CN106502815A - A kind of abnormal cause localization method, device and computing device - Google Patents
A kind of abnormal cause localization method, device and computing device Download PDFInfo
- Publication number
- CN106502815A CN106502815A CN201610917403.1A CN201610917403A CN106502815A CN 106502815 A CN106502815 A CN 106502815A CN 201610917403 A CN201610917403 A CN 201610917403A CN 106502815 A CN106502815 A CN 106502815A
- Authority
- CN
- China
- Prior art keywords
- index
- performance
- anomalous
- performance indications
- reason
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
Abstract
The invention discloses a kind of abnormal cause localization method, executes in computing device, when being suitable to occur anomalous performance index in Devices to test, the reason for causing the anomalous performance index to occur abnormal performance indications are found out, the method includes：Obtain the time serieses of the observation of anomalous performance index and multiple performance indications；According to the dependency that time serieses calculate each performance indications and anomalous performance index respectively, performance indications of the dependency more than first threshold are added the first index set；Calculate the causality of each performance indications in the first index set and anomalous performance index respectively, performance indications of the causality more than Second Threshold are added the second index set；The reason for determining each performance indications in the second index set according to dependency and causality respectively score value；The reason for anomalous performance index is determined according to reason score value performance indications.The invention also discloses the abnormal cause positioner of said method can be implemented, and the computing device including said apparatus.
Description
Technical field
The present invention relates to computing device performance monitoring technical field, more particularly to a kind of abnormal cause localization method, application
And computing device.
Background technology
With the development of information technology, various applications, website are emerged in an endless stream, and the performance of computing device are proposed higher
Require.Property indices are monitored, the running status of computing device are obtained in real time and is investigated exception, be to improve which to calculate
The steps necessary of performance.In general, when the performance indications of monitoring include cpu busy percentage, memory usage, handling capacity, response
Between, etc..In monitoring, at set intervals each performance indications are once sampled, therefore, the monitoring of each performance indications
As a result the time serieses being made up of multiple observations are rendered as.
Need to arrange multiple monitored performance indications generally, for a Devices to test, these performance indications it
Between there may be contact.When monitoring certain performance indications appearance and being abnormal, need to investigate other performance indications, look for
The reason for performance indications of sening as an envoy to occur abnormal.In existing solution, abnormal cause is carried out by operation maintenance personnel often
Investigation, monitoring performance indications more in the case of, this mode will expend substantial amounts of manpower and time, and efficiency is low, and
As a result also it is generally difficult to satisfactory.Some are there is also in prior art for detecting dependency and causal algorithm, can
Certain help is brought to the investigation of abnormal cause.But, whether existing correlation detection algorithm can only judge two indices
Relevant, and whether cannot learn an index be another index the reason for.Existing causality algorithm is only capable of drawing certain
The probability of the reason for index is another index, and whether related cannot draw between the two indexs, detect only with cause and effect
Algorithm easily causes the wrong report of reason, and accuracy rate is not high.Additionally, existing causality detection algorithm often time complexity ratio
Higher, when data volume is more, judge that causality will take a substantial amount of time, it is difficult to realize real-time detection.
Content of the invention
For this purpose, the present invention provides a kind of abnormal cause localization method, device and computing device, solved with trying hard to or at least delayed
The problem that solution is present above.
According to an aspect of the present invention, there is provided a kind of abnormal cause localization method, execute in computing device, be suitable to
When occurring anomalous performance index in Devices to test, the reason for causing the anomalous performance index to occur abnormal performance indications are found out, should
Method includes：Obtain the time serieses of the observation of anomalous performance index and multiple performance indications；Counted according to time serieses respectively
The dependency of each performance indications and anomalous performance index is calculated, first threshold will be more than with the dependency of anomalous performance index
Performance indications add the first index set；Calculate respectively each performance indications in the first index set and anomalous performance index because
Performance indications with the causality of anomalous performance index more than Second Threshold are added the second index set by fruit property；According to dependency
The reason for determining each performance indications in the second index set with causality respectively score value, reason score value are used for representing that performance refers to
It is designated as the probability of reason performance indications；The reason for anomalous performance index is determined according to reason score value performance indications.
Alternatively, in the abnormal cause localization method according to the present invention, dependency is calculated according to below equation：
Wherein, numbers of the n for included observation in time serieses, x represent performance indications, xiFor performance indications x
I-th observation in time serieses,For the meansigma methodss of the observation in the time serieses of performance indications x, y represents abnormity
Energy index, yiFor i-th observation in the time serieses of anomalous performance index y,Time serieses for anomalous performance index y
In observation meansigma methodss.
Alternatively, in the abnormal cause localization method according to the present invention, causality is calculated according to following steps：Set up with
Lower two regression models：
Model one：y1t=a0+a1yt-1+a2yt-2+…+amyt-m
Model two：y2t=b0+b1yt-1+b2yt-2+…+bmyt-m+c0+c1xt-1+c2xt-2+…+cmxt-m
Wherein, yt-1For anomalous performance index y (t-1) moment observation, xt-1It is performance indications x at (t-1) moment
Observation, m be delayed item number, a0～am、b0～bm、c0～cmIt is undetermined coefficient；Referred to according to anomalous performance index y and performance
The time serieses of mark x solve above-mentioned regression model, determine undetermined coefficient a0～am、b0～bm、c0～cmValue；According to below equation
Calculate F test values：
Wherein, the RSS1For the residual sum of squares (RSS) of model one, RSS2For the residual sum of squares (RSS) of model two, m is delayed item
Number, n are the number of included observation in time serieses；
RSS1、RSS2Calculate according to below equation respectively：
Wherein, ytFor anomalous performance index y t observation, y1tIt is that the anomalous performance obtained according to model one refers to
Predictive values of the mark y in t, y2tIt is the predictive value of the anomalous performance index y that obtained according to model two in t；Checked according to F
Value determines significance p_value；By (1-p_value) as performance indications x and the causality of anomalous performance index y.
Alternatively, in the abnormal cause localization method according to the present invention, significance p_value can pass through inquiry significantly
Property level draw for the F-distribution tables of critical values of (1- Second Thresholds), wherein, when the F-distribution tables of critical values is inquired about, freely
Spend for (m, n-2m-1).
Alternatively, in the abnormal cause localization method according to the present invention, significance p_value can be according to below equation
Calculate：
P_value=1-P (F test values)
Wherein, P (z) is the cumulative distribution function of the F-distribution that degree of freedom is (m, n-2m-1), and P (F test values) is accumulation
Value of distribution function P (z) in z=F test values.
Alternatively, in the abnormal cause localization method according to the present invention, reason score value is determined according to below equation：
Score=w1* dependency+w2* causality
Wherein, 0≤w1≤ 1,0≤w2≤ 1, w1+w2=1.
Alternatively, in the abnormal cause localization method according to the present invention, w1=w2=0.5.
Alternatively, in the abnormal cause localization method according to the present invention, anomalous performance index is determined according to reason score value
The reason for performance indications can in the following ways in any one：By the performance indications that reason score value in the second index set is maximum
As reason performance indications；Performance indications of the reason score value in second index set more than the 3rd threshold value are referred to as reason performance
Mark；The performance indications of fixed qty are taken out from the second index set as reason performance according to reason score value order from big to small
Index；By each performance indications in the second index set and its corresponding dependency, causality, reason score value according to reason score value from
Little Sequential output is arrived greatly, so that user therefrom selects reason performance indications.
According to an aspect of the present invention, there is provided a kind of abnormal cause positioner, reside in computing device, be suitable to
When occurring anomalous performance index in Devices to test, the reason for causing the anomalous performance index to occur abnormal performance indications are found out,
The device includes：Data acquisition module, is suitable to the time serieses of the observation of acquisition anomalous performance index and multiple performance indications；
First analysis module, is suitable to calculate each performance indications respectively according to the time serieses related to anomalous performance index
Property, the performance indications with the dependency of anomalous performance index more than first threshold are added the first index set；Second analysis module,
The causality for calculating each performance indications in the first index set and anomalous performance index respectively is suitable to, will be referred to anomalous performance
Target causality adds the second index set more than the performance indications of Second Threshold；Reason locating module, is suitable to according to the correlation
The reason for property and causality determine each performance indications in the second index set respectively score value, and true according to the reason score value
The reason for determining anomalous performance index performance indications.
According to an aspect of the present invention, there is provided a kind of computing device, including abnormal cause positioner as above.
Technology according to the present invention scheme, first, by calculating each performance indications and the dependency of anomalous performance index, looks for
Go out the performance indications being associated with anomalous performance index, form the first index set；Subsequently, each in the first index set is calculated
Performance indications and the causality of anomalous performance index, find out the stronger performance indications of cause effect relation between anomalous performance index,
Form the second index set；Subsequently, the reason for determining each performance indications in the second index set according to dependency and causality
Score value, and performance indications the reason for determine anomalous performance index according to reason score value.
Dependency as causal essential condition, is divided three steps (dependency, causality, original by technical scheme
Because of score value) determining reason performance indications, improve the accuracy of reason positioning result.Additionally, the present invention is using screening twice
Technical scheme：First, the part performance indications unrelated with anomalous performance index are screened out by correlation test, will be with exception
The related index of performance indications adds the first index set, and the time complexity of the algorithm is only O (N)；Second, examined by causality
Test, there will be causal index to add the second index set, the calculation with anomalous performance index
The time complexity of method is O (N^2).Above scheme is avoided
Time for being brought of causality waste and computing resource consumption, save the calculating time, real-time abnormal cause can be realized
Positioning.When performance indications to be measured are more, the advantage of this programme can become apparent from.
Description of the drawings
In order to realize above-mentioned and related purpose, some illustrative sides are described herein in conjunction with explained below and accompanying drawing
Face, indicate in terms of these can be to put into practice principles disclosed herein various modes, and all aspects and its equivalent aspect
It is intended to fall under in the range of theme required for protection.By being read in conjunction with the accompanying detailed description below, the disclosure above-mentioned
And other purposes, feature and advantage will be apparent from.Throughout the disclosure, identical reference generally refers to identical
Part or element.
Fig. 1 shows the schematic diagram of abnormal cause alignment system 100 according to an embodiment of the invention；
Fig. 2 shows the structure chart of computing device according to an embodiment of the invention 200；
Fig. 3 shows the structure chart of abnormal cause positioner 300 according to an embodiment of the invention；
The flow chart that Fig. 4 shows abnormal cause localization method 400 according to an embodiment of the invention.
Specific embodiment
The exemplary embodiment of the disclosure is more fully described below with reference to accompanying drawings.Although the disclosure is shown in accompanying drawing
Exemplary embodiment, it being understood, however, that may be realized in various forms the disclosure and should not be by embodiments set forth here
Limited.On the contrary, there is provided these embodiments are able to be best understood from the disclosure, and can be by the scope of the present disclosure
Complete conveys to those skilled in the art.
Fig. 1 shows the schematic diagram of abnormal cause alignment system 100 according to an embodiment of the invention.As shown in figure 1,
Abnormal cause alignment system 100 includes computing device 200 and multiple 1～N of Devices to test.It should be pointed out that the exception shown in Fig. 1
Reason alignment system 100 is only exemplary, in specific practice situation, can have in abnormal cause alignment system 100
The computing device of varying number and Devices to test, computing device and Devices to test can also be resided in multiple geographical position, this
Invention is not limited to the configuration mode of included computing device in abnormal cause alignment system and Devices to test.
Computing device 200 can be implemented as server, such as file server, database server, application program service
Device and WEB server etc., it is also possible to be embodied as the personal computer for including desktop computer and notebook computer configuration.This
Outward, computing device 200 is also implemented as a part for portable (or mobile) electronic equipment of small size, and these electronic equipments can
Being such as cell phone, personal digital assistant (PDA), personal media player device, wireless network browsing apparatus, the individual number of people
Wear equipment, application specific equipment or the mixing apparatus of any of the above function can be included.Devices to test can be desktop electricity
The equipment with operational capability such as brain, notebook computer, panel computer, mobile phone.
