CN111767198A

CN111767198A - System risk prediction method and device based on classification label sequence matching

Info

Publication number: CN111767198A
Application number: CN202010578700.4A
Authority: CN
Inventors: 江聪颖; 漆英; 朱晓明; 陈思言
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2020-06-23
Filing date: 2020-06-23
Publication date: 2020-10-13

Abstract

The application provides a system risk prediction method and a system risk prediction device based on classification label sequence matching, and the method comprises the following steps: matching the real-time acquired system resource utilization rate value with a corresponding label; generating a current label sequence character string according to a preset time window length and a label; screening a sub-tag sequence character string consistent with the current tag sequence character string from the historical tag sequence character string; and performing system risk prediction by using the sub-label sequence character string. According to the method and the system, based on historical data, the prediction of the utilization rate of system resources in a future time period is realized through a specific algorithm, and the early risk warning can be realized in advance, so that a development operation and maintenance team intervenes in risk assessment in advance, and meanwhile, the method and the system can also be used as an important assessment basis for a system capacity expansion plan.

Description

System risk prediction method and device based on classification label sequence matching

Technical Field

The application belongs to the technical field of system risk early warning, and particularly relates to a system risk prediction method and device based on classification tag sequence matching.

Background

With the continuous promotion of bank distributed system construction, more and more business applications are deployed on the distributed system, so for rapidly increasing business volume, development, operation and maintenance teams need to pay close attention to the use condition of system resources, and the system resources are prevented from reaching or exceeding the limit, causing system downtime and influencing business transactions.

The real-time threshold monitoring is deployed on the current system, the resource utilization rate peak value can be pre-warned to a certain extent, for example, the pre-warning threshold value is set to be 80%, the pre-warning degree is limited, and in addition, the pre-warning effect is lacked under the condition that the peak value punctures the pre-warning threshold value and the actual limit value simultaneously when the numerical value suddenly increases.

For the traditional prediction method, the probability that the sequence of continuous data can be accurately matched is low because the utilization rate of system resources is continuous data for the prediction system, so that the success rate of prediction is not high. In addition, due to the existence of random factors such as noise and the like, the anti-interference effect of continuous number matching is not good.

Disclosure of Invention

The application provides a system risk prediction method and device based on classification label sequence matching, and aims to at least solve the problem that the accuracy of system risk prediction in the prior art is low.

According to one aspect of the application, a system risk prediction method based on classification tag sequence matching is provided, and comprises the following steps:

matching the real-time acquired system resource utilization rate value with a corresponding label;

generating a current label sequence character string according to a preset time window length and a label;

screening a sub-tag sequence character string consistent with the current tag sequence character string from the historical tag sequence character string;

and performing system risk prediction by using the sub-label sequence character string.

In one embodiment, the system risk prediction using the sub-tag sequence string comprises:

and obtaining a system resource utilization rate predicted value at the next moment by utilizing the sub-label sequence character string, and judging whether the system resource utilization rate predicted value exceeds a preset risk value or not.

In one embodiment, matching the real-time obtained system resource usage value with the corresponding tag includes:

determining a value interval in which the system resource utilization rate value is located;

and matching a corresponding label for the system resource utilization rate value according to a pre-generated value interval and label mapping relation table.

In one embodiment, generating a current tag sequence string according to a preset time window length and a tag includes:

acquiring all system resource utilization rate values and corresponding labels within the length of a time window;

and sequencing the labels according to time to generate a label sequence character string.

In one embodiment, predicting a predicted value of system resource usage at a next time based on the sub-tag sequence string comprises:

obtaining a historical value of the utilization rate of the system resources at the next moment of the sub-label character string and a current value of the utilization rate of the system resources;

and averaging the historical values of the utilization rates of all the system resources and the current values of the utilization rates of the system resources to obtain a predicted value of the utilization rates of the system resources.

According to another aspect of the present application, there is also provided a system risk prediction device based on classification tag sequence matching, including:

the tag matching unit is used for matching the corresponding tag with the system resource utilization rate value acquired in real time;

the current label sequence character string generating unit is used for generating a current label sequence character string according to the preset time window length and the label;

the screening unit is used for screening the sub-label sequence character strings consistent with the current label sequence character string from the historical label sequence character strings;

and the risk prediction unit is used for performing system risk prediction by utilizing the sub-label sequence character strings.

In an embodiment, the risk prediction unit comprises:

and the judging module is used for obtaining the system resource utilization rate predicted value at the next moment by utilizing the sub-label sequence character string and judging whether the system resource utilization rate predicted value exceeds a preset risk value or not.

In one embodiment, the tag matching unit includes:

the interval determining module is used for determining a value interval in which the system resource utilization rate value is located;

and the matching module is used for matching the corresponding label for the system resource utilization rate value according to the pre-generated value interval and label mapping relation table.

In one embodiment, the current tag sequence string generating unit includes:

the acquisition module is used for acquiring all system resource utilization rate values and corresponding labels within the length of the time window;

and the sequencing generation module is used for sequencing the labels according to time to generate a label sequence character string.

In one embodiment, the determining module includes:

the numerical value acquisition module is used for acquiring the historical numerical value of the utilization rate of the system resources at the next moment of the sub-label character string and the numerical value of the utilization rate of the current system resources;

and the average value calculation module is used for averaging the historical values of the utilization rates of all the system resources and the current values of the utilization rates of the system resources to obtain a predicted value of the utilization rates of the system resources.

According to the method and the system, based on historical data, the prediction of the utilization rate of system resources in a future time period is realized through a specific algorithm, and the early risk warning can be realized in advance, so that a development operation and maintenance team intervenes in risk assessment in advance, and meanwhile, the method and the system can also be used as an important assessment basis for a system capacity expansion plan.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a flowchart of a system risk prediction method based on classification tag sequence matching according to the present application.

Fig. 2 is a resource usage rate trend graph of each hour for a certain period of time of the CPU in the embodiment of the present application.

Fig. 3 is a flowchart of a method for matching a tag corresponding to a system resource usage rate value in the embodiment of the present application.

Fig. 4 is a flowchart of a method for generating a current tag sequence character string in the embodiment of the present application.

Fig. 5 is a flowchart of a method for calculating a system resource utilization prediction value according to an embodiment of the present disclosure.

Fig. 6 is a block diagram of a system risk prediction device based on classification tag sequence matching according to the present application.

Fig. 7 is a block diagram of a structure of a tag matching unit in the embodiment of the present application.

FIG. 8 is a block diagram of a current tag sequence string generation unit in the embodiment of the present application

Fig. 9 is a block diagram of a determining module in the embodiment of the present application.

Fig. 10 is a specific implementation of an electronic device in an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

In the prior art, real-time threshold monitoring deployed on a system can pre-warn a resource utilization rate peak value to a certain extent, but the pre-warning degree is limited, and in addition, the pre-warning effect is lacked for the conditions that a numerical value suddenly increases and the peak value simultaneously pierces through a pre-warning threshold value and an actual limit value.

In order to solve the above problem, the present application provides a systematic risk prediction method based on classification tag sequence matching, as shown in fig. 1, including:

s101: and matching the real-time acquired system resource utilization rate value with the corresponding label.

In a specific embodiment, historical data of a certain index is received in real time from a system that needs to be predicted, so as to be used for prediction in a matching prediction process, taking the resource utilization rate of a CPU as an example, as shown in fig. 2, the historical data is a resource utilization rate (percentage) trend graph of each hour within a certain period of time of the CPU. In practice, a reasonable time interval T needs to be preset, the current system resource utilization rate value is obtained every T periods, and the corresponding label is matched according to the value interval where the value is located.

S102: and generating a current label sequence character string according to the preset time window length and the label.

In a specific embodiment, a reasonable time window length is preset, for example, the time window length is K, then the current time n-1 is traced back to n-K, and the label corresponding to the system resource utilization rate value at each time n-1 and n-2 … n-K is recorded to generate the current label sequence character string.

S103: and screening the historical label sequence character string to obtain a sub label sequence character string consistent with the current label sequence character string.

In one embodiment, all tag sequence strings consistent with the current tag sequence string are searched from the historical tag sequence strings, which are called as "sub-tag sequence strings", and these sub-tag sequence strings are the prediction basis for the system resource utilization at the future time.

S104: and performing system risk prediction by using the sub-label sequence character string.

And predicting the utilization rate of system resources at a future moment by using the rule of the character string of the word tag sequence found in the step S103, and then judging whether the prediction result has risk or not.

The execution main body of the method shown in fig. 1 can be a PC, a terminal, and the like, and by dividing data according to the type of the interval and matching the corresponding tags, rather than matching the continuous numbers, the interference of noise can be effectively eliminated, and not only the anti-interference performance can be improved, but also the success rate of prediction can be improved. The method and the device are suitable for predicting system indexes, and technicians can take measures for possible risks in advance through prediction results.

In an embodiment, if all the sub-tag sequence strings are found, the value (history) of the system resource usage at the next time corresponding to the sub-tag sequence string can be found, and the current system resource usage at the next time can be calculated (predicted) according to the system resource usage values in the history.

In an embodiment, matching the real-time obtained system resource usage value with the corresponding tag, as shown in fig. 3, includes:

s301: and determining the value interval of the system resource utilization rate value.

In one embodiment, the range of variation of the value X is divided into several intervals, each interval being considered as a class, as shown in Table 1 below:

TABLE 1

Interval(s)	A₁	A₂	A₃	...	A_j	...	A_m
								Label (R)	1	2	3	...	j	...	m

If the number X falls on A_jWithin the interval, the data is marked with a label j and marked as [ X ]]＝j。

The sequence of values thus corresponds to the sequence of tags as shown in table 2 below, and these two sequences are used to predict the value at time n.

TABLE 2

X₁

X₂

X₃

...

X_i

...

X_n-1

[X₁]

[X₂]

[X₃]

...

[X_i]

...

[X_n-1]

S302: and matching a corresponding label for the system resource utilization rate value according to a pre-generated value interval and label mapping relation table.

In one embodiment, it is assumed that the obtained system resource usage value in a certain period of time is as follows:

[29.78, 29.99, 31.06, 30.75, 32.04, 31.09, 29.73, 31.15, 32.37, 32.47, 28.86, 29.88, 31.1] in%.

Assume that the mapping relationship table of the pre-generated value intervals and labels is shown in table 3 below:

TABLE 3

According to the mapping relationship table between the numerical intervals and the labels, when the utilization rate of the system resources is 29.78%, the label corresponding to the numerical interval is J. Therefore, the tag corresponding to the system resource utilization rate in a certain period of time can be converted into a tag sequence string S, where S is jjnmqnrsgjn.

In an embodiment, generating the current tag sequence string according to the preset time window length and the tag, as shown in fig. 4, includes:

s401: and acquiring all system resource utilization rate values and corresponding labels within the length of the time window.

S402: and sequencing the labels according to time to generate a label sequence character string.

In a specific embodiment, the length of the time window is set to be 2, the time n-1 is the time shown in the following table 4, 2 time units are traced from the time n-1 to be one time window, and as shown in the frame in the following table 4, the tag sequence character string s, s ═ JN within the length of the time window is obtained.

TABLE 4

In one embodiment, predicting the system resource usage prediction value at the next time based on the sub-tag sequence string, as shown in fig. 5, includes:

s501: and obtaining the historical value of the utilization rate of the system resources at the next moment of the sub-label character string and the current value of the utilization rate of the system resources.

S502: and averaging the historical values of the utilization rates of all the system resources and the current values of the utilization rates of the system resources to obtain a predicted value of the utilization rates of the system resources.

In a specific embodiment, the matching number of the current tag sequence string S in the historical tag sequence string S is set to N. Let the predicted value at time n be

Tracing back from the time n-1 on the time axis, and searching the position of the sub-label character string S' which is the same as the current label sequence character string S in the S. Each time the position of s 'is found, the value of s' at the next moment is added as one of the predicted values

The matching times N are accumulated by 1. And when the time axis is traced back to the starting point, the matching is finished.

To pair

Taking an average value:

(here, the term "is used in the meaning of" assignment "in computer language) to obtain the predicted value at the time n

At the beginning of the match, N is initialized to 1,

initialized to the value at time n-1, and obtained according to the equation

The value of the time n-1 means the value of the next time predicted by the current time and the label range corresponding to the predicted value.

For example, assuming that the current tag sequence string s is JN (the current time is n-1 and the time window length is 2), the same substring as s is found from the history tag string, as shown in table 5 below:

TABLE 5

In the S-tag string, matching is performed on the S-string, and it can be found that, on the whole time axis, the tag strings of two time windows can be matched with S, which are time n-7 to n-6 and time n-12 to n-11, respectively.

And obtaining a matching result from the matching process, wherein the three time windows of the time n-11, the time n-6 and the time n-1 have relatively similar historical trends.

In a piece of paperThe accumulation process in the preparation process is as follows:

initialization

Is the value at time n-1, i.e.

