequent root cause positioning, and the accuracy of the root cause positioning is improved; the scene data of the current alarm is used as the input of the root cause positioning model to acquire the root cause conditional probability distribution corresponding to the current alarm, the root cause corresponding to the current alarm is determined based on the root cause conditional probability distribution corresponding to the current alarm, and the root cause positioning is performed by using the trained root cause positioning model, so that the algorithm complexity of the root cause positioning method is simplified, and the root cause causing the alarm can be timely given when the alarm occurs, so that the purpose of timely stopping damage is achieved.
Drawings
The accompanying drawings, which are included to provide a further understanding of the specification, illustrate and explain the exemplary embodiments of the present specification and their description, are not intended to limit the specification unduly. In the drawings:
FIG. 1 is a flowchart of a root cause positioning method of a business scenario according to an embodiment of the present disclosure;
FIG. 2 is a block diagram of a root cause positioning system for a business scenario provided in one embodiment of the present disclosure;
fig. 3 is a block diagram of an electronic device according to an embodiment of the present disclosure.
Detailed Description
For the purposes of making the objects, technical solutions and advantages of the present specification more apparent, the technical solutions of the present specification will be clearly and completely described below with reference to specific embodiments of the present specification and corresponding drawings. It will be apparent that the described embodiments are only some, but not all, of the embodiments of the present specification. All other embodiments, which are determined by one of ordinary skill in the art without undue burden on the person of ordinary skill in the art based on the embodiments in this specification, are intended to be within the scope of protection of this specification.
The embodiment of the specification provides a root cause positioning method, a root cause positioning system and electronic equipment of a service scene, so as to solve the problem that the existing root cause positioning method of the service scene is high in algorithm complexity and cannot position an alarm root cause in time. The embodiments of the present specification provide a root cause positioning method of a service scenario, and an execution subject of the method may be, but is not limited to, an electronic device or an apparatus or a system that can be configured to execute the method provided by the embodiments of the present specification.
For convenience of description, an embodiment of the method will be described below by taking an electronic device as an example. It will be appreciated that the subject of execution of the method is an exemplary illustration of an electronic device and should not be construed as limiting the method.
Fig. 1 is a flowchart of a root cause positioning method of a service scenario provided in an embodiment of the present disclosure, where the method of fig. 1 may be performed by an electronic device, as shown in fig. 1, and the method may include:
step 110, determining scene data of the current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located.
The first preset time period may be set according to actual requirements, and the embodiment of the present specification is not specifically limited.
It should be understood that at least one data dimension is a distinguishing data dimension.
The method comprises the following steps: when an alarm occurs, determining a first preset time period in which the current alarm occurs, and acquiring at least one data dimension of a service instance in the first preset time period; and determining scene data of the current alarm based on at least one data dimension of the service instance in the first preset time period.
For example, assuming that the current alarm occurrence time is 2019, 3, 1, 9, and the first preset time period is 50 minutes from 2019, 3, 1, 8, 50 minutes to 2019, 3, 1, 9, 10 minutes, at this time, acquiring at least one data dimension of the service instance, for example, the at least one data dimension includes: appname & dimension & qualifier & information summary (MD 5) set of all service instances at the current time.
Specifically, if at least one data dimension includes a product production time, a product production parameter, etc., determining that a current alarm scene is a production scene based on the at least one data dimension, and determining scene data of the production scene; if the at least one data dimension includes sales amount of the product, sales mode of the product, etc., determining that the current alarm scene is a sales scene based on the at least one data dimension, and determining scene data of the sales scene.
And 120, taking the scene data of the current alarm as the input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm.
The root cause conditional probability distribution can refer to probability conditions of all root causes corresponding to the current alarm.
The root cause positioning model is obtained based on historical alarm scene data and corresponding root cause training.
The training data of the root cause positioning model are historical alarm scene data and corresponding root causes, wherein the historical alarm scene data are determined based on at least one data dimension of a service instance in a second preset time period where a time point of the historical alarm moment occurs, and the corresponding root causes of the historical alarm can be summarized based on working experience of technicians or mined based on frequent modes.
And 130, determining the root cause corresponding to the current alarm based on the root cause conditional probability distribution corresponding to the current alarm.