Computing device 200 can be connected with one or more Devices to tests, to gather the performance indications number of each Devices to test
According to and when detecting certain Devices to test and anomalous performance index occur, finding out that to cause the anomalous performance index to occur abnormal
Reason performance indications.According to a kind of preferred embodiment, it is also possible to come by other computing devices in addition to computing device 200
The acquired original of performance achievement data is realized, and by the data storage for collecting to data base, computing device 200 is from data base
The information for needing is obtained, to find out the reason for causing anomalous performance index to occur abnormal performance indications.
Fig. 2 shows the structure chart of computing device according to an embodiment of the invention 200.In basic configuration 202, meter
Calculation equipment 200 typically comprises system storage 206 and one or more processor 204.Memory bus 208 can be used for
Communication between processor 204 and system storage 206.
Desired configuration is depended on, processor 204 can be any kind of process, including but not limited to：Microprocessor
(μ P), microcontroller (μ C), digital information processor (DSP) or any combination of them.Processor 204 can be included such as
The cache of one or more rank of on-chip cache 210 and second level cache 212 etc, processor core
214 and depositor 216.The processor core 214 of example can include arithmetic and logical unit (ALU), floating-point unit (FPU),
Digital signal processing core (DSP core) or any combination of them.The Memory Controller 218 of example can be with processor
204 are used together, or in some implementations, Memory Controller 218 can be an interior section of processor 204.
Desired configuration is depended on, system storage 206 can be any type of memorizer, including but not limited to：Easily
The property lost memorizer (RAM), nonvolatile memory (ROM, flash memory etc.) or any combination of them.System is stored
Device 206 can include operating system 220, one or more application 222 and routine data 224.In some embodiments,
Application 222 may be arranged to be operated using routine data 224 on an operating system.
Computing device 200 can also include contributing to from various interface equipments (for example, outut device 242, Peripheral Interface
244 and communication equipment 246) to basic configuration 102 via the communication of bus/interface controller 230 interface bus 240.Example
Outut device 242 include Graphics Processing Unit 248 and audio treatment unit 250.They can be configured to contribute to via
One or more A/V port 252 is communicated with the various external equipments of such as display or speaker etc.Outside example
If interface 244 can include serial interface controller 254 and parallel interface controller 256, they can be configured to contribute to
Via one or more I/O port 258 and such as input equipment (for example, keyboard, mouse, pen, voice-input device, touch
Input equipment) or the external equipment of other peripheral hardwares (such as printer, scanner etc.) etc communicated.The communication of example sets
Standby 246 can include network controller 260, and which can be arranged to be easy to via one or more COM1 264 and
Other communications of computing device 262 by network communication link individual or multiple.
Network communication link can be an example of communication media.Communication media can be generally presented as in such as carrier wave
Or the computer-readable instruction in the modulated data signal of other transmission mechanisms etc, data structure, program module, and can
To include any information delivery media." modulated data signal " can be with such signal, and in its data set is more
Individual or it change can the mode of coding information in the signal carry out.Used as nonrestrictive example, communication media can be with
Including the wire medium of such as cable network or private line network etc and such as sound, radio frequency (RF), microwave, infrared
Or other wireless mediums are in interior various wireless mediums (IR).Term computer-readable medium used herein can include depositing
Both storage media and communication media.
In the present invention, the application 222 of computing device 200 includes abnormal cause positioner 300 so that computing device
100 when can there is anomalous performance index in Devices to test, and finding out causes the anomalous performance index abnormal the reason for property occur
Can index.Abnormal cause positioner 300 can reside at the browser of computing device 200 as search engine plug-in unit
In, or as an independent software installation in computing device 200, the present invention depositing in computing device 200 to device 300
It is not limited in form.
Fig. 3 shows the structure chart of abnormal cause positioner 300 according to an embodiment of the invention.As shown in figure 3,
Abnormal cause positioner 300 includes data acquisition module 310, the first analysis module 320, the second analysis module 330 and reason
Locating module 340.
Data acquisition module 310 is suitable to the time serieses of the observation for obtaining anomalous performance index and multiple performance indications.
Certainly, data acquisition module 310 need not obtain the time serieses being made up of whole observations, and only obtain current by distance
The time serieses constituted by moment nearest multiple observations.According to a kind of embodiment, data acquisition module 310 is suitable to obtain
Take by the time serieses constituted apart from 180 nearest observations of current time, i.e. seasonal effect in time series length was 180 (times
The length of sequence is the number of included observation in the time serieses).Certainly, in other examples, time sequence
The length of row can also be set as other numerical value, and the present invention is simultaneously unrestricted to this.
Time serieses of the data acquisition module 310 in the observation for obtaining anomalous performance index and multiple performance indications
Afterwards, each time serieses are sent to the first analysis module 320, is calculated according to time serieses respectively by the first analysis module 320
The dependency of each performance indications and anomalous performance index, and will be with the dependency of anomalous performance index more than first threshold
Performance indications add the first index set.
According to a kind of embodiment, the first analysis module is suitable to calculate dependency according to below equation：
Wherein, numbers of the n for included observation in time serieses, x represent performance indications, xiFor performance indications x
I-th observation in time serieses,For the meansigma methodss of the observation in the time serieses of performance indications x, y represents abnormity
Energy index, yiFor i-th observation in the time serieses of anomalous performance index y,Time serieses for anomalous performance index y
In observation meansigma methodss.
According to a kind of embodiment, first threshold can be set to 0.7.Certainly, in a further embodiment, it is also possible to by first
Threshold value is set to the numerical value in the range of 0.6,0.8 etc. other [0,1], it is preferable that positioning result the reason in order to ensure accurate, and first
Threshold value value in the range of [0.5,1] is preferred.
First analysis module 320 passes through the dependency for calculating each performance indications and anomalous performance index, and will be with abnormity
The dependency of energy index adds the first index set more than the performance indications of first threshold.Subsequently, the first analysis module 320 is by first
The time serieses of each performance indications in index set are sent to the second analysis module 330, and the second analysis module 330 calculates respectively
Each performance indications in one index set and the causality of anomalous performance index, will be more than with the causality of anomalous performance index
The performance indications of Second Threshold add the second index set.
According to a kind of embodiment, the second analysis module 330 is suitable to calculate causality according to following steps：
1) following two regression models are set up：
Model one：y1t=a0+a1yt-1+a2yt-2+…+amyt-m
Model two：y2t=b0+b1yt-1+b2yt-2+…+bmyt-m+c0+c1xt-1+c2xt-2+…+cmxt-m
Wherein, yt-1For anomalous performance index y (t-1) moment observation, xt-1It is performance indications x at (t-1) moment
Observation, m be delayed item number, a0～am、b0～bm、c0～cmIt is undetermined coefficient.According to a kind of embodiment, m=2, certainly,
In other examples, m can also be other numerical value, of the invention without limitation.
2) above-mentioned two regression model is solved according to the time serieses of anomalous performance index y and performance indications x, determine undetermined
Coefficient a0～am、b0～bm、c0～cmValue.According to a kind of embodiment, above-mentioned two model is entered respectively using method of least square
Row linear regression, draws undetermined coefficient a0～am、b0～bm、c0～cmValue.Certainly, in addition, it would however also be possible to employ its other party
Method is solving a0～am、b0～bm、c0～cm, of the invention without limitation.
3) F test values are calculated according to below equation：
Wherein, m is delayed item number, and n is the number of included observation in time serieses, according to a kind of embodiment, m=
2, n=180.RSS1For the residual sum of squares (RSS) of model one, RSS2For the residual sum of squares (RSS) of model two, have：
Wherein, ytFor anomalous performance index y t observation, y1tIt is that the anomalous performance obtained according to model one refers to
Predictive values of the mark y in t, y2tIt is the predictive value of the anomalous performance index y that obtained according to model two in t.
4) significance p_value is determined according to F test values.According to a kind of embodiment, the calculation of significance p_value
Have following two：
The first：It is critical for the F-distribution of (1- Second Thresholds) that significance p_value can pass through inquiry significance level
Value table draws, wherein, when the F-distribution tables of critical values is inquired about, degree of freedom is (m, n-2m-1).For example, work as Second Threshold
When=0.85, m=2, n-2m-1=175, in the F-distribution tables of critical values that significance level is 0.15, inquiry degree of freedom is
(2, F marginal values when 175), the marginal value are p_value.
Second：Significance p_value can be calculated according to below equation：
P_value=1-P (F test values) (5)
Wherein, P (z) is the cumulative distribution function of the F-distribution that degree of freedom is (m, n-2m-1), and P (F test values) is accumulation
Value of distribution function P (z) in z=F test values.
Formula (5) can also be converted into following form：
Wherein, p (z) is the probability density function of the F-distribution that degree of freedom is (m, n-2m-1).To p (z) interval (-
∞, F test value) on quadrature, equivalent to seeking values of the P (z) in z=F test values.
5) by (1-p_value) as performance indications x and the causality of anomalous performance index y.
Second analysis module 330 calculates each performance indications and anomalous performance index in the first index set according to above step
Causality, and the performance indications with the causality of anomalous performance index more than Second Threshold are added the second index set.According to one
Embodiment is planted, Second Threshold is 0.85.Certainly, in other examples, Second Threshold can also be set to other numerical value, this
Bright without limitation.
After second analysis module 330 calculates the second index set, by reason locating module 340 based on dependency and cause and effect
The reason for property determines each performance indications in the second index set respectively score value, and anomalous performance is determined according to reason score value refer to
Target reason performance indications.
According to a kind of embodiment, reason locating module 340 determines each property in the second index set respectively according to below equation
Can index the reason for score value：
Score=w1* dependency+w2* causality (7)
Wherein, w1、w2Respectively dependency, causal weight, have 0≤w1≤ 1,0≤w2≤ 1, w1+w2=1.w1、w2's
Concrete value can be voluntarily arranged by those skilled in the art, according to a kind of embodiment, w1=w2=0.5.
In the second index set is calculated the reason for each performance indications after score value, reason locating module 340 is according to reason
The reason for score value is to determine anomalous performance index performance indications.According to a kind of embodiment, reason locating module 340 can adopt with
Any one under type is determining reason performance indications：Using the maximum performance indications of reason score value in the second index set as original
Because of performance indications；Reason score value in second index set is more than the performance indications of the 3rd threshold value as reason performance indications；According to
Reason score value order from big to small takes out the performance indications of fixed qty from the second index set as reason performance indications；Will
Each performance indications and its corresponding dependency, causality, reason score value in second index set according to reason score value from big to small
Sequential output, therefrom select reason performance indications so as to user.Certainly, reason performance indications are determined according to reason score value
Mode has many kinds, however it is not limited to which 4 kinds of modes listed above, those skilled in the art can voluntarily arrange reason performance indications
System of selection.
The flow chart that Fig. 4 shows abnormal cause localization method 400 according to an embodiment of the invention.As shown in figure 4,
The method starts from step S410.
In step S410, the time serieses of the observation of anomalous performance index and multiple performance indications are obtained.According to one
Kind of embodiment, each time series by by constituting apart from 180 nearest observations of current time, i.e. seasonal effect in time series
Length is 180.
Subsequently, in the step s 420, each performance indications is calculated respectively with anomalous performance index according to time serieses
Performance indications with the dependency of anomalous performance index more than first threshold are added the first index set by dependency.According to one kind
Embodiment, dependency are calculated according to aforementioned formula (1), and first threshold is set to 0.7.
Subsequently, in step S430, each performance indications and anomalous performance index in the first index set are calculated respectively
Causality, will with the causality of anomalous performance index more than Second Threshold performance indications add the second index set.Step
The detailed process of S430 may be referred to the aforementioned description to the second analysis module 330, and here is omitted.
Subsequently, in step S440, determine each performance in the second index set according to dependency and causality respectively
The reason for index score value.According to a kind of embodiment, reason score value can be calculated according to formula (7), wherein, w1=w2=
0.5.
Subsequently, in step S450, performance indications the reason for determine anomalous performance index according to reason score value.According to one kind
Embodiment, can in the following ways in any one determining reason performance indications：By reason score value in the second index set
Maximum performance indications are used as reason performance indications；Performance indications of the reason score value in second index set more than the 3rd threshold value are made
For reason performance indications；The performance indications of fixed qty are taken out according to reason score value order from big to small from the second index set
As reason performance indications；Each performance indications in second index set and its corresponding dependency, causality, reason score value are pressed
According to reason score value Sequential output from big to small, so that user therefrom selects reason performance indications.
When technical scheme anomalous performance index can occur in Devices to test, finding out causes the anomalous performance
The reason for index occurs abnormal performance indications, that is, realize the positioning of abnormal cause.The present invention using dependency as causal must
Condition is wanted, is divided three steps (dependency, causality, reason score value) to determine reason performance indications, is improve reason positioning result
Accuracy.Additionally, the technical scheme that screens twice (screens out the part property unrelated with anomalous performance index by correlation test
Energy index, is checked by causality and screen out again a part of performance indications) it also avoid whether directly investigating each performance indications
The time brought by reason performance indications wastes and computing resource consumption, saves operation time.
A6：Abnormal cause localization method described in A1, wherein, the reason score value is determined according to below equation：
Score=w1* dependency+w2* causality
Wherein, 0≤w1≤ 1,0≤w2≤ 1, w1+w2=1.
A7：Abnormal cause localization method described in A6, wherein, w1=w2=0.5.
A8：Abnormal cause localization method described in A1, wherein, according to the original that the reason score value determines anomalous performance index
Because performance indications can in the following ways in any one：
Using the maximum performance indications of reason score value in the second index set as reason performance indications；
Reason score value in second index set is more than the performance indications of the 3rd threshold value as reason performance indications；
The performance indications of fixed qty are taken out from the second index set as original according to reason score value order from big to small
Because of performance indications；
By each performance indications in the second index set and its corresponding dependency, causality, reason score value according to reason point
Value Sequential output from big to small, so that user therefrom selects reason performance indications.
B13：Abnormal cause positioner described in B11, wherein, significance p_value can be calculated according to below equation：
P_value=1-P (F test values)
Wherein, P (z) is the cumulative distribution function of the F-distribution that degree of freedom is (m, n-2m-1), and P (F test values) is accumulation
Value of distribution function P (z) in z=F test values.
B14：Abnormal cause positioner described in B9, wherein, the reason locating module is suitable to true according to below equation
The fixed reason score value：
Score=w1* dependency+w2* causality
Wherein, 0≤w1≤ 1,0≤w2≤ 1, w1+w2=1.
B15：Abnormal cause positioner described in B14, wherein, w1=w2=0.5.
B16：Abnormal cause positioner described in B9, wherein, the reason locating module is suitable for use with the following manner
Any one determining reason performance indications：
Using the maximum performance indications of reason score value in the second index set as reason performance indications；
Reason score value in second index set is more than the performance indications of the 3rd threshold value as reason performance indications；
The performance indications of fixed qty are taken out from the second index set as original according to reason score value order from big to small
Because of performance indications；
By each performance indications in the second index set and its corresponding dependency, causality, reason score value according to reason point
Value Sequential output from big to small, so that user therefrom selects reason performance indications.
In description mentioned herein, algorithm and show not with any certain computer, virtual system or other
Equipment is inherently related.Various general-purpose systems can also be used together with the example of the present invention.As described above, construct this kind of
Structure required by system is obvious.Additionally, the present invention is also not for any certain programmed language.It should be understood that can
To realize the content of invention described herein using various programming languages, and the above description done by language-specific be for
Disclose the preferred forms of the present invention.
In description mentioned herein, a large amount of details are illustrated.It is to be appreciated, however, that the enforcement of the present invention
Example can be put into practice in the case where not having these details.In some instances, known method, knot are not been shown in detail
Structure and technology, so as not to obscure the understanding of this description.
Similarly, it will be appreciated that in order to simplify the disclosure helping understand one or more in each inventive aspect,
Above in the description to the exemplary embodiment of the present invention, each feature of the present invention is grouped together into single enforcement sometimes
In example, figure or descriptions thereof.However, should not be construed to reflect following intention by the method for the disclosure：I.e. required guarantor
The feature more features is expressly recited in each claim by the application claims ratio of shield.More precisely, as following
As claims are reflected, inventive aspect is all features less than single embodiment disclosed above.Therefore, abide by
Thus the claims for following specific embodiment are expressly incorporated in the specific embodiment, wherein each claim itself
Separate embodiments as the present invention.
Those skilled in the art should be understood the module of the equipment in example disclosed herein or unit or group
Part can be arranged in equipment as depicted in this embodiment, or alternatively can be positioned at and the equipment in the example
In different one or more equipment.Module in aforementioned exemplary can be combined as a module or be segmented in addition multiple
Submodule.
Those skilled in the art be appreciated that can to embodiment in equipment in module carry out adaptively
Change and they are arranged in one or more equipment different from the embodiment.Can be the module in embodiment or list
Unit or component are combined into a module or unit or component, and can be divided in addition multiple submodule or subelement or
Sub-component.In addition at least some in such feature and/or process or unit is excluded each other, can adopt any
Combination is disclosed to all features disclosed in this specification (including adjoint claim, summary and accompanying drawing) and so to appoint
Where all processes or unit of method or equipment are combined.Unless expressly stated otherwise, this specification (includes adjoint power
Profit is required, summary and accompanying drawing) disclosed in each feature can identical by offers, be equal to or the alternative features of similar purpose carry out generation
Replace.
Although additionally, it will be appreciated by those of skill in the art that some embodiments described herein include other embodiments
In some included features rather than further feature, but the combination of the feature of different embodiments means in of the invention
Within the scope of and form different embodiments.For example, in the following claims, embodiment required for protection appoint
One of meaning can in any combination mode using.
Additionally, some heres in the embodiment be described as can be by the processor of computer system or by executing
The combination of method or method element that other devices of the function are implemented.Therefore, with for implementing methods described or method
The processor of the necessary instruction of element is formed for implementing the device of the method or method element.Additionally, device embodiment
Element described in this is the example of following device：The device is used for implementing by order to implement performed by the element of the purpose of the invention
Function.
As used in this, unless specifically stated so, come using ordinal number " first ", " second ", " the 3rd " etc.
Description plain objects are merely representative of the different instances for being related to similar object, and are not intended to imply that the object being so described must
There must be the given order that the time is upper, spatially, in terms of sequence or in any other manner.
Although the embodiment according to limited quantity describes the present invention, above description, the art is benefited from
Interior it is clear for the skilled person that in the scope of the present invention for thus describing, it can be envisaged that other embodiments.Additionally, it should be noted that
Language used in this specification primarily to the purpose of readable and teaching and select, rather than in order to explain or limit
Determine subject of the present invention and select.Therefore, in the case of without departing from the scope of the appended claims and spirit, for this
For the those of ordinary skill of technical field, many modifications and changes will be apparent from.For the scope of the present invention, to this
The done disclosure of invention is illustrative and not restrictive, and it is intended that the scope of the present invention be defined by the claims appended hereto.
Claims (10)
1. a kind of abnormal cause localization method, executes in computing device, is suitable to occur anomalous performance index in Devices to test
When, the reason for causing the anomalous performance index to occur abnormal performance indications are found out, the method includes：
Obtain the time serieses of the observation of anomalous performance index and multiple performance indications；
According to the dependency that the time serieses calculate each performance indications and anomalous performance index respectively, will be with anomalous performance
The dependency of index adds the first index set more than the performance indications of first threshold；
Calculate the causality of each performance indications in the first index set and anomalous performance index respectively, will refer to anomalous performance
Target causality adds the second index set more than the performance indications of Second Threshold；
The reason for determining each performance indications in the second index set according to the dependency and causality respectively score value, described
Reason score value is used for representing the probability that performance indications are reason performance indications；
The reason for anomalous performance index is determined according to reason score value performance indications.
2. abnormal cause localization method as claimed in claim 1, wherein, the dependency is calculated according to below equation：
Wherein, numbers of the n for included observation in time serieses, x represent performance indications, xiTime sequence for performance indications x
I-th observation in row,For the meansigma methodss of the observation in the time serieses of performance indications x, y represents anomalous performance index,
yiFor i-th observation in the time serieses of anomalous performance index y,For the sight in the time serieses of anomalous performance index y
The meansigma methodss of measured value.
3. abnormal cause localization method as claimed in claim 1, wherein, the causality is calculated according to following steps：
Set up following two regression models：
Model one：y1t=a0+a1yt-1+a2yt-2+…+amyt-m
Model two：y2t=b0+b1yt-1+b2yt-2+…+bmyt-m+c0+c1xt-1+c2xt-2+…+cmxt-m
Wherein, yt-1For anomalous performance index y (t-1) moment observation, xt-1For performance indications x (t-1) moment sight
Measured value, m be delayed item number, a0～am、b0～bm、c0～cmIt is undetermined coefficient；
Above-mentioned regression model is solved according to the time serieses of anomalous performance index y and performance indications x, undetermined coefficient a is determined0～am、
b0～bm、c0～cmValue；
F test values are calculated according to below equation：
Wherein, the RSS1For the residual sum of squares (RSS) of model one, RSS2For the residual sum of squares (RSS) of model two, m is delayed item number, and n is
The number of included observation in time serieses；
RSS1、RSS2Calculate according to below equation respectively：
Wherein, ytFor anomalous performance index y t observation, y1tIt is that the anomalous performance index y obtained according to model one exists
The predictive value of t, y2tIt is the predictive value of the anomalous performance index y that obtained according to model two in t；
Significance p_value is determined according to F test values；
By (1-p_value) as performance indications x and the causality of anomalous performance index y.
4. abnormal cause positioner as claimed in claim 3, wherein, significance p_value can pass through to inquire about significance
Level is drawn for the F-distribution tables of critical values of (1- Second Thresholds), wherein, when the F-distribution tables of critical values is inquired about, degree of freedom
For (m, n-2m-1).
5. abnormal cause positioner as claimed in claim 3, wherein, significance p_value can be according to below equation meter
Calculate：
P_value=1-P (F test values)
Wherein, P (z) is the cumulative distribution function of the F-distribution that degree of freedom is (m, n-2m-1), and P (F test values) is cumulative distribution
Value of function P (z) in z=F test values.
6. a kind of abnormal cause positioner, resides in computing device, is suitable to occur anomalous performance index in Devices to test
When, the reason for causing the anomalous performance index to occur abnormal performance indications are found out, the device includes：
Data acquisition module, is suitable to the time serieses of the observation of acquisition anomalous performance index and multiple performance indications；
First analysis module, is suitable to the phase for calculating each performance indications and anomalous performance index according to the time serieses respectively
Performance indications with the dependency of anomalous performance index more than first threshold are added the first index set by Guan Xing；
Second analysis module, is suitable to the cause and effect for calculating each performance indications in the first index set and anomalous performance index respectively
Property, the performance indications with the causality of anomalous performance index more than Second Threshold are added the second index set；
Reason locating module, is suitable to determine that according to the dependency and causality each performance in the second index set refers to respectively
Target reason score value, and performance indications the reason for determine anomalous performance index according to the reason score value.
7. abnormal cause positioner as claimed in claim 6, wherein, first analysis module is suitable to according to below equation
Calculate dependency：
Wherein, numbers of the n for included observation in time serieses, x represent performance indications, xiTime sequence for performance indications x
I-th observation in row,For the meansigma methodss of the observation in the time serieses of performance indications x, y represents that anomalous performance refers to
Mark, yiFor i-th observation in the time serieses of anomalous performance index y,In time serieses for anomalous performance index y
The meansigma methodss of observation.
8. abnormal cause positioner as claimed in claim 6, wherein, second analysis module is suitable to according to following steps
Calculate causality：
Set up following two regression models：
Model one：y1t=a0+a1yt-1+a2yt-2+…+amyt-m
Model two：y2t=b0+b1yt-1+b2yt-2+…+bmyt-m+c0+c1xt-1+c2xt-2+…+cmxt-m
Wherein, yt-1For anomalous performance index y (t-1) moment observation, xt-1For performance indications x (t-1) moment sight
Measured value, m be delayed item number, a0～am、b0～bm、c0～cmIt is undetermined coefficient；
Above-mentioned regression model is solved according to the time serieses of anomalous performance index y and performance indications x, undetermined coefficient a is determined0～am、
b0～bm、c0～cmValue；
F test values are calculated according to below equation：
Wherein, the RSS1For the residual sum of squares (RSS) of model one, RSS2For the residual sum of squares (RSS) of model two, m is delayed item number, and n is
The number of included observation in time serieses；
RSS1、RSS2Calculate according to below equation respectively：
Wherein, ytFor anomalous performance index y t observation, y1tIt is that the anomalous performance index y obtained according to model one exists
The predictive value of t, y2tIt is the predictive value of the anomalous performance index y that obtained according to model two in t；True according to F test values
Determine significance p_value；
By (1-p_value) as performance indications x and the causality of anomalous performance index y.
9. abnormal cause positioner as claimed in claim 8, wherein, significance p_value can pass through to inquire about significance
Level is drawn for the F-distribution tables of critical values of (1- Second Thresholds), wherein, when the F-distribution tables of critical values is inquired about, degree of freedom
For (m, n-2m-1).
10. a kind of computing device, including the abnormal cause positioner as any one of claim 6-9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610917403.1A CN106502815B (en) | 2016-10-20 | 2016-10-20 | A kind of abnormal cause localization method, device and calculate equipment |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610917403.1A CN106502815B (en) | 2016-10-20 | 2016-10-20 | A kind of abnormal cause localization method, device and calculate equipment |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN106502815A true CN106502815A (en) | 2017-03-15 |
| CN106502815B CN106502815B (en) | 2019-08-02 |
Family
ID=58318241
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610917403.1A Active CN106502815B (en) | 2016-10-20 | 2016-10-20 | A kind of abnormal cause localization method, device and calculate equipment |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106502815B (en) |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107301119A (en) * | 2017-06-28 | 2017-10-27 | 北京优特捷信息技术有限公司 | The method and device of IT failure root cause analysis is carried out using timing dependence |
| CN108228428A (en) * | 2018-02-05 | 2018-06-29 | 百度在线网络技术（北京）有限公司 | For the method and apparatus of output information |
| CN108362957A (en) * | 2017-12-19 | 2018-08-03 | 东软集团股份有限公司 | Equipment fault diagnosis method, device, storage medium and electronic equipment |
| CN108446184A (en) * | 2018-02-23 | 2018-08-24 | 北京天元创新科技有限公司 | Analyze the method and system of failure root primordium |
| CN109587001A (en) * | 2018-11-15 | 2019-04-05 | 新华三信息安全技术有限公司 | A kind of performance indicator method for detecting abnormality and device |
| CN109815042A (en) * | 2019-01-21 | 2019-05-28 | 南方科技大学 | Localization method, device, server and the storage medium of abnormal factors |
| CN109840185A (en) * | 2019-01-11 | 2019-06-04 | 新华三大数据技术有限公司 | A kind of index correlating method and device |
| CN110008247A (en) * | 2018-12-13 | 2019-07-12 | 阿里巴巴集团控股有限公司 | Abnormal source determines method, apparatus, equipment and computer readable storage medium |
| CN110019978A (en) * | 2017-11-17 | 2019-07-16 | 阿里巴巴集团控股有限公司 | A kind of data processing method and device |
| CN113342616A (en) * | 2021-06-30 | 2021-09-03 | 北京奇艺世纪科技有限公司 | Abnormal index information positioning method and device, electronic equipment and storage medium |
| CN114760190A (en) * | 2022-04-11 | 2022-07-15 | 北京邮电大学 | Service-oriented converged network performance anomaly detection method |
| CN115118580A (en) * | 2022-05-20 | 2022-09-27 | 阿里巴巴（中国）有限公司 | Alarm analysis method and device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103412805A (en) * | 2013-07-31 | 2013-11-27 | 交通银行股份有限公司 | IT (information technology) fault source diagnosis method and IT fault source diagnosis system |
| CN104317681A (en) * | 2014-09-02 | 2015-01-28 | 上海交通大学 | Behavioral abnormality automatic detection method and behavioral abnormality automatic detection system aiming at computer system |
| CN105554786A (en) * | 2015-12-11 | 2016-05-04 | 中国联合网络通信集团有限公司 | Method and device for positioning network problem |
-
2016
- 2016-10-20 CN CN201610917403.1A patent/CN106502815B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103412805A (en) * | 2013-07-31 | 2013-11-27 | 交通银行股份有限公司 | IT (information technology) fault source diagnosis method and IT fault source diagnosis system |
| CN104317681A (en) * | 2014-09-02 | 2015-01-28 | 上海交通大学 | Behavioral abnormality automatic detection method and behavioral abnormality automatic detection system aiming at computer system |
| CN105554786A (en) * | 2015-12-11 | 2016-05-04 | 中国联合网络通信集团有限公司 | Method and device for positioning network problem |
Cited By (21)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107301119A (en) * | 2017-06-28 | 2017-10-27 | 北京优特捷信息技术有限公司 | The method and device of IT failure root cause analysis is carried out using timing dependence |
| CN107301119B (en) * | 2017-06-28 | 2020-07-14 | 北京优特捷信息技术有限公司 | Method and device for analyzing IT fault root cause by utilizing time sequence correlation |
| CN110019978A (en) * | 2017-11-17 | 2019-07-16 | 阿里巴巴集团控股有限公司 | A kind of data processing method and device |
| CN108362957A (en) * | 2017-12-19 | 2018-08-03 | 东软集团股份有限公司 | Equipment fault diagnosis method, device, storage medium and electronic equipment |
| CN108362957B (en) * | 2017-12-19 | 2020-09-11 | 东软集团股份有限公司 | Equipment fault diagnosis method and device, storage medium and electronic equipment |
| CN108228428A (en) * | 2018-02-05 | 2018-06-29 | 百度在线网络技术（北京）有限公司 | For the method and apparatus of output information |
| CN108228428B (en) * | 2018-02-05 | 2021-09-21 | 百度在线网络技术（北京）有限公司 | Method and apparatus for outputting information |
| CN108446184A (en) * | 2018-02-23 | 2018-08-24 | 北京天元创新科技有限公司 | Analyze the method and system of failure root primordium |
| CN108446184B (en) * | 2018-02-23 | 2021-09-07 | 北京天元创新科技有限公司 | Method and system for analyzing fault root cause |
| CN109587001A (en) * | 2018-11-15 | 2019-04-05 | 新华三信息安全技术有限公司 | A kind of performance indicator method for detecting abnormality and device |
| CN109587001B (en) * | 2018-11-15 | 2020-11-27 | 新华三信息安全技术有限公司 | Performance index abnormality detection method and device |
| CN110008247A (en) * | 2018-12-13 | 2019-07-12 | 阿里巴巴集团控股有限公司 | Abnormal source determines method, apparatus, equipment and computer readable storage medium |
| CN110008247B (en) * | 2018-12-13 | 2022-08-16 | 阿里巴巴集团控股有限公司 | Method, device and equipment for determining abnormal source and computer readable storage medium |
| CN109840185A (en) * | 2019-01-11 | 2019-06-04 | 新华三大数据技术有限公司 | A kind of index correlating method and device |
| CN109815042A (en) * | 2019-01-21 | 2019-05-28 | 南方科技大学 | Localization method, device, server and the storage medium of abnormal factors |
| CN109815042B (en) * | 2019-01-21 | 2022-05-27 | 南方科技大学 | Abnormal factor positioning method, abnormal factor positioning device, server and storage medium |
| CN113342616A (en) * | 2021-06-30 | 2021-09-03 | 北京奇艺世纪科技有限公司 | Abnormal index information positioning method and device, electronic equipment and storage medium |
| CN113342616B (en) * | 2021-06-30 | 2023-10-27 | 北京奇艺世纪科技有限公司 | Positioning method and device of abnormal index information, electronic equipment and storage medium |
| CN114760190A (en) * | 2022-04-11 | 2022-07-15 | 北京邮电大学 | Service-oriented converged network performance anomaly detection method |
| CN115118580A (en) * | 2022-05-20 | 2022-09-27 | 阿里巴巴（中国）有限公司 | Alarm analysis method and device |
| CN115118580B (en) * | 2022-05-20 | 2023-10-31 | 阿里巴巴（中国）有限公司 | Alarm analysis method and device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN106502815B (en) | 2019-08-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106502815A (en) | A kind of abnormal cause localization method, device and computing device | |
| Succi et al. | An empirical exploration of the distributions of the chidamber and kemerer object-oriented metrics suite | |
| Dey et al. | Exponentiated Chen distribution: Properties and estimation | |
| Zhou | Heteroscedasticity and autocorrelation robust structural change detection | |
| Abrahamsson | Uncertainty in quantitative risk analysis-characterisation and methods of treatment | |
| CN103020459B (en) | A kind of cognitive method of various dimensions electricity consumption behavior and system | |
| Nielsen et al. | Capacity of large-scale, long-term biodiversity monitoring programmes to detect trends in species prevalence | |
| CN107992447A (en) | A kind of feature selecting decomposition method applied to river level prediction data | |
| McAssey | An empirical goodness-of-fit test for multivariate distributions | |
| CN107609711A (en) | A kind of offer method, apparatus, equipment and storage medium for entering oneself for the examination information | |
| Hu et al. | A Bayesian network approach for predicting seismic liquefaction based on interpretive structural modeling | |
| Liu et al. | A systematic approach to optimizing value for fuzzy linear regression with symmetric triangular fuzzy numbers | |
| CN110135913A (en) | Training method, shop site selecting method and the device of shop site selection model | |
| Khan et al. | A new variable control chart under failure‐censored reliability tests for Weibull distribution | |
| CN114818828B (en) | Training method of radar interference perception model and radar interference signal identification method | |
| Sun et al. | Overview of interdependency models of critical infrastructure for resilience assessment | |
| CN110348717A (en) | Base station value methods of marking and device based on grid granularity | |
| de Sousa et al. | A 20‐year mapping of Bayesian belief networks in software project management | |
| Chen et al. | Applying a deployment strategy and data analysis model for water quality continuous monitoring and management | |
| CN104821854B (en) | A kind of many primary user's multidimensional frequency spectrum sensing methods based on random set | |
| Zhao et al. | Leak detection method of liquid-filled pipeline based on VMD and SVM | |
| Alonso et al. | A note on the indeterminacy of the random-effects distribution in hierarchical models | |
| CN111428405B (en) | Fine particulate matter concentration simulation method and device, storage medium and electronic equipment | |
| CN106934009A (en) | One kind application arrangement method, device and computing device | |
| Liu et al. | Random rounded integer-valued autoregressive conditional heteroskedastic process |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20220719 Address after: 100193 room 101-216, 2nd floor, building 4, East District, yard 10, northwest Wangdong Road, Haidian District, Beijing Patentee after: Beijing Ruixiang Technology Co.,Ltd. Address before: 100191 floors 3 and 4, building a-5, Dongsheng Science Park, Zhongguancun, No. 66, xixiaokou Road, Haidian District, Beijing Patentee before: BEIJING ONEAPM Co.,Ltd. |