N＝1。

Find time windows n-7 to n-6, accumulate the values at time n-5, i.e.

N＝2。

Find the time windows n-12 to n-11, accumulate the values at time n-10, i.e.

N＝3。

To obtain finally

Namely, the predicted value of the resource utilization rate at the time n (next hour) is 32.07, and the predicted value belongs to the range of the label Q: 31.8-32.1.

In another embodiment, the numerical value of the next time of each sub-tag character string s 'may also be obtained, assuming that the number of the sub-tag character strings is 2, and the numerical value of the next time of each sub-tag character string s' is X respectively₁And X₂Then system resource usage prediction value

I.e., taking an average value, which is not limited in this application.

Based on the same inventive concept, the embodiment of the present application further provides a system risk prediction apparatus based on classification tag sequence matching, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Because the problem solving principle of the system risk prediction device based on the classification tag sequence matching is similar to that of the system risk prediction method based on the classification tag sequence matching, the implementation of the system risk prediction device based on the classification tag sequence matching can refer to the implementation of the system risk prediction method based on the classification tag sequence matching, and repeated parts are not repeated. As used hereinafter, the term "unit" or "module" may be a combination of software and/or hardware that implements a predetermined function. While the system described in the embodiments below is preferably implemented in software, implementations in hardware, or a combination of software and hardware are also possible and contemplated.

As shown in fig. 6, the present application provides a system risk prediction device based on classification tag sequence matching, including:

a tag matching unit 601, configured to match a corresponding tag with a system resource utilization rate value obtained in real time;

a current tag sequence string generating unit 602, configured to generate a current tag sequence string according to a preset time window length and a tag;

a screening unit 603 configured to screen a sub-tag sequence character string that is consistent with the current tag sequence character string from the historical tag sequence character string;

and a risk prediction unit 604, configured to perform system risk prediction by using the sub-tag sequence character string.

In an embodiment, the risk prediction unit 604 comprises:

In one embodiment, as shown in fig. 7, the tag matching unit 601 includes:

an interval determining module 701, configured to determine a value interval in which the system resource usage rate value is located;

a matching module 702, configured to match a corresponding tag for the system resource utilization value according to a pre-generated value interval and tag mapping relationship table.

In one embodiment, as shown in fig. 8, the current tag sequence character string generating unit 602 includes:

an obtaining module 801, configured to obtain all system resource usage rate values and corresponding tags within a time window length;

and a sorting generation module 802, configured to sort the tags according to time to generate a tag sequence character string.

In one embodiment, as shown in fig. 9, the determining module includes:

a value obtaining module 901, configured to obtain a historical value of the system resource usage rate and a current value of the system resource usage rate at a next time of the sub tag character string;

an average value calculating module 902, configured to average historical values of the usage rates of all system resources and current values of the usage rates of the system resources to obtain a predicted value of the usage rates of the system resources.

The sampling data in the application are all sample data of the same time span, and the prediction of the next time span moment is realized. By adjusting the time span, the lead of the predicted value can be adjusted to adjust the lead of the risk pre-warning, such as predicting the peak value of the resource utilization rate in the next hour or predicting the peak value of the resource utilization rate in the next day.

When the source of the sampled data changes fundamentally, the success rate of prediction is reduced, for example, the traffic of a system to be predicted increases, which leads to a general increase in resource utilization rate. The prediction success rate can be reset by resetting the interval range of the numerical division and adjusting the time window length k. Thus, in use, a certain number of parameter setting schedules may be preset.

The principle and the implementation mode of the invention are explained by applying specific embodiments in the invention, and the description of the embodiments is only used for helping to understand the method and the core idea of the invention; meanwhile, for a person skilled in the art, according to the idea of the present invention, there may be variations in the specific embodiments and the application scope, and in summary, the content of the present specification should not be construed as a limitation to the present invention.

An embodiment of the present application further provides a specific implementation manner of an electronic device capable of implementing all steps in the method in the foregoing embodiment, and referring to fig. 10, the electronic device specifically includes the following contents:

a processor (processor)1301, a memory 1302, a Communications Interface (Communications Interface)1303, a bus 1304, and a non-volatile memory 1305;

the processor 1301, the memory 1302 and the communication interface 1303 complete communication with each other through the bus 1304;

the processor 1301 is configured to call the computer programs in the memory 1302 and the non-volatile storage 1305, and the processor implements all the steps of the method in the above embodiments when executing the computer programs, for example, the processor implements the following steps when executing the computer programs:

Embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps of the method in the above embodiments, where the computer-readable storage medium stores thereon a computer program, and the computer program when executed by a processor implements all the steps of the method in the above embodiments, for example, the processor implements the following steps when executing the computer program:

The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the hardware + program class embodiment, since it is substantially similar to the method embodiment, the description is simple, and the relevant points can be referred to the partial description of the method embodiment. Although embodiments of the present description provide method steps as described in embodiments or flowcharts, more or fewer steps may be included based on conventional or non-inventive means. The order of steps recited in the embodiments is merely one manner of performing the steps in a multitude of orders and does not represent the only order of execution. When an actual apparatus or end product executes, it may execute sequentially or in parallel (e.g., parallel processors or multi-threaded environments, or even distributed data processing environments) according to the method shown in the embodiment or the figures. The terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, the presence of additional identical or equivalent elements in a process, method, article, or apparatus that comprises the recited elements is not excluded. For convenience of description, the above devices are described as being divided into various modules by functions, and are described separately. Of course, in implementing the embodiments of the present description, the functions of each module may be implemented in one or more software and/or hardware, or a module implementing the same function may be implemented by a combination of multiple sub-modules or sub-units, and the like. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and other divisions may be realized in practice, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form. The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

As will be appreciated by one skilled in the art, embodiments of the present description may be provided as a method, system, or computer program product. Accordingly, embodiments of the present description may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present description may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and so forth) having computer-usable program code embodied therein. The embodiments in the present specification are described in a progressive manner, and the same and similar parts among the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment. In the description herein, references to the description of "an embodiment," "a particular embodiment," etc., mean that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the embodiments herein.

In this specification, the schematic representations of the terms used above are not necessarily intended to refer to the same embodiment or example. Furthermore, various embodiments or examples and features of different embodiments or examples described in this specification can be combined and combined by one skilled in the art without contradiction. The above description is only an example of the embodiments of the present disclosure, and is not intended to limit the embodiments of the present disclosure. Various modifications and variations to the embodiments described herein will be apparent to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiments of the present specification should be included in the scope of the claims of the embodiments of the present specification.

Claims

1. A system risk prediction method based on classification label sequence matching is characterized by comprising the following steps:

generating a current label sequence character string according to a preset time window length and the label;

screening a sub-label sequence character string consistent with the current label sequence character string from the historical label sequence character string;

2. The method of claim 1, wherein the using the sub-tag sequence string for system risk prediction comprises:

and obtaining a system resource utilization rate predicted value at the next moment by using the sub-label sequence character string, and judging whether the system resource utilization rate predicted value exceeds a preset risk value.

3. The method of claim 1, wherein matching the real-time derived system resource usage value to a corresponding tag comprises:

4. The method of claim 1, wherein the generating a current tag sequence string according to a preset time window length and the tag comprises:

and sequencing the labels according to time to generate the label sequence character string.

5. The method of claim 2, wherein predicting the predicted value of the system resource usage at the next time based on the sub-tag sequence string comprises:

6. A system risk prediction device based on classification tag sequence matching, comprising:

the current label sequence character string generating unit is used for generating a current label sequence character string according to a preset time window length and the label;

and the risk prediction unit is used for performing system risk prediction by utilizing the sub-label sequence character string.

7. The system risk prediction device of claim 6, wherein the risk prediction unit comprises:

and the judging module is used for obtaining a system resource utilization rate predicted value at the next moment by utilizing the sub-label sequence character string and judging whether the system resource utilization rate predicted value exceeds a preset risk value or not.

8. The system risk prediction device of claim 6, wherein the tag matching unit comprises:

the interval determining module is used for determining a value interval in which the system resource utilization rate value is positioned;

and the matching module is used for matching the corresponding label for the system resource utilization rate value according to a pre-generated value interval and label mapping relation table.

9. The system risk prediction device of claim 6, wherein the current tag sequence string generation unit comprises:

and the sequencing generation module is used for sequencing the labels according to time to generate the label sequence character string.

10. The system risk prediction device of claim 7, wherein the determination module comprises:

11. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the method for systematic risk prediction based on class-tag sequence matching of any of claims 1-5 when executing the program.

12. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, implements the system risk prediction method based on classification tag sequence matching according to any one of claims 1 to 5.