The method comprises the following steps: and determining the root cause corresponding to the root cause probability meeting the preset condition as the root cause corresponding to the current alarm based on the root cause conditional probability distribution corresponding to the current alarm. The predetermined condition may be selected according to actual requirements, for example, the predetermined condition is a condition with the highest probability, and so on.
According to the embodiment of the specification, the scene data of the current alarm is determined based on at least one data dimension of the service instance in the first preset time period where the occurrence time point of the current alarm is located, so that more alarm scene information can be provided for the subsequent root cause positioning, and the accuracy of the root cause positioning is improved; the scene data of the current alarm is used as the input of the root cause positioning model to acquire the root cause conditional probability distribution corresponding to the current alarm, the root cause corresponding to the current alarm is determined based on the root cause conditional probability distribution corresponding to the current alarm, and the root cause positioning is performed by using the trained root cause positioning model, so that the algorithm complexity of the root cause positioning method is simplified, and the root cause causing the alarm can be timely given when the alarm occurs, so that the purpose of timely stopping damage is achieved.
Alternatively, as an embodiment, step 130 may be specifically implemented as:
determining posterior probability that the current alarm scene is generated by a target root cause based on prior probability of the current alarm scene, prior probability of the target root cause and conditional probability that the scene is the current alarm scene under the condition that the target root cause appears, wherein the target root cause is any root cause in root cause conditional probability distribution corresponding to the current alarm;
and selecting a target root cause with the maximum posterior probability from the root causes in the root cause conditional probability distribution corresponding to the current alarm as the root cause corresponding to the current alarm.
The prior probability (prior probability) is a probability obtained by conventional experience and analysis.
The determining that the current alarm scene is the posterior probability generated by the target root causes can be specifically implemented as follows:
based on the prior probability of the current alarm scene, the prior probability of the target root cause and the conditional probability that the scene is the current alarm scene under the condition that the target root cause appears, the posterior probability that the current alarm scene is generated by the target root cause is determined through a Bayesian principle.
Specifically, assume that a bayesian formula of two variables is adopted, and the formula is:
determining posterior probability that the current alarm scene is generated by a target root cause;
wherein P (A) represents the prior probability of the target root cause A; p (B) represents the prior probability of the current alarm scene B; p (B/A) represents the conditional probability that the scene is the current alarm scene B in the case that the target root cause A appears; p (B/A) represents the posterior probability that the current alarm scenario B is generated by the target root cause A.
For example, if there are sales scenes, production scenes and processing scenes, the sales scenes, the production scenes and the processing scenes are mutually exclusive, the current alarm scenes are respectively the sales scenes, the production scenes and the processing scenes, and the prior probabilities of the sales scenes, the production scenes and the processing scenes are all 1/3;
if the target root cause includes: target root cause a, target root cause b, target root cause c and target root cause d, wherein the target root cause a, target root cause b, target root cause c and target root cause d are mutually exclusive root causes, and the prior probabilities of the target root cause a, the target root cause b, the target root cause c and the target root cause d are all 1/4;
if the conditional probability that the scene is a sales scene when the target root appears as a is 1/a, the conditional probability that the scene is a sales scene when the target root appears as b is 1/b, the conditional probability that the scene is a sales scene when the target root appears as c is 1/c, and the conditional probability that the scene is a sales scene when the target root appears as d is 1/d, then:
posterior probability generated by target root a in sales scenario
Posterior probability generated by target root b in sales scenario
Posterior probability generated by target root c in sales scenario
Posterior probability generated by target root d in sales scenario
If a > b > c > d, the posterior probability that the sales scenario is generated by the target root cause d is the greatest, and it can be determined that the sales scenario is generated by the target root cause d, that is, the root of the sales scenario is generated by the target root cause d.
According to the embodiment of the specification, the target root cause with the maximum posterior probability is selected from the root causes in the root cause conditional probability distribution corresponding to the current alarm to serve as the root cause corresponding to the current alarm, so that the root cause with the maximum possibility in the root causes can be positioned in time when the alarm occurs, and the accuracy of root cause positioning is improved.
Optionally, as an embodiment, before training the root cause positioning model based on the scene data of the historical alarm and the root cause corresponding to the historical alarm, the following two methods may be specifically adopted:
firstly, determining a root cause corresponding to the historical alarm based on the frequency of the historical root cause in unit time and the weight value of the historical root cause; wherein the historical root cause is a root cause that has occurred before the historical alert time.
Secondly, determining a root cause corresponding to the historical alarm based on the probability that the historical root cause and the historical alarm occur simultaneously and the conditional probability of the root cause under the condition that the historical alarm occurs; wherein the historical root cause is a root cause that has occurred before the historical alert time.
Specifically, if the first probability and the second probability are both minimum values, determining the historical root cause as the root cause of the historical alarm. Wherein the first probability is: the root cause is the conditional probability of the historical root cause under the condition that the historical alarm appears; the second probability is: the historical root causes and the historical alarms are concurrent probabilities.
According to the embodiment of the specification, the root cause corresponding to the historical alarm is determined through the historical root cause and the historical alarm, so that training sample data is prepared for the root cause positioning model, when the alarm occurs, the corresponding root cause of the current alarm can be obtained through inputting scene data of the current alarm into the root cause positioning model, and according to the obtained corresponding root cause of the current alarm, the root cause conditional probability distribution corresponding to the current alarm is obtained, more calculation time is not required, and the instantaneity is high.
In the above, fig. 1 illustrates the root cause positioning method of the service scenario in the embodiment of the present specification in detail, and in the following, with reference to fig. 2, the root cause positioning system of the service scenario in the embodiment of the present specification is illustrated in detail.
Fig. 2 is a schematic structural diagram of a root cause positioning system of a service scenario provided in an embodiment of the present disclosure, as shown in fig. 2, a root cause positioning system 200 of the service scenario may include:
a first data determining module 210, configured to determine scene data of a current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located;
the input module 220 is configured to take the current alarm scene data as input of a root cause positioning model to obtain a root cause conditional probability distribution corresponding to the current alarm, where the root cause positioning model is obtained based on historical alarm scene data and corresponding root cause training;
a first root cause determining module 230, configured to determine a root cause corresponding to the current alarm based on a root cause conditional probability distribution corresponding to the current alarm.
In one embodiment, the first root cause determining module 230 includes:
the first probability determining unit is used for determining posterior probability that the current alarm scene is generated by a target root cause based on the prior probability of the current alarm scene, the prior probability of the target root cause and the conditional probability that the scene is the current alarm scene under the condition that the target root cause appears, wherein the target root cause is any root cause in root cause conditional probability distribution corresponding to the current alarm;
and the selecting unit is used for selecting a target root cause with the maximum posterior probability from the root causes in the root cause conditional probability distribution corresponding to the current alarm as the root cause corresponding to the current alarm.
In an embodiment, the first probability determining unit includes:
the probability determination subunit is configured to determine, based on the prior probability of the current alarm scene, the prior probability of the target root cause, and the conditional probability that the scene is the current alarm scene when the target root cause appears, a posterior probability that the current alarm scene is generated by the target root cause according to a bayesian principle.
In one embodiment, the root cause positioning system 200 of the service scenario includes:
a second data determining module 240, configured to determine scenario data of the historical alarm based on at least one data dimension of a service instance in a second preset time period where a time point of occurrence of the historical alarm time is located;
the training module 250 is configured to train the root cause positioning model based on the scene data of the historical alarm and the root cause conditional probability distribution corresponding to the historical alarm.
In one embodiment, the root cause positioning system 200 of the service scenario includes:
a second root cause determining module 260, configured to determine a root cause corresponding to the historical alarm based on a frequency of a historical root cause in a unit time and a weight value of the historical root cause, where the historical root cause is a root cause that occurs before the time of the historical alarm.
In one embodiment, the root cause positioning system 200 of the service scenario includes:
and a third root cause determining module 280, configured to determine a root cause corresponding to the historical alarm based on a probability that the historical root cause and the historical alarm occur simultaneously, and based on a conditional probability of the historical root cause when the historical alarm occurs, where the historical root cause is a root cause that occurs before the time of the historical alarm.
In one embodiment, the third root cause determination module 280 includes:
the root cause determining unit is used for determining the historical root cause as the root cause of the historical alarm if the first probability and the second probability are both minimum;
wherein the first probability is: the root cause is the conditional probability of the historical root cause under the condition that the historical alarm appears;
the second probability is: the historical root causes and the historical alarms are concurrent probabilities.
According to the embodiment of the specification, the scene data of the current alarm is determined based on at least one data dimension of the service instance in the first preset time period where the occurrence time point of the current alarm is located, so that more alarm scene information can be provided for the subsequent root cause positioning, and the accuracy of the root cause positioning is improved; the scene data of the current alarm is used as the input of the root cause positioning model to acquire the root cause conditional probability distribution corresponding to the current alarm, the root cause corresponding to the current alarm is determined based on the root cause conditional probability distribution corresponding to the current alarm, and the root cause positioning is performed by using the trained root cause positioning model, so that the algorithm complexity of the root cause positioning method is simplified, and the root cause causing the alarm can be timely given when the alarm occurs, so that the purpose of timely stopping damage is achieved.
Fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present disclosure. Referring to fig. 3, at the hardware level, the electronic device includes a processor, and optionally an internal bus, a network interface, and a memory. The memory may include a memory, such as a high-speed Random access memory (Random-AccessMemory, RAM), and may further include a non-volatile memory (non-volatile memory), such as at least 1 disk memory, etc. Of course, the electronic device may also include hardware required for other services.
The processor, network interface, and memory may be interconnected by an internal bus, which may be an ISA (Industry Standard Architecture ) bus, a PCI (Peripheral Component Interconnect, peripheral component interconnect standard) bus, or EISA (Extended Industry Standard Architecture ) bus, among others. The buses may be classified as address buses, data buses, control buses, etc. For ease of illustration, only one bi-directional arrow is shown in FIG. 3, but not only one bus or type of bus.
And the memory is used for storing programs. In particular, the program may include program code including computer-operating instructions. The memory may include memory and non-volatile storage and provide instructions and data to the processor.
The processor reads the corresponding computer program from the nonvolatile memory into the memory and then runs the computer program to form a device for associating the resource value-added object with the resource object on a logic level. The processor is used for executing the programs stored in the memory and is specifically used for executing the following operations:
determining scene data of a current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located;
taking the scene data of the current alarm as input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained based on the scene data of historical alarms and corresponding root cause training;
and determining the root cause corresponding to the current alarm based on the root cause conditional probability distribution corresponding to the current alarm.
According to the embodiment of the specification, the scene data of the current alarm is determined based on at least one data dimension of the service instance in the first preset time period where the occurrence time point of the current alarm is located, so that more alarm scene information can be provided for the subsequent root cause positioning, and the accuracy of the root cause positioning is improved; the scene data of the current alarm is used as the input of the root cause positioning model to acquire the root cause conditional probability distribution corresponding to the current alarm, the root cause corresponding to the current alarm is determined based on the root cause conditional probability distribution corresponding to the current alarm, and the root cause positioning is performed by using the trained root cause positioning model, so that the algorithm complexity of the root cause positioning method is simplified, and the root cause causing the alarm can be timely given when the alarm occurs, so that the purpose of timely stopping damage is achieved.
The root cause positioning method of the service scenario disclosed in the embodiment shown in fig. 1 of the present specification can be applied to a processor or implemented by the processor. The processor may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware in a processor or by instructions in the form of software. The processor may be a general-purpose processor, including a central processing unit (Central Processing Unit, CPU), a network processor (Network Processor, NP), etc.; but also digital signal processors (Digital Signal Processor, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), field programmable gate arrays (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The various methods, steps, and logic blocks disclosed in one or more embodiments of the present description may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of a method disclosed in connection with one or more embodiments of the present disclosure may be embodied directly in a hardware decoding processor or in a combination of hardware and software modules in a decoding processor. The software modules may be located in a random access memory, flash memory, read only memory, programmable read only memory, or electrically erasable programmable memory, registers, etc. as well known in the art. The storage medium is located in a memory, and the processor reads the information in the memory and, in combination with its hardware, performs the steps of the above method.
The electronic device may also execute the root cause positioning method of the service scenario of fig. 1 executed by the root cause positioning system of the service scenario of fig. 2, which is not described herein.
Of course, in addition to the software implementation, the electronic device in this specification does not exclude other implementations, such as a logic device or a combination of software and hardware, that is, the execution subject of the following processing flow is not limited to a plurality of logic units, but may also be hardware or a logic device.
The embodiments of the present disclosure further provide a computer readable storage medium, on which a computer program is stored, where the computer program when executed by a processor implements a plurality of processes of the above method embodiments, and the same technical effects can be achieved, and for avoiding repetition, a description is omitted herein. Wherein the computer readable storage medium is selected from Read-Only Memory (ROM), random access Memory (Random Access Memory, RAM), magnetic disk or optical disk.
It will be appreciated by those skilled in the art that embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, the present specification may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present description can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
The present description is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the specification. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a system for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
In one typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
The memory may include volatile memory in a computer-readable medium, random Access Memory (RAM) and/or nonvolatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of computer-readable media.
Computer readable media, including both non-transitory and non-transitory, removable and non-removable media, may implement information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of storage media for a computer include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices, or any other non-transmission medium, which can be used to store information that can be accessed by a computing device. Computer-readable media, as defined herein, does not include transitory computer-readable media (transmission media), such as modulated data signals and carrier waves.
The foregoing description of specific embodiments of the present invention has been presented. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article or apparatus that comprises an element.
The foregoing is merely an example of the present specification and is not intended to limit the present specification. Various modifications and alterations to this specification will become apparent to those skilled in the art. Any modifications, equivalent substitutions, improvements, or the like, which are within the spirit and principles of the present description, are intended to be included within the scope of the claims of the present description.
Claims (9)
1. A root cause positioning method of a business scene comprises the following steps:
determining scene data of the current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located, wherein the at least one data dimension is a distinguishing data dimension;
taking the scene data of the current alarm as input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained based on the scene data of historical alarms and corresponding root cause training;
determining posterior probability that the current alarm scene is generated by a target root cause based on prior probability of the current alarm scene, prior probability of the target root cause and conditional probability that the scene is the current alarm scene under the condition that the target root cause appears, wherein the target root cause is any root cause in root cause conditional probability distribution corresponding to the current alarm;
and selecting a target root cause with the maximum posterior probability from the root causes in the root cause conditional probability distribution corresponding to the current alarm as the root cause corresponding to the current alarm.
2. The method of claim 1, wherein the determining the current alert scene as a posterior probability generated by a target root cause based on a priori probability of the current alert scene, a priori probability of the target root cause, and a conditional probability that the scene is the current alert scene if the target root cause is present, comprises:
based on the prior probability of the current alarm scene, the prior probability of the target root cause and the conditional probability that the scene is the current alarm scene under the condition that the target root cause appears, the posterior probability that the current alarm scene is generated by the target root cause is determined through a Bayesian principle.
3. The method of claim 1, comprising, prior to taking the current alarm's scene data as input to a root cause positioning model to obtain a root cause conditional probability distribution corresponding to the current alarm:
determining scene data of the historical alarm based on at least one data dimension of a service instance in a second preset time period where a time point of occurrence of the historical alarm moment is located;
and training the root cause positioning model based on the scene data of the historical alarm and the root cause corresponding to the historical alarm.
4. A method as claimed in claim 3, comprising, prior to training the root cause positioning model based on the context data of the historical alert and the root cause corresponding to the historical alert:
and determining the root cause corresponding to the historical alarm based on the frequency of the historical root cause in unit time and the weight value of the historical root cause, wherein the historical root cause is the root cause which appears before the time of the historical alarm.
5. A method as claimed in claim 3, comprising, prior to training the root cause positioning model based on the context data of the historical alert and the root cause corresponding to the historical alert:
and determining the root cause corresponding to the historical alarm based on the probability that the historical root cause and the historical alarm occur simultaneously and the conditional probability of the historical root cause under the condition that the historical alarm occurs, wherein the historical root cause is the root cause which occurs before the time of the historical alarm.
6. The method of claim 5, the determining a root cause corresponding to the historical alert comprising:
if the first probability and the second probability are both minimum values, determining the historical root cause as the root cause of the historical alarm;
wherein the first probability is: the root cause is the conditional probability of the historical root cause under the condition that the historical alarm appears;
the second probability is: the historical root causes and the historical alarms are concurrent probabilities.
7. A root cause positioning system for a business scenario, comprising:
the first data determining module is used for determining scene data of the current alarm based on at least one data dimension of a service instance in a first preset time period where the occurrence time point of the current alarm is located, wherein the at least one data dimension is a distinguishing data dimension;
the input module is used for taking the scene data of the current alarm as the input of a root cause positioning model to acquire the root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained based on the scene data of the historical alarm and the corresponding root cause training;
the first root cause determining module is used for determining posterior probability that the current alarm scene is generated by a target root cause based on prior probability of the current alarm scene, prior probability of the target root cause and conditional probability that the scene is the current alarm scene under the condition that the target root cause appears, wherein the target root cause is any root cause in root cause conditional probability distribution corresponding to the current alarm; and selecting a target root cause with the maximum posterior probability from the root causes in the root cause conditional probability distribution corresponding to the current alarm as the root cause corresponding to the current alarm.
8. An electronic device, comprising: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program when executed by the processor implementing the steps of:
determining scene data of the current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located, wherein the at least one data dimension is a distinguishing data dimension;
taking the scene data of the current alarm as input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained based on the scene data of historical alarms and corresponding root cause training;
determining posterior probability that the current alarm scene is generated by a target root cause based on prior probability of the current alarm scene, prior probability of the target root cause and conditional probability that the scene is the current alarm scene under the condition that the target root cause appears, wherein the target root cause is any root cause in root cause conditional probability distribution corresponding to the current alarm;
and selecting a target root cause with the maximum posterior probability from the root causes in the root cause conditional probability distribution corresponding to the current alarm as the root cause corresponding to the current alarm.
9. A computer readable storage medium having stored thereon a computer program which when executed by a processor performs the steps of:
determining scene data of the current alarm based on at least one data dimension of a service instance in a first preset time period where an occurrence time point of the current alarm is located, wherein the at least one data dimension is a distinguishing data dimension;
taking the scene data of the current alarm as input of a root cause positioning model to acquire root cause conditional probability distribution corresponding to the current alarm, wherein the root cause positioning model is obtained based on the scene data of historical alarms and corresponding root cause training;
determining posterior probability that the current alarm scene is generated by a target root cause based on prior probability of the current alarm scene, prior probability of the target root cause and conditional probability that the scene is the current alarm scene under the condition that the target root cause appears, wherein the target root cause is any root cause in root cause conditional probability distribution corresponding to the current alarm;
and selecting a target root cause with the maximum posterior probability from the root causes in the root cause conditional probability distribution corresponding to the current alarm as the root cause corresponding to the current alarm.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910383396.5A CN110222936B (en) | 2019-05-09 | 2019-05-09 | Root cause positioning method and system of business scene and electronic equipment |
| CN202310995880.XA CN117035452A (en) | 2019-05-09 | 2019-05-09 | Root cause positioning method and system of business scene and electronic equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910383396.5A CN110222936B (en) | 2019-05-09 | 2019-05-09 | Root cause positioning method and system of business scene and electronic equipment |
Related Child Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310995880.XA Division CN117035452A (en) | 2019-05-09 | 2019-05-09 | Root cause positioning method and system of business scene and electronic equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110222936A CN110222936A (en) | 2019-09-10 |
| CN110222936B true CN110222936B (en) | 2023-08-29 |
Family
ID=67820757
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310995880.XA Pending CN117035452A (en) | 2019-05-09 | 2019-05-09 | Root cause positioning method and system of business scene and electronic equipment |
| CN201910383396.5A Active CN110222936B (en) | 2019-05-09 | 2019-05-09 | Root cause positioning method and system of business scene and electronic equipment |
Family Applications Before (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310995880.XA Pending CN117035452A (en) | 2019-05-09 | 2019-05-09 | Root cause positioning method and system of business scene and electronic equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (2) | CN117035452A (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113360350A (en) * | 2020-03-03 | 2021-09-07 | 中国移动通信集团贵州有限公司 | Method, device, equipment and storage medium for positioning root cause alarm of network equipment |
| CN113298638B (en) * | 2021-05-12 | 2023-07-14 | 深圳前海微众银行股份有限公司 | Root cause positioning method, electronic equipment and storage medium |
| CN113254254B (en) * | 2021-07-14 | 2021-11-30 | 南京中兴新软件有限责任公司 | Root cause positioning method and device of system fault, storage medium and electronic device |
| CN113642644B (en) * | 2021-08-13 | 2024-05-10 | 北京赛目科技有限公司 | Method and device for determining vehicle environment level, electronic equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105184386A (en) * | 2015-07-22 | 2015-12-23 | 中国寰球工程公司 | Method for establishing abnormal event early warning system based on expert experience and historical data |
| WO2016083676A1 (en) * | 2014-11-28 | 2016-06-02 | Total Sa | Method and device for processing well data |
| CN109270461A (en) * | 2018-10-15 | 2019-01-25 | 四川长虹电器股份有限公司 | Fault detection method based on Bayesian network |
| CN109634819A (en) * | 2018-10-26 | 2019-04-16 | 阿里巴巴集团控股有限公司 | Alarm root is because of localization method and device, electronic equipment |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20110054806A1 (en) * | 2009-06-05 | 2011-03-03 | Jentek Sensors, Inc. | Component Adaptive Life Management |
-
2019
- 2019-05-09 CN CN202310995880.XA patent/CN117035452A/en active Pending
- 2019-05-09 CN CN201910383396.5A patent/CN110222936B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2016083676A1 (en) * | 2014-11-28 | 2016-06-02 | Total Sa | Method and device for processing well data |
| CN105184386A (en) * | 2015-07-22 | 2015-12-23 | 中国寰球工程公司 | Method for establishing abnormal event early warning system based on expert experience and historical data |
| CN109270461A (en) * | 2018-10-15 | 2019-01-25 | 四川长虹电器股份有限公司 | Fault detection method based on Bayesian network |
| CN109634819A (en) * | 2018-10-26 | 2019-04-16 | 阿里巴巴集团控股有限公司 | Alarm root is because of localization method and device, electronic equipment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117035452A (en) | 2023-11-10 |
| CN110222936A (en) | 2019-09-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110222936B (en) | Root cause positioning method and system of business scene and electronic equipment | |
| US10860453B2 (en) | Index anomaly detection method and apparatus, and electronic device | |
| CN108846749B (en) | Partitioned transaction execution system and method based on block chain technology | |
| CN109711440B (en) | Data anomaly detection method and device | |
| CN111488289A (en) | Fault positioning method, device and equipment | |
| CN112836751A (en) | Target detection method and device | |
| CN106648839B (en) | Data processing method and device | |
| CN110851207B (en) | State transition management method and device, electronic equipment and storage medium | |
| CN111639011A (en) | Data monitoring method, device and equipment | |
| CN110008470B (en) | Sensitivity grading method and device for report forms | |
| CN108920326B (en) | Method and device for determining time-consuming abnormity of system and electronic equipment | |
| CN111709748B (en) | Transaction execution method and device with business attribute and electronic equipment | |
| CN109508791A (en) | Vehicle damage management method | |
| CN110806733B (en) | Thermal power plant equipment monitoring method and device and electronic equipment | |
| CN112416534A (en) | Agent-based task management method and device | |
| CN107301097B (en) | Method and device for storing calling java object and reference address information of java object | |
| CN108470242B (en) | Risk management and control method, device and server | |
| CN115442262B (en) | Resource evaluation method and device, electronic equipment and storage medium | |
| CN109740336B (en) | Method and device for identifying verification information in picture and electronic equipment | |
| CN110458393B (en) | Method and device for determining risk identification scheme and electronic equipment | |
| CN109656805B (en) | Method and device for generating code link for business analysis and business server | |
| CN113516453A (en) | Construction project investment fund control early warning method, device, equipment and medium | |
| CN112506911A (en) | Data quality monitoring method and device, electronic equipment and storage medium | |
| CN111046909A (en) | Load prediction method and device | |
| CN110163471B (en) | Abnormality identification method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20200925 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant before: Advanced innovation technology Co.,Ltd. Effective date of registration: 20200925 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman, British Islands Applicant after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Applicant before: Alibaba Group Holding Ltd. |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |