CN109615312A - Business abnormal investigation method, apparatus, electronic equipment and storage medium in execution - Google Patents

Business abnormal investigation method, apparatus, electronic equipment and storage medium in execution Download PDF

Info

Publication number
CN109615312A
CN109615312A CN201811237458.3A CN201811237458A CN109615312A CN 109615312 A CN109615312 A CN 109615312A CN 201811237458 A CN201811237458 A CN 201811237458A CN 109615312 A CN109615312 A CN 109615312A
Authority
CN
China
Prior art keywords
abnormal
machine learning
learning model
log
operational order
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201811237458.3A
Other languages
Chinese (zh)
Inventor
郭红英
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ping An Technology Shenzhen Co Ltd
Original Assignee
Ping An Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ping An Technology Shenzhen Co Ltd filed Critical Ping An Technology Shenzhen Co Ltd
Priority to CN201811237458.3A priority Critical patent/CN109615312A/en
Publication of CN109615312A publication Critical patent/CN109615312A/en
Pending legal-status Critical Current

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00Administration; Management
    • G06Q10/10Office automation; Time management

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Human Resources & Organizations (AREA)
  • Operations Research (AREA)
  • Economics (AREA)
  • Marketing (AREA)
  • Data Mining & Analysis (AREA)
  • Quality & Reliability (AREA)
  • Tourism & Hospitality (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Debugging And Monitoring (AREA)

Abstract

Present disclose provides a kind of business abnormal investigation method, apparatus, electronic equipment and storage mediums in execution.The disclosure is for the loophole remediation efficiency optimization in system function optimization.This method comprises: the operational order of user is received, wherein the operational order is the instruction for an operation in the business;According to the corresponding default inspection rule of the operation in the operational order, the operational order is examined, generates inspection result log;In response to there is abnormal report in business execution, the inspection result log is searched based on abnormal type, positions abnormal log section corresponding with the type of the exception in the inspection result log;The abnormal log section is inputted into the first machine learning model, by the first machine learning model output abnormality reason.The embodiment of the present disclosure reduces O&M resource occupation, and has ensured business efficient abnormal investigation in execution.

Description

Business abnormal investigation method, apparatus, electronic equipment and storage medium in execution
Technical field
The present invention relates to field of artificial intelligence, more particularly to a kind of business abnormal investigation method in execution, dress It sets, electronic equipment and storage medium.
Background technique
There are a large amount of duplicate routine work tasks in the daily IT maintenance work of unit.The complexity that these tasks have is numerous Trivial quantity is big, some heavy dependence execution orders, and some need can execute after waiting various conditions to have.Although IT O&M The technology of management is being constantly progressive, but actually IT operation maintenance personnel is not liberated really, the system of current many enterprises open and Most work such as closing, system update upgrading, emergency operation are all manually operated.Even if simple system variation or soft The upgrading that part replicates adhesive type updates, and often requires operation maintenance personnel and logs in every manual change of equipment progress one by one.Especially In the case where cloud platform, big data and bulk device, workload it is big as one can imagine.And such change and inspection operation exist Often all occurring daily in IT O&M, is occupying a large amount of O&M resource.
It is badly in need of a kind of efficient business for reducing O&M resource occupation abnormal investigation scheme in execution in the prior art.
Summary of the invention
The disclosure is intended to provide a kind of efficient business for reducing O&M resource occupation abnormal investigation scheme in execution.
According to the disclosure in a first aspect, providing a kind of business abnormal investigation method in execution, the business includes The sequence that multiple operations continuously performed are constituted, each operation correspond to a default inspection rule, which comprises
The operational order of user is received, wherein the operational order is the instruction for an operation in the business;
According to the corresponding default inspection rule of the operation in the operational order, the operational order is examined, generates inspection Result log;
In response to there is abnormal report in business execution, the inspection result log is searched based on abnormal type, it is fixed Abnormal log section corresponding with the type of the exception in the inspection result log of position;
The abnormal log section is inputted into the first machine learning model, it is former by the first machine learning model output abnormality Cause, wherein first machine learning model is trained in the following manner: by each exception in abnormal log section sample set Log section sample inputs first machine learning model, and each abnormal log section sample posts the known abnormal log in advance The label of the abnormal cause of section sample, the first machine learning model output abnormality reason, if first machine learning The label of the abnormal cause and the abnormal log section sample of model output is inconsistent, adjusts the first machine learning model, makes first The abnormal cause of machine learning model output is consistent with the label of the abnormal log section sample.
In one embodiment, the abnormal log section is being inputted into the first machine learning model, by first machine After learning model output abnormality reason, the method also includes:
Abnormal cause and the solution table of comparisons are searched based on the abnormal cause, obtains the corresponding solution party of the abnormal cause Case.
In one embodiment, described according to the corresponding default inspection rule of the operation in the operational order, inspection institute Operational order is stated, inspection result log is generated, comprising:
Obtain the operation name in the operational order;
Search operation name obtains the corresponding default inspection rule of the operation name to the default inspection rule table of comparisons, described Default inspection rule includes the condition that each field in operational order needs to meet;
The field for examining each field in the operational order whether to meet in the predetermined inspection rule needs to meet Condition;
According to inspection result, inspection result log is generated.
In one embodiment, described in response to there is abnormal report in business execution, it is searched based on abnormal type The inspection result log positions abnormal log section corresponding with the type of the exception in the inspection result log, comprising:
Occur identifying abnormal type in abnormal report from business execution;
Abnormal type and the abnormal keyword table of comparisons are searched, keyword corresponding to the type of the exception is obtained;
The keyword is positioned in the inspection result log;
Based on the keyword navigated in the inspection result log, it is based on predetermined criterion, positions the inspection result Abnormal log section corresponding to keyword described in log, as abnormal log section corresponding with the type of the exception.
In one embodiment, the predetermined criterion includes: by occurring in the context of the keyword with the pass For keyword apart from nearest template paragraph as abnormal log section corresponding to the keyword, the template paragraph is selected from pre- cover half Plate paragraph library.
In one embodiment, the abnormal cause is preparatory based on the second machine learning model with the solution table of comparisons It establishes, the second machine learning model pre-establishes in the following manner:
Abnormal cause sample each in abnormal cause sample database is inputted into the second machine learning model, each abnormal cause sample This posts the label of the solution of the known abnormal cause sample in advance, what the second machine learning model output determined Solution, if the solution of second machine learning model judgement and the label of the abnormal cause sample are inconsistent, The second machine learning model is adjusted, the label one of the solution and the abnormal cause sample that determine the second machine learning model It causes.
In one embodiment, abnormal cause and the solution table of comparisons are being searched based on the abnormal cause, it is different obtains this After the corresponding solution of normal reason, the method also includes:
Solution based on acquisition searches script corresponding with the solution in the script bank established in advance;
Execute the corresponding script of the solution.
According to the second aspect of the disclosure, a kind of business abnormal examination device in execution is provided, the business includes The sequence that multiple operations continuously performed are constituted, each operation correspond to a default inspection rule, and described device includes:
Receiving unit, for receiving the operational order of user, wherein the operational order is for one in the business The instruction of a operation;
Verification unit, for examining the operation according to the corresponding default inspection rule of the operation in the operational order Instruction generates inspection result log;
Positioning unit searches the inspection based on abnormal type for occurring abnormal report in executing in response to business Result log is tested, abnormal log section corresponding with the type of the exception in the inspection result log is positioned;
Abnormal cause obtaining unit, for the abnormal log section to be inputted the first machine learning model, by described first Machine learning model output abnormality reason, wherein first machine learning model is trained in the following manner: by abnormal log Each abnormal log section sample in section sample set inputs first machine learning model, each abnormal log section sample thing The label of the abnormal cause of the known abnormal log section sample is first posted, the first machine learning model output abnormality is former Cause, if the label of the abnormal cause and the abnormal log section sample of first machine learning model output is inconsistent, adjustment First machine learning model, the label one of the abnormal cause and the abnormal log section sample that export the first machine learning model It causes.
According to the third aspect of the disclosure, a kind of electronic equipment is provided, comprising:
Memory is configured to storage executable instruction.
Processor is configured to execute the executable instruction stored in the memory, to execute the process described above.
According to the fourth aspect of the disclosure, a kind of computer-readable program medium is provided, computer program is stored with and refers to It enables, when the computer instruction is computer-executed, computer is made to execute the process described above.
In the embodiment of the present disclosure, business is regarded as the sequence that multiple operations continuously performed are constituted, is each operation setting One default inspection rule.As soon as in this way, after receiving operational order of the user for the operation in sequence, according to described The corresponding default inspection rule of operation in operational order examines the operational order, generates inspection result log.Once it was found that There is exception in executing in business, so that it may search the inspection result log based on abnormal type, position the inspection result Abnormal log section corresponding with the type of the exception in log.The abnormal log section is inputted into the first machine learning model, by The first machine learning model output abnormality reason.The above process is executed by machine completely, does not need the intervention of operation maintenance personnel, The occupancy for reducing O&M resource realizes the business automation in execution checked extremely.
Other characteristics and advantages of the disclosure will be apparent from by the following detailed description, or partially by the disclosure Practice and acquistion.
It should be understood that the above general description and the following detailed description are merely exemplary, this can not be limited It is open.
Detailed description of the invention
Fig. 1 shows the flow chart of the business abnormal investigation method in execution according to one example embodiment of the disclosure.
Fig. 2 shows the flow charts of the abnormal investigation method in execution of the business according to one example embodiment of the disclosure.
Fig. 3 shows the specific flow chart of the step 120 according to one example embodiment of the disclosure.
Fig. 4 shows the specific flow chart of the step 130 according to one example embodiment of the disclosure.
Fig. 5 shows the block diagram of the business abnormal examination device in execution according to one example embodiment of the disclosure.
Fig. 6 shows the hardware device figure of the electronic equipment according to one example embodiment of the disclosure.
Fig. 7 shows the computer readable storage medium figure according to one example embodiment of the disclosure.
Specific embodiment
Example embodiment is described more fully with reference to the drawings.However, example embodiment can be with a variety of shapes Formula is implemented, and is not understood as limited to example set forth herein;On the contrary, thesing embodiments are provided so that the disclosure will more Fully and completely, and by the design of example embodiment comprehensively it is communicated to those skilled in the art.Described feature, knot Structure or characteristic can be incorporated in any suitable manner in one or more embodiments.In the following description, it provides perhaps More details fully understand embodiment of the present disclosure to provide.It will be appreciated, however, by one skilled in the art that can It is omitted with technical solution of the disclosure one or more in the specific detail, or others side can be used Method, constituent element, device, step etc..In other cases, be not shown in detail or describe known solution to avoid a presumptuous guest usurps the role of the host and So that all aspects of this disclosure thicken.
In addition, attached drawing is only the schematic illustrations of the disclosure, it is not necessarily drawn to scale.Identical attached drawing mark in figure Note indicates same or similar part, thus will omit repetition thereof.Some block diagrams shown in the drawings are function Energy entity, not necessarily must be corresponding with physically or logically independent entity.These function can be realized using software form Energy entity, or these functional entitys are realized in one or more hardware modules or integrated circuit, or at heterogeneous networks and/or place These functional entitys are realized in reason device device and/or microcontroller device.
As shown in Figure 1, in one embodiment, providing a kind of business abnormal investigation method in execution.Here business Refer to the complete activity of one be engaged in unit (enterprise, cause, organ, team etc.).For example, China National Investment & Guaranty Corp., insurance company business It is the business that it is engaged in, including a whole set of complete process, as user's record is single --- > quotation --- > application is insured --- > Submitting order, --- > calling financial system opens list, and --- --- > calling finance to account --- > accepts insurance for > client payment.Exception refers to In process of service execution system occur with inconsistent situation when operating normally, such as at " user records single " " record is single to lose Lose " etc..Abnormal investigation method refers to the method checked and verify when occurring abnormal from abnormal cause.This method is by unit Server of uniting executes.
In one embodiment, the business includes the sequence that multiple operations continuously performed are constituted.Each of business Specific movement is called operation.Such as the business of insuring is the sequence that the above operation continuously performed is formed: user records single, quotation, Shen It please insure, submit order, financial system is called to open list, client's payment, call finance to account, accept insurance.Each operation corresponds to one A default inspection rule.Default inspection rule is the pre-set rule tested to operational order.Operational order is to use In the instruction for executing operation.Such as user records in list, will have a requirement to each field in user's typing list.For example, This field of name is typing Chinese or Chinese plus phonetic.In other words, the name in the single operational order of corresponding record this Field is Chinese or Chinese plus phonetic.It, cannot be by examining if operational order does not meet default inspection rule, but it will be It is recorded in log.This point is described in more detail below.
As shown in Figure 1, which comprises
Step 110, the operational order for receiving user, wherein the operational order is for an operation in the business Instruction;
Step 120, according to the corresponding default inspection rule of the operation in the operational order, examine the operational order, Generate inspection result log;
Step 130, in response to business execute in there is abnormal report, the inspection result is searched based on abnormal type Log positions abnormal log section corresponding with the type of the exception in the inspection result log;
The abnormal log section is inputted the first machine learning model by step 140, defeated by first machine learning model Abnormal cause out, wherein first machine learning model is trained in the following manner: will be in abnormal log section sample set Each abnormal log section sample inputs first machine learning model, and each abnormal log section sample posts known be somebody's turn to do in advance The label of the abnormal cause of abnormal log section sample, the first machine learning model output abnormality reason, if described first The label of the abnormal cause and the abnormal log section sample of machine learning model output is inconsistent, adjusts the first machine learning mould Type, the abnormal cause for exporting the first machine learning model are consistent with the label of the abnormal log section sample.
These steps are described in detail below.
In step 110, the operational order of user is received, wherein the operational order is for one in the business The instruction of operation.
For example, the operational order of this operation single for record, the operational order may have an operation name first Section shows that this operational order operation to be performed is that record is single.In addition, the operational order may carry the single particular content of record Field, such as: name field, the inside carry the name of insurer;Age field, the inside carry the age, etc. of insurer.It is different Operation have different operational orders.
In the step 120, according to the corresponding default inspection rule of the operation in the operational order, the operation is examined to refer to It enables, generates inspection result log.
In one embodiment, as shown in figure 3, step 120 includes:
Operation name in step 1201, the acquisition operational order;
Step 1202, search operation name and the default inspection rule table of comparisons obtain the corresponding default inspection of the operation name Rule, the default inspection rule include the condition that each field in operational order needs to meet;
Step 1203 examines whether each field in the operational order meets the field in the predetermined inspection rule The condition for needing to meet;
Step 1204, according to inspection result, generate inspection result log.
As it appears from the above, a field of operational order is operation file-name field, in this way, in step 1201, from operation name Section read operation name.
The operation name of step 1202 and the default inspection rule table of comparisons be it is pre-set store operation name with it is corresponding The table of inspection rule.Inspection rule is for the field in operational order, and the content of each field is different, and inspection rule is just not Together, it is therefore desirable to accordingly store different preset with operation name from storage in the default inspection rule table of comparisons in operation name and examine Rule.
For example, inspection rule may be for name field: the Chinese+Chinese phonetic alphabet.For date of birth field, examine Rule may be: xxxx-yy-zz, and wherein xxxx represents year, and yy represents the moon, and zz represents day.
Examine whether it meets pair that step 1202 is got for each field in operational order in step 1203 The default inspection rule answered.For example, " on August 21st, 2017 " is not meet such a corresponding inspection rule of xxxx-yy-zz 's.
In step 1204, since each operation of computer can be recorded in log, equally, inspection movement can also be produced Birthday will, i.e. inspection result log store Check-Out Time, whether pass through inspection, not verified field, the field not Which predetermined inspection rule met.
In step 130, in response to there is abnormal report in business execution, the inspection is searched based on abnormal type Result log positions abnormal log section corresponding with the type of the exception in the inspection result log.
In process of service execution, may occur in any one operation wherein abnormal.Exception refers to that business can not execute Or it executes and normally executes different situation.For example, being recorded in user single --- > quotation --- > application is insured --- > Submitting order, --- > calling financial system opens list, and --- --- > calling finance to account --- > accepts insurance such a for > client payment In the business of insuring of process, in fact it could happen that record Dan Yichang, the exception for submitting the links such as order is abnormal, payment is abnormal.Business Once exception reporting can be generated by exception occur when execution, abnormal type, time of origin etc. are indicated.Abnormal type includes business System is out of service, operation system can not log in, records the abnormal type of the generations such as single exception.
In one embodiment, as shown in figure 4, step 130 includes:
Step 1301 occurs identifying abnormal type in abnormal report from business execution;
Step 1302 searches abnormal type and the abnormal keyword table of comparisons, obtains pass corresponding to the type of the exception Keyword;
Step 1303 positions the keyword in the inspection result log;
Step 1304, based on the keyword navigated in the inspection result log, predetermined criterion is based on, described in positioning Abnormal log section corresponding to keyword described in inspection result log, as abnormal log corresponding with the type of the exception Section.
The report of appearance exception in step 1301 can be the business execution module of server when an exception is detected It is reported to the abnormal investigation module of server.This report includes abnormal type, time of origin etc..It therefore, can be from the report Abnormal type is identified in announcement.
In step 1302, abnormal keyword is the exception that the type ought occur determined for abnormal each type When the symbolic characteristic that is likely to occur of inspection result log.For " payment is abnormal " this abnormal type, corresponding transaction Result log is likely to occur the abnormal keyword such as " account name mistake ", " password mistake ", " without this account ".Thus, it is possible to obtain Then these keywords position abnormal log section with these keywords in inspection result log again.
After obtaining keyword, in step 1303, with inspection result log described in the keyword search, pass has just been navigated to Keyword.
Then, in step 1304, so that it may based on the keyword navigated in the inspection result log, based on pre- It fixes then, abnormal log section corresponding to keyword described in the inspection result log is positioned, as the type with the exception Corresponding abnormal log section.
Abnormal log section is may be comprising the part of data required for investigation abnormal cause in inspection result log.
In one embodiment, predetermined criterion include: by inspection result log include the keyword section, as institute State abnormal log section corresponding to keyword described in inspection result log.This section is the section where keyword, is used it as different Chang Zhi sections obtain abnormal cause by subsequent processing, are possible.
In one embodiment, the predetermined criterion includes: by occurring in the context of the keyword with the pass For keyword apart from nearest template paragraph as abnormal log section corresponding to the keyword, the template paragraph is selected from pre- cover half Plate paragraph library.
Section where keyword may not reflect abnormal Producing reason, it is possible to be that some sections before and after this section can more embody Abnormal Producing reason.These sections often have the characteristics that some general character, the part of general character can be made into template paragraph.Once There are some template paragraphs in the context (being not necessarily the section where keyword) of the keyword, these template paragraphs very may be used It can reflect abnormal Producing reason.It therefore, can be by occurring in the context of the keyword with the keyword distance Nearest template paragraph is selected from pre- solid plate paragraph as abnormal log section corresponding to the keyword, the template paragraph Library.If the template paragraph, before keyword, template paragraph refers to template paragraph the last character at a distance from keyword The number of characters being spaced between symbol and keyword first character;If the template paragraph behind keyword, template paragraph with The distance of keyword refers to the number of characters being spaced between keyword last character and template paragraph first character;If closed For keyword in template paragraph, template paragraph is 0 at a distance from keyword.
In step 140, after abnormal log section being navigated to, so that it may which the abnormal log section is inputted the first engineering Model is practised, by the first machine learning model output abnormality reason.
First machine learning model is trained in the following manner in advance: by each of abnormal log section sample set Abnormal log section sample inputs first machine learning model.Abnormal log section sample is one from historical inspection result The abnormal log section extracted in log, the mode extracted are referred to shown in Fig. 4.Abnormal log section sample set is big Measure the set that abnormal log section sample is constituted.Each abnormal log section sample posts the known abnormal log section sample in advance The label of abnormal cause, the label can be sticked to sample one by one by expert.The first machine learning model output abnormality is former Cause, if the label of the abnormal cause and the abnormal log section sample of first machine learning model output is inconsistent, adjustment Coefficient in first machine learning model, the abnormal cause for exporting the first machine learning model and the abnormal log section sample Label is consistent.By a large amount of sample training, the first machine learning model can produce after receiving any abnormal log section The output of raw abnormal cause.
As shown in Fig. 2, in one embodiment, the method is after step 140 further include: step 150, based on this is different Normal cause investigation abnormal cause and the solution table of comparisons, obtain the corresponding solution of the abnormal cause.
Abnormal cause and the solution table of comparisons are the tables that store various abnormal causes with corresponding solution.In step It is determined in abnormal cause in rapid 140, so that it may search the table, obtain the corresponding solution of the abnormal cause.
The advantages of embodiment is can not only to automate to determine abnormal Producing reason, additionally it is possible to which automation is found out Abnormal solution.
In one embodiment, the abnormal cause is preparatory based on the second machine learning model with the solution table of comparisons It establishes, the second machine learning model pre-establishes in the following manner: by abnormal cause sample each in abnormal cause sample database The second machine learning model of this input, each abnormal cause sample post the solution of the known abnormal cause sample in advance Label, the solution that second machine learning model output determines, if what second machine learning model determined Solution and the label of the abnormal cause sample are inconsistent, adjust the second machine learning model, make the second machine learning model The solution of judgement is consistent with the label of the abnormal cause sample.
Abnormal cause sample, which can be, to be obtained according to the process of Fig. 1 when user in history encounters exception when business executes Abnormal cause as sample.Abnormal cause sample database is the library for including a large amount of abnormal cause samples, wherein each abnormal cause Sample all determines solution by expert, sticks the label of solution.
In one embodiment, the disclosure is not only able to find out abnormal solution, additionally it is possible to execute the solution automatically Scheme.As shown in Fig. 2, the method is after step 150 further include:
Step 160, the solution based on acquisition search foot corresponding with the solution in the script bank established in advance This;
Step 170 executes the corresponding script of the solution.
In embodiment, the every kind of solution listed for abnormal cause and the solution table of comparisons, by programming personnel The script storage of the solution is write in advance in the database.Once searching abnormal cause and the solution table of comparisons obtaining Solution, so that it may be found in the database and (deposited for example, script is corresponding with solution ID by the script of solution What is stored in storage, abnormal cause and the solution table of comparisons is also the corresponding relationship of reason reason and solution ID).Then, It loads the script into memory and executes, as script execution as a result, being carried out the solution.
As shown in figure 5, the embodiment of the present disclosure also discloses a kind of business abnormal examination device in execution, the business packet The sequence that multiple operations continuously performed are constituted is included, each operation corresponds to a default inspection rule, and described device includes:
Receiving unit 210, for receiving the operational order of user, wherein the operational order is in the business The instruction of one operation;
Verification unit 220, for examining the behaviour according to the corresponding default inspection rule of the operation in the operational order It instructs, generates inspection result log;
Positioning unit 230, for occurring abnormal report in executing in response to business, based on described in abnormal type lookup Inspection result log positions abnormal log section corresponding with the type of the exception in the inspection result log;
Abnormal cause obtaining unit 240, for the abnormal log section to be inputted the first machine learning model, by described the One machine learning model output abnormality reason, wherein first machine learning model is trained in the following manner: by abnormal day Each abnormal log section sample in will section sample set inputs first machine learning model, each abnormal log section sample The label of the abnormal cause of the known abnormal log section sample is posted in advance, and the first machine learning model output abnormality is former Cause, if the label of the abnormal cause and the abnormal log section sample of first machine learning model output is inconsistent, adjustment First machine learning model, the label one of the abnormal cause and the abnormal log section sample that export the first machine learning model It causes.
In one embodiment, described device further include:
Solution acquiring unit (not shown) is compareed for searching abnormal cause based on the abnormal cause with solution Table obtains the corresponding solution of the abnormal cause.
In one embodiment, verification unit 220 is further used for:
Obtain the operation name in the operational order;
Search operation name and the default inspection rule table of comparisons obtain the corresponding default inspection rule of the operation name, described Default inspection rule includes the condition that each field in operational order needs to meet;
The field for examining each field in the operational order whether to meet in the predetermined inspection rule needs to meet Condition;
According to inspection result, inspection result log is generated.
In one embodiment, positioning unit 230 is further used for:
Occur identifying abnormal type in abnormal report from business execution;
Abnormal type and the abnormal keyword table of comparisons are searched, keyword corresponding to the type of the exception is obtained;
The keyword is positioned in the inspection result log;
Based on the keyword navigated in the inspection result log, it is based on predetermined criterion, positions the inspection result Abnormal log section corresponding to keyword described in log, as abnormal log section corresponding with the type of the exception.
In one embodiment, the predetermined criterion includes: by occurring in the context of the keyword with the pass For keyword apart from nearest template paragraph as abnormal log section corresponding to the keyword, the template paragraph is selected from pre- cover half Plate paragraph library.
In one embodiment, the abnormal cause is preparatory based on the second machine learning model with the solution table of comparisons It establishes, the second machine learning model pre-establishes in the following manner:
Abnormal cause sample each in abnormal cause sample database is inputted into the second machine learning model, each abnormal cause sample This posts the label of the solution of the known abnormal cause sample in advance, what the second machine learning model output determined Solution, if the solution of second machine learning model judgement and the label of the abnormal cause sample are inconsistent, The second machine learning model is adjusted, the label one of the solution and the abnormal cause sample that determine the second machine learning model It causes.
In one embodiment, described device further include:
Script searching unit, for the solution based on acquisition, search in the script bank established in advance with the solution party The corresponding script of case;
Script executing unit, for executing the corresponding script of the solution.
The function of each unit and the realization process of effect are specifically detailed in the above method and correspond to step in above-mentioned apparatus Realization process, details are not described herein.
It should be noted that although being referred to several modules or list for acting the equipment executed in the above detailed description Member, but this division is not enforceable.In fact, according to embodiment of the present disclosure, it is above-described two or more Module or the feature and function of unit can embody in a module or unit.Conversely, an above-described mould The feature and function of block or unit can be to be embodied by multiple modules or unit with further division.
In addition, although describing each step of method in the disclosure in the accompanying drawings with particular order, this does not really want These steps must be executed in this particular order by asking or implying, or having to carry out step shown in whole could realize Desired result.Additional or alternative, it is convenient to omit multiple steps are merged into a step and executed by certain steps, and/ Or a step is decomposed into execution of multiple steps etc..
Through the above description of the embodiments, those skilled in the art is it can be readily appreciated that example described herein is implemented Mode can also be realized by software realization in such a way that software is in conjunction with necessary hardware.Therefore, according to the disclosure The technical solution of embodiment can be embodied in the form of software products, which can store non-volatile at one Property storage medium (can be CD-ROM, USB flash disk, mobile hard disk etc.) in or network on, including some instructions are so that a calculating Equipment (can be personal computer, server, mobile terminal or network equipment etc.) is executed according to disclosure embodiment Method.
In an exemplary embodiment of the disclosure, a kind of electronic equipment that can be realized the above method is additionally provided.
Person of ordinary skill in the field it is understood that various aspects of the invention can be implemented as system, method or Program product.Therefore, various aspects of the invention can be embodied in the following forms, it may be assumed that complete hardware embodiment, complete The embodiment combined in terms of full Software Implementation (including firmware, microcode etc.) or hardware and software, can unite here Referred to as circuit, " module " or " system ".
The electronic equipment 400 of this embodiment according to the present invention is described referring to Fig. 6.The electronics that Fig. 6 is shown Equipment 400 is only an example, should not function to the embodiment of the present invention and use scope bring any restrictions.
As shown in fig. 6, electronic equipment 400 is showed in the form of universal computing device.The component of electronic equipment 400 can wrap It includes but is not limited to: at least one above-mentioned processing unit 410, at least one above-mentioned storage unit 420, the different system components of connection The bus 430 of (including storage unit 420 and processing unit 410).
Wherein, the storage unit is stored with program code, and said program code can be held by the processing unit 410 Row, so that various according to the present invention described in the execution of the processing unit 410 above-mentioned " illustrative methods " part of this specification The step of illustrative embodiments.For example, the processing unit 410 can execute process as shown in Figure 1.
Storage unit 420 may include the readable medium of volatile memory cell form, such as Random Access Storage Unit (RAM) 4201 and/or cache memory unit 4202, it can further include read-only memory unit (ROM) 4203.
Storage unit 420 can also include program/utility with one group of (at least one) program module 4205 4204, such program module 4205 includes but is not limited to: operating system, one or more application program, other program moulds It may include the realization of network environment in block and program data, each of these examples or certain combination.
Bus 430 can be to indicate one of a few class bus structures or a variety of, including storage unit bus or storage Cell controller, peripheral bus, graphics acceleration port, processing unit use any bus structures in a variety of bus structures Local bus.
Electronic equipment 400 can also be with one or more external equipments 500 (such as keyboard, sensing equipment, bluetooth equipment Deng) communication, can also be enabled a user to one or more equipment interact with the electronic equipment 400 communicate, and/or with make Any equipment (such as the router, modulation /demodulation that the electronic equipment 400 can be communicated with one or more of the other calculating equipment Device etc.) communication.This communication can be carried out by input/output (I/O) interface 450.Also, electronic equipment 400 can be with By network adapter 460 and one or more network (such as local area network (LAN), wide area network (WAN) and/or public network, Such as internet) communication.As shown, network adapter 460 is communicated by bus 430 with other modules of electronic equipment 400. It should be understood that although not shown in the drawings, other hardware and/or software module can not used in conjunction with electronic equipment 400, including but not Be limited to: microcode, device driver, redundant processing unit, external disk drive array, RAID system, tape drive and Data backup storage system etc..
Through the above description of the embodiments, those skilled in the art is it can be readily appreciated that example described herein is implemented Mode can also be realized by software realization in such a way that software is in conjunction with necessary hardware.Therefore, according to the disclosure The technical solution of embodiment can be embodied in the form of software products, which can store non-volatile at one Property storage medium (can be CD-ROM, USB flash disk, mobile hard disk etc.) in or network on, including some instructions are so that a calculating Equipment (can be personal computer, server, terminal installation or network equipment etc.) is executed according to disclosure embodiment Method.
In an exemplary embodiment of the disclosure, a kind of computer readable storage medium is additionally provided, energy is stored thereon with Enough realize the program product of this specification above method.In some possible embodiments, various aspects of the invention may be used also In the form of being embodied as a kind of program product comprising program code, when described program product is run on the terminal device, institute Program code is stated for executing the terminal device described in above-mentioned " illustrative methods " part of this specification according to this hair The step of bright various illustrative embodiments.
Refering to what is shown in Fig. 7, describing the program product for realizing the above method of embodiment according to the present invention 600, can using portable compact disc read only memory (CD-ROM) and including program code, and can in terminal device, Such as it is run on PC.However, program product of the invention is without being limited thereto, in this document, readable storage medium storing program for executing can be with To be any include or the tangible medium of storage program, the program can be commanded execution system, device or device use or It is in connection.
Described program product can be using any combination of one or more readable mediums.Readable medium can be readable letter Number medium or readable storage medium storing program for executing.Readable storage medium storing program for executing for example can be but be not limited to electricity, magnetic, optical, electromagnetic, infrared ray or System, device or the device of semiconductor, or any above combination.The more specific example of readable storage medium storing program for executing is (non exhaustive List) include: electrical connection with one or more conducting wires, portable disc, hard disk, random access memory (RAM), read-only Memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disc read only memory (CD-ROM), light storage device, magnetic memory device or above-mentioned any appropriate combination.
Computer-readable signal media may include in a base band or as carrier wave a part propagate data-signal, In carry readable program code.The data-signal of this propagation can take various forms, including but not limited to electromagnetic signal, Optical signal or above-mentioned any appropriate combination.Readable signal medium can also be any readable Jie other than readable storage medium storing program for executing Matter, the readable medium can send, propagate or transmit for by instruction execution system, device or device use or and its The program of combined use.
The program code for including on readable medium can transmit with any suitable medium, including but not limited to wirelessly, have Line, optical cable, RF etc. or above-mentioned any appropriate combination.
The program for executing operation of the present invention can be write with any combination of one or more programming languages Code, described program design language include object oriented program language-Java, C++ etc., further include conventional Procedural programming language-such as " C " language or similar programming language.Program code can be fully in user It calculates and executes in equipment, partly executes on a user device, being executed as an independent software package, partially in user's calculating Upper side point is executed on a remote computing or is executed in remote computing device or server completely.It is being related to far Journey calculates in the situation of equipment, and remote computing device can pass through the network of any kind, including local area network (LAN) or wide area network (WAN), it is connected to user calculating equipment, or, it may be connected to external computing device (such as utilize ISP To be connected by internet).
In addition, above-mentioned attached drawing is only the schematic theory of processing included by method according to an exemplary embodiment of the present invention It is bright, rather than limit purpose.It can be readily appreciated that the time that above-mentioned processing shown in the drawings did not indicated or limited these processing is suitable Sequence.In addition, be also easy to understand, these processing, which can be, for example either synchronously or asynchronously to be executed in multiple modules.
Those skilled in the art after considering the specification and implementing the invention disclosed here, will readily occur to its of the disclosure His embodiment.This application is intended to cover any variations, uses, or adaptations of the disclosure, these modifications, purposes or Adaptive change follow the general principles of this disclosure and including the undocumented common knowledge in the art of the disclosure or Conventional techniques.The description and examples are only to be considered as illustrative, and the true scope and spirit of the disclosure are by claim It points out.

Claims (10)

1. a kind of business abnormal investigation method in execution, which is characterized in that the business includes multiple operations continuously performed The sequence of composition, each operation correspond to a default inspection rule, which comprises
The operational order of user is received, wherein the operational order is the instruction for an operation in the business;
According to the corresponding default inspection rule of the operation in the operational order, the operational order is examined, generates inspection result Log;
In response to there is abnormal report in business execution, the inspection result log is searched based on abnormal type, positions institute State abnormal log section corresponding with the type of the exception in inspection result log;
The abnormal log section is inputted into the first machine learning model, by the first machine learning model output abnormality reason, Wherein first machine learning model is trained in the following manner: by each abnormal log in abnormal log section sample set Section sample inputs first machine learning model, and each abnormal log section sample posts the known abnormal log section sample in advance The label of this abnormal cause, the first machine learning model output abnormality reason, if first machine learning model The abnormal cause of output and the label of the abnormal log section sample are inconsistent, adjust the first machine learning model, make the first machine The abnormal cause of learning model output is consistent with the label of the abnormal log section sample.
2. the method according to claim 1, wherein the abnormal log section is inputted the first machine learning mould Type, after the first machine learning model output abnormality reason, the method also includes:
Abnormal cause and the solution table of comparisons are searched based on the abnormal cause, obtains the corresponding solution of the abnormal cause.
3. the method according to claim 1, wherein described corresponding pre- according to the operation in the operational order If inspection rule, the operational order is examined, generates inspection result log, comprising:
Obtain the operation name in the operational order;
Search operation name and the default inspection rule table of comparisons obtain the corresponding default inspection rule of the operation name, described default Inspection rule includes the condition that each field in operational order needs to meet;
Examine whether each field in the operational order meets the item that the field in the predetermined inspection rule needs to meet Part;
According to inspection result, inspection result log is generated.
4. the method according to claim 1, wherein it is described in response to business execute in there is abnormal report, The inspection result log is searched based on abnormal type, is positioned corresponding with the type of the exception in the inspection result log Abnormal log section, comprising:
Occur identifying abnormal type in abnormal report from business execution;
Abnormal type and the abnormal keyword table of comparisons are searched, keyword corresponding to the type of the exception is obtained;
The keyword is positioned in the inspection result log;
Based on the keyword navigated in the inspection result log, it is based on predetermined criterion, positions the inspection result log Described in abnormal log section corresponding to keyword, as abnormal log section corresponding with the type of the exception.
5. according to the method described in claim 4, it is characterized in that, the predetermined criterion includes: will be above and below the keyword Occur in text with the keyword apart from nearest template paragraph as abnormal log section corresponding to the keyword, it is described Template paragraph is selected from pre- solid plate paragraph library.
6. according to the method described in claim 2, it is characterized in that, the abnormal cause and the solution table of comparisons are based on the What two machine learning models pre-established, the second machine learning model pre-establishes in the following manner:
Abnormal cause sample each in abnormal cause sample database is inputted into the second machine learning model, each abnormal cause sample thing First post the label of the solution of the known abnormal cause sample, the solution that the second machine learning model output determines Scheme, if the solution of second machine learning model judgement and the label of the abnormal cause sample are inconsistent, adjustment Second machine learning model, the solution for determining the second machine learning model are consistent with the label of the abnormal cause sample.
7. according to the method described in claim 2, it is characterized in that, searching abnormal cause and solution party based on the abnormal cause The case table of comparisons, after obtaining the corresponding solution of the abnormal cause, the method also includes:
Solution based on acquisition searches script corresponding with the solution in the script bank established in advance;
Execute the corresponding script of the solution.
8. a kind of business abnormal examination device in execution, which is characterized in that the business includes multiple operations continuously performed The sequence of composition, each operation correspond to a default inspection rule, and described device includes:
Receiving unit, for receiving the operational order of user, wherein the operational order is for a behaviour in the business The instruction of work;
Verification unit, for examining the operational order according to the corresponding default inspection rule of the operation in the operational order, Generate inspection result log;
Positioning unit searches the inspection knot based on abnormal type for occurring abnormal report in executing in response to business Fruit log positions abnormal log section corresponding with the type of the exception in the inspection result log;
Abnormal cause obtaining unit, for the abnormal log section to be inputted the first machine learning model, by first machine Learning model output abnormality reason, wherein first machine learning model is trained in the following manner: by abnormal log section sample Each abnormal log section sample in this set inputs first machine learning model, and each abnormal log section sample pastes in advance The label of the abnormal cause of the abnormal log section sample known to having, the first machine learning model output abnormality reason, such as The label of the abnormal cause and the abnormal log section sample of the output of first machine learning model described in fruit is inconsistent, adjusts the first machine Device learning model, the abnormal cause for exporting the first machine learning model are consistent with the label of the abnormal log section sample.
9. a kind of electronic equipment is characterized in that, comprising:
Memory is configured to storage executable instruction.
Processor is configured to execute the executable instruction stored in the memory, with any in execution according to claim 1-7 A method.
10. a kind of computer-readable program medium, which is characterized in that it is stored with computer program instructions, when the computer When instruction is computer-executed, computer is made to execute method described in any of -7 according to claim 1.
CN201811237458.3A 2018-10-23 2018-10-23 Business abnormal investigation method, apparatus, electronic equipment and storage medium in execution Pending CN109615312A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201811237458.3A CN109615312A (en) 2018-10-23 2018-10-23 Business abnormal investigation method, apparatus, electronic equipment and storage medium in execution

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811237458.3A CN109615312A (en) 2018-10-23 2018-10-23 Business abnormal investigation method, apparatus, electronic equipment and storage medium in execution

Publications (1)

Publication Number Publication Date
CN109615312A true CN109615312A (en) 2019-04-12

Family

ID=66002057

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811237458.3A Pending CN109615312A (en) 2018-10-23 2018-10-23 Business abnormal investigation method, apparatus, electronic equipment and storage medium in execution

Country Status (1)

Country Link
CN (1) CN109615312A (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111143840A (en) * 2019-12-31 2020-05-12 上海观安信息技术股份有限公司 Method and system for identifying abnormity of host operation instruction
CN111949994A (en) * 2020-08-19 2020-11-17 北京紫光展锐通信技术有限公司 Vulnerability analysis method and system, electronic device and storage medium
CN112116330A (en) * 2020-09-28 2020-12-22 中国银行股份有限公司 Workflow error queue automatic processing method and device
CN115130111A (en) * 2022-07-07 2022-09-30 大庆旭航科技有限公司 AI analysis-based system operation vulnerability repairing method and big data service system

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080215922A1 (en) * 2007-01-16 2008-09-04 International Business Machines Corporation Method and System for Diagnosing an Application
CN104978529A (en) * 2015-03-10 2015-10-14 腾讯科技(深圳)有限公司 Exception handling method, exception handling system and exception handling server for webpage front end
CN105719112A (en) * 2015-05-22 2016-06-29 北京小度信息科技有限公司 Determination method and device for distribution abnormal state, and server
CN105893229A (en) * 2016-04-01 2016-08-24 浪潮电子信息产业股份有限公司 Method and device for testing journaling function of computer protection system
CN108170537A (en) * 2017-12-06 2018-06-15 北京像素软件科技股份有限公司 Game API approach, device, interface server and readable storage medium storing program for executing

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080215922A1 (en) * 2007-01-16 2008-09-04 International Business Machines Corporation Method and System for Diagnosing an Application
CN104978529A (en) * 2015-03-10 2015-10-14 腾讯科技(深圳)有限公司 Exception handling method, exception handling system and exception handling server for webpage front end
CN105719112A (en) * 2015-05-22 2016-06-29 北京小度信息科技有限公司 Determination method and device for distribution abnormal state, and server
CN105893229A (en) * 2016-04-01 2016-08-24 浪潮电子信息产业股份有限公司 Method and device for testing journaling function of computer protection system
CN108170537A (en) * 2017-12-06 2018-06-15 北京像素软件科技股份有限公司 Game API approach, device, interface server and readable storage medium storing program for executing

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111143840A (en) * 2019-12-31 2020-05-12 上海观安信息技术股份有限公司 Method and system for identifying abnormity of host operation instruction
CN111143840B (en) * 2019-12-31 2022-01-25 上海观安信息技术股份有限公司 Method and system for identifying abnormity of host operation instruction
CN111949994A (en) * 2020-08-19 2020-11-17 北京紫光展锐通信技术有限公司 Vulnerability analysis method and system, electronic device and storage medium
CN112116330A (en) * 2020-09-28 2020-12-22 中国银行股份有限公司 Workflow error queue automatic processing method and device
CN112116330B (en) * 2020-09-28 2024-05-28 中国银行股份有限公司 Automatic workflow error queue processing method and device
CN115130111A (en) * 2022-07-07 2022-09-30 大庆旭航科技有限公司 AI analysis-based system operation vulnerability repairing method and big data service system

Similar Documents

Publication Publication Date Title
US11748416B2 (en) Machine-learning system for servicing queries for digital content
CN109615312A (en) Business abnormal investigation method, apparatus, electronic equipment and storage medium in execution
US10963688B2 (en) Systems and methods for a customer feedback classification system
AU2019204776A1 (en) Preventative diagnosis prediction and solution determination of future event using internet of things and artificial intelligence
US10410219B1 (en) Providing automatic self-support responses
EP4141760A1 (en) Service management control platform
US11102276B2 (en) System and method for providing more appropriate question/answer responses based upon profiles
US20230004819A1 (en) Method and apparatus for training semantic retrieval network, electronic device and storage medium
US20220350690A1 (en) Training method and apparatus for fault recognition model, fault recognition method and apparatus, and electronic device
CN109146152A (en) Incident classification prediction technique and device on a kind of line
US11263224B2 (en) Identifying and scoring data values
CN111191893A (en) Wind control text processing method and device and electronic equipment
CN112558966B (en) Depth model visualization data processing method and device and electronic equipment
US20230367821A1 (en) Machine-learning system for servicing queries for digital content
US20210166016A1 (en) Product baseline information extraction
US20220343217A1 (en) Intelligent support framework
CN115221936A (en) Record matching in a database system
WO2022164549A1 (en) Root cause pattern recognition based model training
CN112019675A (en) Address list contact person sorting method and device and electronic equipment
CN110083807A (en) The modification of contract influences automatic prediction method, device, medium and electronic equipment
CN113761183A (en) Intention recognition method and intention recognition device
US20240135199A1 (en) Generating and upgrading knowledge graph data structures
US20240134887A1 (en) Systems and methods for manipulating time-dependent relationships in knowledge graph data structures
US20220400159A1 (en) Merging data from various content domains to train a machine learning model to generate predictions for a specific content domain
CN109766260A (en) Configure method, apparatus, electronic equipment and the storage medium of test action

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination