CN110727533A - Alarm method, device, equipment and medium - Google Patents
Alarm method, device, equipment and medium Download PDFInfo
- Publication number
- CN110727533A CN110727533A CN201910917009.1A CN201910917009A CN110727533A CN 110727533 A CN110727533 A CN 110727533A CN 201910917009 A CN201910917009 A CN 201910917009A CN 110727533 A CN110727533 A CN 110727533A
- Authority
- CN
- China
- Prior art keywords
- time
- detected
- data
- transaction
- group
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0751—Error or fault detection not based on redundancy
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/0766—Error or fault reporting or storing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
Abstract
The invention discloses a method, a device, equipment and a medium for alarming, which comprise the following steps: acquiring transaction data in real time in a transaction system; carrying out anomaly detection on the acquired transaction data in real time to record the occurrence time of an abnormal behavior; when the abnormal behavior is detected, counting whether the total number of the abnormal behaviors occurring in a preset time period before the abnormal behavior occurs reaches a preset value or not; and if so, sending alarm information to the monitoring terminal. According to the embodiment of the application, the total number of the abnormal behaviors in the preset time period before the abnormal behaviors occur each time is counted, when the total number of the abnormal behaviors in the preset time period reaches the preset value, the alarm is given to the monitoring terminal, the fault corresponding to the discontinuous abnormal behaviors can be detected in the mode, the alarm is given out, and the accuracy of detecting the fault in the transaction system is improved.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, a device, and a medium for alarming.
Background
With the rapid development of the internet, a large number of business systems (such as banking business systems, tax systems, etc.) appear in the field of computers, the business volumes processed by the business systems are also continuously increased, and the probability of the business systems failing due to the increase of the business volumes is also continuously improved. In order to solve the fault in the service system in time, the service system needs to be monitored by the server to determine whether the service system has the fault, and the server can notify the operation and maintenance personnel at the first time after determining that the service system has the fault, so that the operation and maintenance personnel can solve the fault in time.
The server mainly adopts two modes for monitoring the service system, wherein the mode is as follows: the server detects that the abnormality in the service system continuously occurs for N times, and then confirms that the service system fails; the second method comprises the following steps: and if the server detects that the abnormality in the service system lasts for M minutes, the server confirms that the service system has a fault. However, the two monitoring methods can only detect the fault corresponding to the continuous abnormality, but the faults under other conditions cannot be detected, so that the server cannot give an alarm to the operation and maintenance personnel when the faults under other conditions occur, and the accuracy of the alarm to the operation and maintenance personnel by the server is low.
Disclosure of Invention
In view of this, an object of the present application is to provide an alarming method, apparatus, device and medium, so as to solve the problem in the prior art how to improve the accuracy of alarming for operation and maintenance personnel.
In a first aspect, an embodiment of the present application provides an alarm method, including:
acquiring transaction data in real time in a transaction system;
carrying out anomaly detection on the acquired transaction data in real time to record the occurrence time of an abnormal behavior;
when the abnormal behavior is detected, counting whether the total number of the abnormal behaviors occurring in a preset time period before the abnormal behavior occurs reaches a preset value or not;
and if so, sending alarm information to the monitoring terminal.
Optionally, the performing, in real time, an anomaly detection on the acquired transaction data to record an occurrence time of an abnormal behavior includes:
grouping the acquired transaction data according to the occurrence time of the transaction data to obtain a plurality of groups of data to be detected;
aiming at each group of data to be detected, calculating the transaction density of the group of data to be detected according to the occurrence time of transaction data in the group of data to be detected;
determining whether reference time corresponding to a time period to be detected is used as recording abnormal behavior occurrence time or not according to the transaction density of each group of data to be detected; the generation time of the first transaction data in the group of data to be detected is used as a starting time, the generation time of the last transaction data in the group of data to be detected is used as an ending time, and the time period to be detected is a corresponding time period from the starting time to the ending time.
Optionally, for each group of data to be detected, calculating the transaction density of the group of data to be detected according to the occurrence time of the transaction data in the group of data to be detected, including:
aiming at each group of data to be detected, acquiring the total transaction data amount of the group of data to be detected;
for each group of data to be detected, determining the transaction density of the group of data to be detected according to the ratio of the total transaction data amount of the group of data to be detected to the time length corresponding to the group of data to be detected; the time length is a difference value between an ending time and a starting time corresponding to the group of data to be detected.
Optionally, the reference time corresponding to the time period to be detected is a start time or an end time of the time period to be detected; the time length of each time period to be detected is the same.
Optionally, when the abnormal behavior is detected, counting whether a total number of the abnormal behaviors occurring within a preset time period before the occurrence of the abnormal behavior reaches a predetermined value includes:
judging whether an abnormal behavior for generating historical alarm information exists in a first preset time period before the abnormal behavior occurs;
if the abnormal behavior corresponding to the last alarm information is stored in the first preset time corresponding to the abnormal behavior, taking the reference time of the last abnormal behavior corresponding to one alarm information as the starting time of the second preset time, and taking the reference time of the abnormal behavior corresponding to the last alarm information as the ending time of the first preset time and the second preset time to detect so as to determine whether the total number of the abnormal behaviors in the first preset time reaches a preset value or not; wherein the time length of the first preset time is the same as the maximum value of the time length of the second preset time.
Optionally, if yes, after sending the alarm information to the monitoring terminal, the method further includes:
and analyzing according to the alarm information to obtain a solution of the detected abnormal behavior.
In a second aspect, an embodiment of the present application provides an apparatus for alarming, including:
the acquisition module is used for acquiring transaction data in real time in the transaction system;
the real-time detection module is used for carrying out abnormity detection on the acquired transaction data in real time so as to record the occurrence time of abnormal behaviors;
the judging module is used for counting whether the total number of the abnormal behaviors occurring in a preset time period before the abnormal behaviors occur reaches a preset value or not when the abnormal behaviors are detected; and if so, sending alarm information to the monitoring terminal.
Optionally, the real-time detection module includes: the device comprises a grouping module, a calculating module and a timing module;
the grouping module is used for grouping the acquired transaction data according to the occurrence time of the transaction data to obtain a plurality of groups of data to be detected;
the calculation module is used for calculating the transaction density of each group of data to be detected according to the occurrence time of the transaction data in the group of data to be detected;
the timing module is used for determining whether a reference moment corresponding to a time period to be detected is used as the occurrence time of the abnormal behavior according to the transaction density of each group of data to be detected; the generation time of the first transaction data in the group of data to be detected is used as a starting time, the generation time of the last transaction data in the group of data to be detected is used as an ending time, and the time period to be detected is a corresponding time period from the starting time to the ending time.
In a third aspect, an embodiment of the present application provides a computer device, which includes a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor implements the steps of the above method when executing the computer program.
In a fourth aspect, the present application provides a computer-readable storage medium, on which a computer program is stored, and the computer program, when executed by a processor, performs the steps of the above method.
The embodiment of the application provides an alarm method, which comprises the steps of firstly, acquiring transaction data in a transaction system in real time; then, carrying out abnormity detection on the acquired transaction data in real time to record the occurrence time of abnormal behaviors; in addition, when the abnormal behavior is detected, whether the total number of the abnormal behaviors occurring in a preset time period before the abnormal behavior occurs reaches a preset value or not is counted; and finally, if so, sending alarm information to the monitoring terminal.
According to the method and the system, the total number of the abnormal behaviors in the preset time period before the abnormal behaviors occur each time is counted, when the total number of the abnormal behaviors in the preset time period reaches a preset value, the alarm is given to the monitoring terminal, the fault corresponding to the discontinuous abnormal behaviors can be detected in the mode, the alarm is given out, and the accuracy of detecting the fault in the transaction system is improved.
In order to make the aforementioned objects, features and advantages of the present application more comprehensible, preferred embodiments accompanied with figures are described in detail below.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained from the drawings without inventive effort.
FIG. 1 is a schematic structural diagram of continuous abnormal data provided in an embodiment of the present application;
FIG. 2 is a schematic structural diagram of non-continuous abnormal data according to an embodiment of the present disclosure;
FIG. 3 is a schematic structural diagram of a single-time exception data according to an embodiment of the present application;
fig. 4 is a schematic flowchart of an alarm method according to an embodiment of the present application;
FIG. 5 is a schematic diagram of a variation curve of transaction amount versus time according to an embodiment of the present disclosure;
fig. 6 is a schematic structural diagram of an alarm device according to an embodiment of the present application;
fig. 7 is a schematic structural diagram of a computer device 700 according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments. The components of the embodiments of the present application, generally described and illustrated in the figures herein, can be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of the embodiments of the present application, presented in the accompanying drawings, is not intended to limit the scope of the claimed application, but is merely representative of selected embodiments of the application. All other embodiments, which can be derived by a person skilled in the art from the embodiments of the present application without making any creative effort, shall fall within the protection scope of the present application.
In a trading system, the phenomenon of failure occurrence is various. In the prior art, transaction data in the transaction system is monitored by the server to determine faults in the transaction system. The mode of determining the transaction system comprises two modes, namely: the server detects that the abnormality in the service system continuously occurs for N times, and then confirms that the service system fails; the second method comprises the following steps: and if the server detects that the abnormality in the service system lasts for M minutes, the server confirms that the service system has a fault. In both of the above-mentioned two ways of determining the failure in the transaction system, the server sends an alarm message after detecting continuous abnormal data (as shown in fig. 1). However, if the failure causes discontinuous abnormal data (as shown in fig. 2), the failure cannot be detected by the two methods, so that the failure may be reported by the server. If the failure shown in fig. 2 is solved, the most common solution of those skilled in the art is to send an alarm by the server every time abnormal data occurs, but if the abnormal data occurs only once in the service system (as shown in fig. 3), only the system fluctuates and the abnormal data is not caused by the failure of the service system, and the alarm sent by the server is inaccurate in this case.
In order to solve the above technical problem, as shown in fig. 4, an embodiment of the present application provides an alarm method, including:
s401, acquiring transaction data in a transaction system in real time;
s402, carrying out abnormity detection on the acquired transaction data in real time to record the occurrence time of abnormal behaviors;
s403, when the abnormal behavior is detected, counting whether the total number of the abnormal behaviors occurring in a preset time period before the abnormal behavior occurs reaches a preset value;
and S404, if yes, sending alarm information to the monitoring terminal.
In the step S401, the transaction system may be used for the user to perform transaction operation and generate transaction data, where the transaction data may be a transaction amount, a transaction success rate, a transaction response rate, and the like. And acquiring transaction data generated in real time in the service system through the server.
In the step S402, the abnormal behavior may be that the transaction density per unit time exceeds a preset transaction density.
Specifically, the server detects an abnormal behavior of the data acquired in real time, and when the server detects the abnormal behavior, the server records the occurrence time of the abnormal behavior.
In the above step S403, the preset time period may be a preset time length, such as 3 minutes, 5 minutes, and the like. The predetermined value may be a preset number of abnormal behaviors, for example, 3 times, 5 times, or the like.
Specifically, after detecting the abnormal behavior, the server determines a first starting time and a first ending time of the statistical total number of the abnormal behavior according to the occurrence time corresponding to the abnormal behavior and a preset time period, determines whether the occurrence time of the historical abnormal behavior is between the first starting time and the first ending time, calculates the total number of the abnormal behavior of the historical abnormal behavior between the first starting time and the first ending time, and determines whether the total number of the abnormal behavior reaches a preset value.
In step S404, the monitoring terminal may be configured to receive the alarm information, and the monitoring terminal may be a mobile terminal, a terminal in a computer, and the like, which is not limited herein. The alarm information may include occurrence time of the abnormal behavior, transaction data corresponding to the abnormal behavior, a judgment standard corresponding to the abnormal behavior, and the like.
Specifically, in step S403, if it is counted that the abnormal behavior in the preset time period before the occurrence of the abnormal behavior at this time always reaches the predetermined value, the information such as the abnormal data and the occurrence time corresponding to each abnormal behavior in the preset time period is obtained, and the obtained information is sent to the monitoring terminal, so that the worker can detect the abnormal behavior according to the obtained information, make a reasonable solution, and reduce the occurrence of the next abnormal behavior.
Through the four steps, the total number of the abnormal behaviors in the preset time period before the abnormal behaviors occur each time is counted, and when the total number of the abnormal behaviors in the preset time period reaches a preset value, the monitoring terminal is alarmed, so that the fault corresponding to the discontinuous abnormal behaviors can be detected, and the alarm is sent out, and the accuracy of detecting the fault in the transaction system is improved.
When detecting abnormal behavior, step S402, performing abnormal detection on the acquired transaction data in real time to record the occurrence time of abnormal behavior, including:
step 4021, grouping the acquired transaction data according to the occurrence time of the transaction data to obtain a plurality of groups of data to be detected;
step 4022, calculating the transaction density of each group of data to be detected according to the occurrence time of the transaction data in the group of data to be detected;
step 4023, determining whether reference time corresponding to a time period to be detected is used as the occurrence time of abnormal behaviors according to the transaction density of each group of data to be detected; the generation time of the first transaction data in the group of data to be detected is used as a starting time, the generation time of the last transaction data in the group of data to be detected is used as an ending time, and the time period to be detected is a corresponding time period from the starting time to the ending time.
In the above step 4021, a change curve of the transaction amount and the time as shown in fig. 5 is generated according to the transaction data acquired in real time, and in the process of acquiring the transaction data in real time, the transaction data is grouped according to the occurrence time of the transaction data, where the grouping process of the transaction data includes counting the transaction amount in the time period to be detected from the beginning of acquiring the transaction data, and the transaction amount corresponding to each time period to be detected is a set of transaction data to be detected, and after the acquired transaction data are grouped, at least one set of transaction data to be detected is obtained. The time period to be detected may be preset, may be a fixed value, or may be a non-fixed value, for example, 1 minute, 2 minutes, and the like, and is not limited herein.
In step 4022, the transaction density may be a ratio of the total transaction amount in the period to be detected to the period to be detected.
Specifically, in step 4022, the process of calculating the transaction density of each set of data to be detected includes:
40221, acquiring the total transaction data amount of each group of data to be detected;
step 40222, determining the transaction density of each group of data to be detected according to the ratio of the total transaction data amount of the group of data to be detected to the time length corresponding to the group of data to be detected; and the time length is the difference value between the ending time and the starting time of the time period to be detected corresponding to the group of data to be detected.
In the step 40221, for each group of data to be detected, the transaction amount at each time in the group of data to be detected is obtained, and the transaction amounts corresponding to each time are added to obtain the total transaction data amount of the group of data to be detected.
In the step 40222, a ratio of the total amount of the transaction data corresponding to the set of data to be detected to the time length of the time period to be detected corresponding to the set of data to be detected is calculated, so as to obtain the transaction density corresponding to the set of data to be detected.
In the above step 4023, for each group of data to be detected, it is determined whether the transaction density of the group of data to be detected is greater than the preset transaction density, if the transaction density of the group of data to be detected is greater than the preset transaction density, it is determined that the group of data to be detected corresponds to an abnormal behavior, and a certain time in the time period to be detected corresponding to the group of data to be detected is taken as a reference time, and the reference time is recorded as the occurrence time corresponding to the abnormal behavior. The reference time corresponding to the time period to be detected is the starting time or the ending time of the time period to be detected; the time length of each time period to be detected is the same. And if the transaction density of the group of detection data is less than or equal to the preset transaction density, determining that the group of transaction data to be detected is not abnormal behavior. And if the total amount of the transaction data in the time period to be detected is less than or equal to a preset transaction data total amount threshold value, determining that the abnormal behavior does not exist in the group of transaction data to be detected.
In addition to the above method for detecting abnormal behavior through transaction density, an embodiment of the present application further provides a method for determining abnormal behavior through transaction amount, including:
step 4024, grouping the acquired transaction data according to the occurrence time of the transaction data to obtain a plurality of groups of data to be detected;
step 4025, calculating the total amount of the transaction data of each group of data to be detected according to the occurrence time of the transaction data in the group of data to be detected;
step 4026, determining whether the reference time corresponding to the time period to be detected is used as the occurrence time of the abnormal behavior according to the total transaction data amount of each group of data to be detected.
In the above step 4024, a change curve of the transaction amount and the time as shown in fig. 5 is generated according to the transaction data acquired in real time, and in the process of acquiring the transaction data in real time, the transaction data is grouped according to the occurrence time of the transaction data, where the grouping process of the transaction data includes counting the transaction amount in the time period to be detected from the beginning of acquiring the transaction data, and the transaction amount corresponding to each time period to be detected is a set of transaction data to be detected, and after the acquired transaction data are grouped, at least one set of transaction data to be detected is obtained.
In the above step 4025, the total amount of the transaction data in the time period to be detected is counted according to the start time and the end time of the time period to be detected corresponding to each set of data to be detected.
In the above step 4026, first, a preset transaction data total amount threshold corresponding to the abnormal behavior is determined, for each group of data to be detected, it is determined whether the transaction data total amount in the time period to be detected is greater than the preset transaction data total amount threshold, if the transaction data total amount in the time period to be detected is greater than the preset transaction data total amount threshold, it is determined that the group of transaction data to be detected corresponds to an abnormal behavior, and a certain time in the time period to be detected corresponding to the group of transaction data to be detected is taken as a reference time, and the reference time is recorded as an occurrence time corresponding to the abnormal behavior. And if the total amount of the transaction data in the time period to be detected is less than or equal to a preset transaction data total amount threshold value, determining that the abnormal behavior does not exist in the group of transaction data to be detected.
After detecting the abnormal behavior in the transaction data, step S403, when detecting the abnormal behavior, counting whether a total number of the abnormal behaviors occurring within a preset time period before the occurrence of the current abnormal behavior reaches a predetermined value, including:
step 4031, judging whether an abnormal behavior for generating historical alarm information exists in a preset time period before the abnormal behavior occurs;
step 4032, if the abnormal behavior corresponding to the previous alarm information is stored in the preset time period corresponding to the abnormal behavior, taking the reference time of the last abnormal behavior as the start time of a first preset time period, taking the occurrence time of the abnormal behavior as the end time of the first preset time period, and detecting the first preset time period to determine whether the total number of the abnormal behavior in the first preset time period reaches a preset value; wherein the time length of the preset time is the same as the maximum value of the time length of the first preset time.
In step 4031, the history alarm information may be alarm information already displayed on the monitoring terminal.
Specifically, after an abnormal behavior is used for generating alarm information, information corresponding to the abnormal behavior (e.g., occurrence time of the abnormal behavior, transaction density corresponding to the abnormal behavior, etc.) may be stored in the server, and after a new abnormal behavior is detected, all pieces of abnormal behavior information within a preset time period are acquired. For each abnormal behavior, judging whether the abnormal behavior is the abnormal behavior used for generating historical alarm information or not by traversing the information corresponding to the stored abnormal behavior in the server; if the server stores the information corresponding to the abnormal behavior, the abnormal behavior is the abnormal behavior used for generating the historical alarm information; and if the server does not store the information corresponding to the abnormal behavior, the abnormal behavior is not the abnormal behavior used for generating the historical alarm information.
In step 4032, if an abnormal behavior corresponding to the previous alarm information is stored in a preset time period before the occurrence time of the detected abnormal behavior, the occurrence time corresponding to the abnormal behavior corresponding to the previous alarm information is used as the start time of the first preset time period, the occurrence time corresponding to the latest detected abnormal behavior is used as the end time of the first preset time period, and the total number of abnormal behaviors occurring in the first preset time period is counted. The time length of the first preset time period is less than or equal to the time length of the preset time period.
Through the two steps, in a first preset time period which is less than or equal to the preset time period, the total number of the abnormal behaviors which are more than the preset value is detected, and the abnormal behaviors do not wrap the abnormal behaviors used for generating the historical alarm information, namely, the total number of the detected abnormal behaviors reaches the preset value in time under the condition that the preset time period is not reached, the alarm information can be sent to the monitoring terminal.
After step S404, sending alarm information to the monitoring terminal, the method includes:
and analyzing according to the alarm information to obtain a solution of the detected abnormal behavior.
Specifically, according to the alarm information, the worker determines the fault reason according to the alarm information obtained by the monitoring terminal, and maintains the fault through the monitoring terminal.
For example, the staff of the business system receives the alarm message through the monitoring terminal, knows that the transaction density of the business system at 8 am is lower than 80% by checking the alarm message, checks the alarm message through the operation and maintenance tool to determine that a problem occurs in the account transfer link of the business system, confirms that the network bearing the account transfer has a problem (for example, the network setting is modified), and maintains the network so that the network returns to normal.
As shown in fig. 6, an embodiment of the present application provides an apparatus for alarming, including:
the acquisition module 601 is used for acquiring transaction data in real time in a transaction system;
a real-time detection module 602, configured to perform anomaly detection on the acquired transaction data in real time to record occurrence time of an abnormal behavior;
the determining module 603 is configured to, when the abnormal behavior is detected, count whether a total number of abnormal behaviors occurring within a preset time period before the occurrence of the abnormal behavior reaches a predetermined value; and if so, sending alarm information to the monitoring terminal.
Optionally, the real-time detection module 602 includes: the device comprises a grouping module, a calculating module and a timing module;
the grouping module is used for grouping the acquired transaction data according to the occurrence time of the transaction data to obtain a plurality of groups of data to be detected;
the calculation module is used for calculating the transaction density of each group of data to be detected according to the occurrence time of the transaction data in the group of data to be detected;
the timing module is used for determining whether a reference moment corresponding to a time period to be detected is used as the occurrence time of the abnormal behavior according to the transaction density of each group of data to be detected; taking the occurrence time of the first transaction data in the group of data to be detected as a starting time and the occurrence time of the last transaction data in the group of data to be detected as an ending time, wherein the time period to be detected is a corresponding time period between the starting time and the ending time; the reference time corresponding to the time period to be detected is the starting time or the ending time of the time period to be detected; the time length of each time period to be detected is the same.
Optionally, when the calculating module calculates the transaction density of each group of data to be detected according to the occurrence time of the transaction data in the group of data to be detected, the calculating module includes:
aiming at each group of data to be detected, acquiring the total transaction data amount of the group of data to be detected;
for each group of data to be detected, determining the transaction density of the group of data to be detected according to the ratio of the total transaction data amount of the group of data to be detected to the time length corresponding to the group of data to be detected; the time length is a difference value between an ending time and a starting time corresponding to the group of data to be detected.
Optionally, when the determining module detects the abnormal behavior, it is counted whether a total number of the abnormal behaviors occurring within a preset time period before the occurrence of the abnormal behavior reaches a predetermined value, where the counting includes:
judging whether an abnormal behavior for generating historical alarm information exists in a first preset time period before the abnormal behavior occurs;
if the abnormal behavior corresponding to the last alarm information is stored in the first preset time corresponding to the abnormal behavior, taking the reference time of the last abnormal behavior corresponding to one alarm information as the starting time of the second preset time, and taking the reference time of the abnormal behavior corresponding to the last alarm information as the ending time of the first preset time and the second preset time to detect so as to determine whether the total number of the abnormal behaviors in the first preset time reaches a preset value or not; wherein the time length of the first preset time is the same as the maximum value of the time length of the second preset time.
The device, still include: an analysis module;
and the analysis module is used for analyzing according to the alarm information to obtain a solution of the detected abnormal behavior.
Corresponding to the method of the alarm in fig. 1, an embodiment of the present application further provides a computer device 700, as shown in fig. 7, the device includes a memory 701, a processor 702, and a computer program stored in the memory 701 and executable on the processor 702, where the processor 702 implements the steps of the method of the alarm when executing the computer program.
Specifically, the memory 701 and the processor 702 may be general memories and general processors, which are not specifically limited herein, and when the processor 702 runs a computer program stored in the memory 701, the method for alarming may be executed, so as to solve the problem in the prior art of how to improve accuracy of alarming for operation and maintenance staff.
Corresponding to the method of warning in fig. 1, the present application further provides a computer readable storage medium, on which a computer program is stored, and the computer program is executed by a processor to perform the steps of the method of warning.
Specifically, the storage medium can be a general storage medium, such as a mobile disk, a hard disk, and the like, and when a computer program on the storage medium is run, the method for alarming can be executed, so as to solve the problem in the prior art that how to improve the accuracy of alarming for operation and maintenance personnel.
In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method may be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one logical division, and there may be other divisions when actually implemented, and for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection of devices or units through some communication interfaces, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit.
The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus once an item is defined in one figure, it need not be further defined and explained in subsequent figures, and moreover, the terms "first", "second", "third", etc. are used merely to distinguish one description from another and are not to be construed as indicating or implying relative importance.
Finally, it should be noted that: the above-mentioned embodiments are only specific embodiments of the present application, and are used for illustrating the technical solutions of the present application, but not limiting the same, and the scope of the present application is not limited thereto, and although the present application is described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: any person skilled in the art can modify or easily conceive the technical solutions described in the foregoing embodiments or equivalent substitutes for some technical features within the technical scope disclosed in the present application; such modifications, changes or substitutions do not depart from the spirit and scope of the present disclosure, which should be construed in light of the above teachings. Are intended to be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.
Claims (10)
1. A method of alerting, comprising:
acquiring transaction data in real time in a transaction system;
carrying out anomaly detection on the acquired transaction data in real time to record the occurrence time of an abnormal behavior;
when the abnormal behavior is detected, counting whether the total number of the abnormal behaviors occurring in a preset time period before the abnormal behavior occurs reaches a preset value or not;
and if so, sending alarm information to the monitoring terminal.
2. The method of claim 1, wherein said performing anomaly detection on said captured transaction data in real-time to record anomalous behavior occurrence times comprises:
grouping the acquired transaction data according to the occurrence time of the transaction data to obtain a plurality of groups of data to be detected;
aiming at each group of data to be detected, calculating the transaction density of the group of data to be detected according to the occurrence time of transaction data in the group of data to be detected;
determining whether reference time corresponding to a time period to be detected is used as recording abnormal behavior occurrence time or not according to the transaction density of each group of data to be detected; the generation time of the first transaction data in the group of data to be detected is used as a starting time, the generation time of the last transaction data in the group of data to be detected is used as an ending time, and the time period to be detected is a corresponding time period from the starting time to the ending time.
3. The method of claim 2, wherein calculating, for each set of data to be detected, a transaction density for the set of data to be detected based on a time of occurrence of transaction data in the set of data to be detected comprises:
aiming at each group of data to be detected, acquiring the total transaction data amount of the group of data to be detected;
for each group of data to be detected, determining the transaction density of the group of data to be detected according to the ratio of the total transaction data amount of the group of data to be detected to the time length corresponding to the group of data to be detected; the time length is a difference value between an ending time and a starting time corresponding to the group of data to be detected.
4. The method according to claim 2, wherein the reference time corresponding to the time period to be detected is a start time or an end time of the time period to be detected; the time length of each time period to be detected is the same.
5. The method according to claim 3, wherein when the abnormal behavior is detected, counting whether a total number of abnormal behaviors occurring within a preset time period before the occurrence of the current abnormal behavior reaches a predetermined value includes:
judging whether an abnormal behavior for generating historical alarm information exists in a first preset time period before the abnormal behavior occurs;
if the abnormal behavior corresponding to the last alarm information is stored in the first preset time corresponding to the abnormal behavior, taking the reference time of the last abnormal behavior corresponding to one alarm information as the starting time of the second preset time, and taking the reference time of the abnormal behavior corresponding to the last alarm information as the ending time of the first preset time and the second preset time to detect so as to determine whether the total number of the abnormal behaviors in the first preset time reaches a preset value or not; wherein the time length of the first preset time is the same as the maximum value of the time length of the second preset time.
6. The method of claim 1, wherein if yes, after sending the alarm information to the monitoring terminal, further comprising:
and analyzing according to the alarm information to obtain a solution of the detected abnormal behavior.
7. An alerting device comprising:
the acquisition module is used for acquiring transaction data in real time in the transaction system;
the real-time detection module is used for carrying out abnormity detection on the acquired transaction data in real time so as to record the occurrence time of abnormal behaviors;
the judging module is used for counting whether the total number of the abnormal behaviors occurring in a preset time period before the abnormal behaviors occur reaches a preset value or not when the abnormal behaviors are detected; and if so, sending alarm information to the monitoring terminal.
8. The apparatus of claim 7, wherein the real-time detection module comprises: grouping module, calculating module and timing module
The grouping module is used for grouping the acquired transaction data according to the occurrence time of the transaction data to obtain a plurality of groups of data to be detected;
the calculation module is used for calculating the transaction density of each group of data to be detected according to the occurrence time of the transaction data in the group of data to be detected;
the timing module is used for determining whether a reference moment corresponding to a time period to be detected is used as the occurrence time of the abnormal behavior according to the transaction density of each group of data to be detected; the generation time of the first transaction data in the group of data to be detected is used as a starting time, the generation time of the last transaction data in the group of data to be detected is used as an ending time, and the time period to be detected is a corresponding time period from the starting time to the ending time.
9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method of any of the preceding claims 1-6 are implemented by the processor when executing the computer program.
10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, is adapted to carry out the steps of the method of any one of the preceding claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910917009.1A CN110727533A (en) | 2019-09-26 | 2019-09-26 | Alarm method, device, equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910917009.1A CN110727533A (en) | 2019-09-26 | 2019-09-26 | Alarm method, device, equipment and medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110727533A true CN110727533A (en) | 2020-01-24 |
Family
ID=69219502
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910917009.1A Pending CN110727533A (en) | 2019-09-26 | 2019-09-26 | Alarm method, device, equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110727533A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111586129A (en) * | 2020-04-28 | 2020-08-25 | 北京奇艺世纪科技有限公司 | Alarm method and device for data synchronization, electronic equipment and storage medium |
| CN111782462A (en) * | 2020-06-13 | 2020-10-16 | 华青融天(北京)软件股份有限公司 | Alarm method and device and electronic equipment |
| CN112231174A (en) * | 2020-09-30 | 2021-01-15 | 中国银联股份有限公司 | Abnormity warning method, device, equipment and storage medium |
| CN113723956A (en) * | 2021-08-09 | 2021-11-30 | 上海浦东发展银行股份有限公司 | Abnormity monitoring method, device, equipment and storage medium |
| CN115118463A (en) * | 2022-06-10 | 2022-09-27 | 深信服科技股份有限公司 | Method and device for detecting defect host, electronic equipment and storage medium |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107202604A (en) * | 2017-03-02 | 2017-09-26 | 湖南工业大学 | A kind of alert processing method and system |
| CN108537544A (en) * | 2018-04-04 | 2018-09-14 | 中南大学 | A kind of transaction system method for real-time monitoring and its monitoring system |
| CN108989084A (en) * | 2018-06-11 | 2018-12-11 | 新疆玖富万卡信息技术有限公司 | Abnormal data monitoring method, apparatus and system |
| WO2019080918A1 (en) * | 2017-10-26 | 2019-05-02 | 中兴通讯股份有限公司 | Method for suppressing redundant alarms, and network management device and storage medium |
| CN110191094A (en) * | 2019-04-26 | 2019-08-30 | 北京奇安信科技有限公司 | Monitoring method and device, storage medium, the terminal of abnormal data |
-
2019
- 2019-09-26 CN CN201910917009.1A patent/CN110727533A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107202604A (en) * | 2017-03-02 | 2017-09-26 | 湖南工业大学 | A kind of alert processing method and system |
| WO2019080918A1 (en) * | 2017-10-26 | 2019-05-02 | 中兴通讯股份有限公司 | Method for suppressing redundant alarms, and network management device and storage medium |
| CN108537544A (en) * | 2018-04-04 | 2018-09-14 | 中南大学 | A kind of transaction system method for real-time monitoring and its monitoring system |
| CN108989084A (en) * | 2018-06-11 | 2018-12-11 | 新疆玖富万卡信息技术有限公司 | Abnormal data monitoring method, apparatus and system |
| CN110191094A (en) * | 2019-04-26 | 2019-08-30 | 北京奇安信科技有限公司 | Monitoring method and device, storage medium, the terminal of abnormal data |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111586129A (en) * | 2020-04-28 | 2020-08-25 | 北京奇艺世纪科技有限公司 | Alarm method and device for data synchronization, electronic equipment and storage medium |
| CN111782462A (en) * | 2020-06-13 | 2020-10-16 | 华青融天(北京)软件股份有限公司 | Alarm method and device and electronic equipment |
| CN112231174A (en) * | 2020-09-30 | 2021-01-15 | 中国银联股份有限公司 | Abnormity warning method, device, equipment and storage medium |
| WO2022068549A1 (en) * | 2020-09-30 | 2022-04-07 | 中国银联股份有限公司 | Abnormality alarm method and apparatus, and device and storage medium |
| TWI819385B (en) * | 2020-09-30 | 2023-10-21 | 大陸商中國銀聯股份有限公司 | Abnormal alarm methods, devices, equipment and storage media |
| CN112231174B (en) * | 2020-09-30 | 2024-02-23 | 中国银联股份有限公司 | Abnormality warning method, device, equipment and storage medium |
| CN113723956A (en) * | 2021-08-09 | 2021-11-30 | 上海浦东发展银行股份有限公司 | Abnormity monitoring method, device, equipment and storage medium |
| CN115118463A (en) * | 2022-06-10 | 2022-09-27 | 深信服科技股份有限公司 | Method and device for detecting defect host, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110727533A (en) | Alarm method, device, equipment and medium | |
| CN109981328B (en) | Fault early warning method and device | |
| EP3121727B1 (en) | Information processing device and error detection method | |
| JP5704234B2 (en) | Message determination device and message determination program | |
| JP5098821B2 (en) | Monitoring device and monitoring method for detecting a sign of failure of monitored system | |
| JP4573179B2 (en) | Performance load abnormality detection system, performance load abnormality detection method, and program | |
| CN104778111A (en) | Alarm method and alarm device | |
| CN107391335B (en) | Method and equipment for checking health state of cluster | |
| JP2015028700A (en) | Failure detection device, failure detection method, failure detection program and recording medium | |
| CN105117301A (en) | Memory warning method and apparatus | |
| JP6413537B2 (en) | Predictive failure notification device, predictive notification method, predictive notification program | |
| CN110489260B (en) | Fault identification method and device and BMC | |
| CN115328733A (en) | Alarm method and device applied to business system, electronic equipment and storage medium | |
| CN113590427A (en) | Alarm method, device, storage medium and equipment for monitoring index abnormity | |
| JP2011247695A (en) | Abnormality diagnosis method and abnormality diagnosis system using pattern library | |
| JP6875199B2 (en) | Equipment diagnostic system | |
| CN110457185B (en) | Abnormality alarm method and device and electronic equipment | |
| CN110673973A (en) | Application programming interface API (application programming interface) abnormity determining method and device | |
| CN115690681A (en) | Processing method of abnormity judgment basis, abnormity judgment method and device | |
| JP2020038525A (en) | Abnormality detecting device | |
| CN114138620B (en) | Cloud platform log explosion detection method, device, equipment and storage medium | |
| CN111127855A (en) | Environmental event monitoring method and system of environmental Internet of things | |
| CN112416896A (en) | Data abnormity warning method and device, storage medium and electronic device | |
| CN111694715A (en) | Abnormity warning method, device, equipment and machine readable storage medium | |
| CN114610560B (en) | System abnormality monitoring method, device and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |