CN111190796A - Data adjusting method and device - Google Patents
Data adjusting method and device Download PDFInfo
- Publication number
- CN111190796A CN111190796A CN201911419499.9A CN201911419499A CN111190796A CN 111190796 A CN111190796 A CN 111190796A CN 201911419499 A CN201911419499 A CN 201911419499A CN 111190796 A CN111190796 A CN 111190796A
- Authority
- CN
- China
- Prior art keywords
- user
- monitoring
- value range
- data
- users
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3055—Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/302—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a software system
Abstract
The application provides a data adjusting method and device, after acquiring identity characteristic data of a user and behavior characteristic data of the user, dividing the user into corresponding user sets according to the identity characteristic data of the user, determining a monitoring index and a monitoring requirement when all users in the user sets monitor a monitored object according to the behavior characteristic data of all users in the user sets, acquiring an initial monitoring value range of the monitoring index, and adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement to obtain a target abnormal value range suitable for all users in the user sets, so that the target abnormal value range suitable for the behavior characteristic data of all users in the user sets can be determined for the user sets by taking the user sets as units. And the behavior characteristic data of the users in different user sets have difference, so that the difference of the target abnormal value range taking the user set as a unit is realized.
Description
Technical Field
The application belongs to the technical field of system monitoring, and particularly relates to a data adjusting method and device.
Background
In order to reduce the failure rate of the monitored object, the monitored indexes corresponding to the monitored object are very many, so that different directions of the monitored object can be monitored through the monitored indexes, for example, for one database, the monitored indexes corresponding to the database include, but are not limited to, response speed, data capacity and storage delay, and the response speed, data capacity and storage delay of the database can be monitored when the database is monitored. For the monitored objects, since there are many monitoring indexes corresponding to the monitored objects, it is necessary to set respective corresponding thresholds for the monitoring indexes to monitor the monitored objects in a threshold manner.
Disclosure of Invention
In view of this, an object of the present application is to provide a data adjusting method and apparatus, which are used for determining a target abnormal value range of a monitoring index corresponding to a user set by using the user set as a unit.
The application provides a data adjusting method, which comprises the following steps:
acquiring identity characteristic data of a user and behavior characteristic data of the user;
dividing the users into corresponding user sets according to the identity characteristic data of the users, wherein each user in the user sets monitors the same monitored object;
determining monitoring indexes and monitoring requirements of all users in the user set when monitoring the monitored object according to the behavior characteristic data of all users in the user set, wherein the monitoring indexes are used for indicating the monitoring direction of monitoring the monitored object, and the monitoring requirements are used for representing the requirements of monitoring the monitored object from the monitoring direction;
and acquiring an initial monitoring value range of the monitoring index, and adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement to obtain a target abnormal value range suitable for all users in the user set.
Optionally, the method further includes:
grouping all users in the user set to obtain each user group corresponding to the user set;
dividing the target abnormal value range to obtain an abnormal test value range of each user group;
obtaining abnormal test response data of each user group, wherein the abnormal test response data represent the results of monitoring the monitored object by the users in the user groups by adopting the corresponding abnormal test value range;
and adjusting the target abnormal value range according to the abnormal test response data of each user group and the abnormal test value range of each user group.
Optionally, the method further includes: and if receiving the alarm data of the user level, triggering the grouping of all the users in the user set and the division of the target abnormal value range so as to readjust the target abnormal value range, wherein the alarm data of the user level is used for indicating that the alarm is triggered by the user.
Optionally, the method further includes: if no alarm occurs within the preset time for monitoring the monitored object through the target abnormal value range, calculating a standard deviation between values within the target abnormal value range;
and if the standard deviation between the numerical values is smaller than the threshold value, removing the monitoring index corresponding to the target abnormal value range from the monitoring index range of the user set.
Optionally, the acquiring the identity characteristic data of the user includes: acquiring pre-marked identity characteristic data of a user;
or
The acquiring of the identity characteristic data of the user comprises: and acquiring at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user, and acquiring the identity characteristic data of the user according to at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user.
Optionally, the acquiring the behavior feature data of the user includes: and acquiring an abnormal event obtained when the user monitors the monitored object and response data of the user to the abnormal event, wherein the abnormal event represents the monitoring index, and the response data represents the monitoring requirement.
Optionally, the obtaining of the initial monitoring value range of the monitoring index includes:
acquiring historical monitoring data for monitoring the monitored object according to the monitoring index;
extracting a monitoring value indicating the abnormity of the monitored object from the historical monitoring data;
and obtaining an initial monitoring value range of the monitoring index according to the monitoring value.
Optionally, the adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement includes:
and determining an adjusting parameter for adjusting the initial monitoring value range according to the monitoring requirement, and adjusting the initial monitoring value range according to the adjusting parameter.
The present application further provides a data adjusting apparatus, including:
the acquiring unit is used for acquiring the identity characteristic data of the user and acquiring the behavior characteristic data of the user;
the dividing unit is used for dividing the users into corresponding user sets according to the identity characteristic data of the users, and each user in the user sets monitors the same monitored object;
a determining unit, configured to determine, according to behavior feature data of all users in the user set, a monitoring index and a monitoring requirement when all users in the user set monitor the monitored object, where the monitoring index is used to indicate a monitoring direction in which the monitored object is monitored, and the monitoring requirement is used to represent a requirement when the monitored object is monitored from the monitoring direction;
the acquisition unit is further configured to acquire an initial monitoring value range of the monitoring index;
and the adjusting unit is used for adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement to obtain a target abnormal value range suitable for all users in the user set.
Optionally, the apparatus further comprises:
the grouping unit is used for grouping all users in the user set to obtain each user group corresponding to the user set; the target abnormal value range is divided to obtain the abnormal test value range of each user group;
the acquiring unit is used for acquiring abnormal test response data of each user group, and the abnormal test response data represents a result that the users in the user groups adopt corresponding abnormal test value ranges to monitor the monitored object;
and the adjusting unit is further used for adjusting the target abnormal value range according to the abnormal test response data of each user group and the abnormal test value range of each user group.
It can be known from the above technical solutions that after obtaining the identity characteristic data of a user and the behavior characteristic data of the user, the users are divided into corresponding user sets according to the identity characteristic data of the user, each user in the user sets monitors the same monitored object, the monitoring index and the monitoring requirement of all users in the user sets when monitoring the monitored object are determined according to the behavior characteristic data of all users in the user sets, the initial monitoring value range of the monitoring index is obtained, and the initial monitoring value range of the monitoring index is adjusted according to the monitoring requirement, so that the target abnormal value range applicable to all users in the user sets is obtained, and thus, each user with the same identity characteristic data and behavior characteristic data can monitor the monitored object from the monitoring index using the same target abnormal value range, therefore, the target abnormal value range which is adaptive to the behavior characteristic data of all the users in the user set can be determined for the user set by taking the user set as a unit, and each user in the user set can adopt the target abnormal value range which is adaptive to the behavior characteristic data of the user to monitor. And the behavior characteristic data of the users in different user sets have difference, and the monitoring requirements of the corresponding different user sets for the same monitoring index are different, so that the target abnormal value ranges of the different user sets for the same monitoring index are different, and the differentiation of the target abnormal value ranges by taking the user sets as units is realized.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.
Fig. 1 is a flowchart of a data adjusting method provided in an embodiment of the present application;
FIG. 2 is a flow chart of another data adjustment method provided in the embodiments of the present application;
fig. 3 is a schematic structural diagram of a data adjustment apparatus according to an embodiment of the present application;
fig. 4 is a schematic structural diagram of another data adjustment apparatus according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are some embodiments of the present application, but not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
Referring to fig. 1, a flowchart of a data adjustment method provided in an embodiment of the present application is shown, which may include the following steps:
101: and acquiring the identity characteristic data of the user and acquiring the behavior characteristic data of the user. The identity characteristic data of the user is used for indicating the identity of the user monitoring the monitored object so as to indicate the engineer identity of the user monitoring the monitored object at present, for example, the user is an operating system engineer or a database engineer, or the user is an operation and maintenance engineer facing a specific application or an operation and maintenance engineer facing a specific database.
In this embodiment, one way to obtain the identity feature data of the user is as follows: the method includes the steps of obtaining pre-labeled user identity characteristic data to manually label user identities in advance, wherein the pre-labeled user identity characteristic data can be identity characteristic data of users labeled by an operation and maintenance management engineer to monitor a monitored object or identity characteristic data of users labeled in advance from other systems.
For example, other systems include, but are not limited to, an HR (Human Resource) management system in which division of departments within a company is stored, and an LDAP (Lightweight Directory Access Protocol) system in which corresponding work of different departments is different to indicate an engineer identity of a user, so that identity feature data of the user can be acquired from the HR system through a communication interface with the HR system. The directory service of the LDAP system also stores department information in the company, such as a company email directory, which can indicate basic information of employees of the company, a working group to which the employees belong, and the like, and can determine identity characteristic data of any employee in the company through the information, so that the identity characteristic data can be acquired from the LDAP system through a communication interface with the LDAP system in the same embodiment.
In this embodiment, another way to obtain the identity feature data of the user is as follows: the method comprises the steps of obtaining at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user, obtaining the identity characteristic data of the user according to the at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user, and achieving automatic determination of the identity characteristic data of the user.
The method for obtaining the identity characteristic data of the user according to at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user includes but is not limited to: inputting at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user into a pre-constructed classification model to obtain the identity characteristic data of the user output by the classification model, wherein the pre-constructed classification model is the condition data corresponding to the known identity characteristic data and the known identity characteristic data, and the condition data is the various data serving as the input parameters of the classification model. Besides the classification model, the identity feature data of the user can be obtained by using a rule engine and the like, and the details of this embodiment are not described.
In this embodiment, the behavior feature data of the user is used to represent the behavior generated when the user monitors the monitored object, such as monitoring an abnormal event of the monitored object and responding to the monitoring of the abnormal event, so as to represent the monitoring index corresponding to the user and the monitoring requirement when monitoring is performed in the monitoring direction indicated by the monitoring index. The process of acquiring the behavior characteristic data of the user comprises the following steps: the method comprises the steps of obtaining an abnormal event obtained when a user monitors a monitored object and response data of the user to the abnormal event, wherein the abnormal event represents a monitoring index, and the response data represents a monitoring requirement. Or the embodiment may also manually specify the monitoring index, and obtain behavior characteristic data generated when monitoring is performed by using the monitoring index after the monitoring index is manually specified, so as to obtain the monitoring requirement according to the behavior characteristic data.
The abnormal event and the response data to the abnormal event may be obtained from at least one of mail interaction data and historical access data of a work group to which the user belongs. The manner obtained according to the mail interaction data of the work group to which the user belongs may be, but is not limited to: acquiring keywords indicating abnormal events, such as false reports, delay and the like, from the mail interactive data, wherein the events corresponding to the keywords are the abnormal events, the interactive times in unit time in the mail interactive data and/or the interactive time interval of adjacent mails indicating the same abnormal event can be used as response data for the abnormal events, the more the interactive times in unit time are, the more the attention is paid to the abnormal events, the higher the monitoring requirement is, and otherwise, the lower the monitoring requirement is; the shorter the interaction time interval of the adjacent mails indicating the same exceptional event, the more important the exceptional event is, the higher the monitoring requirement is, otherwise, the lower the monitoring requirement is, thereby the monitoring requirement can be obtained through the response data of the exceptional event.
The mode of obtaining the abnormal event and the response data to the abnormal event according to the historical access data is as follows: and acquiring the resource accessed by the user from the historical access data, and extracting the alarm event from the operation log of the resource accessed by the user, so that the alarm time can be determined as the abnormal event, and the alarm frequency of the alarm event, the monitoring investment time for the resource to which the alarm event belongs and the monitoring frequency for the resource to which the alarm time belongs can be used as response data to embody the monitoring requirement for the abnormal event. The higher the monitoring frequency, the higher the monitoring requirement.
In this embodiment, the abnormal event and the response data to the abnormal event may also be labeled by the user, so that the abnormal event labeled by the user and the response data to the abnormal event can be acquired.
102: and dividing the users into corresponding user sets according to the identity characteristic data of the users, wherein each user in the user sets monitors the same monitored object.
It can be understood that the identity characteristic data of the user indicates an engineer identity of the user, and at least one of the monitoring index and the monitoring requirement corresponding to the monitoring index of different engineers is different in the process of monitoring the same monitored object, so that the users with the same engineer identity need to be divided into a user set in this embodiment. If a user set matched with the identity characteristic data exists after the identity characteristic data of the user is obtained (if the engineer identity of each user in the user set is the same as the engineer identity indicated by the identity characteristic data), adding the user into the user set, and if no user set matched with the identity characteristic data exists, constructing a new user set and adding the user into the constructed user set.
103: according to the behavior feature data of all users in the user set, determining monitoring indexes and monitoring requirements of all users in the user set when monitoring the monitored object, wherein the monitoring indexes are used for indicating the monitoring direction of monitoring the monitored object, and the monitoring requirements are used for representing the requirements of monitoring the monitored object from the monitoring direction.
Taking a database as an example, for a monitored object, the database can be monitored from the monitoring directions of response speed, data capacity, storage delay and the like, and if a database engineer has a relatively large storage delay to the database, the database engineer can monitor the database from the monitoring direction of storage delay, and the database engineer requires a relatively small storage delay to the database, which indicates that the data engineering is a requirement for the storage delay. If the storage delay of the database by the os engineer is not so relevant, the os engineer may monitor the database without delaying the storage, or if the database is monitored with delaying the storage, the storage delay required by the os engineer is smaller than the storage delay required by the database engineer.
The behavior characteristic data of the users can indicate abnormal events monitored by the users and responses for monitoring the abnormal events, the abnormal events can represent monitoring indexes, the responses for monitoring the abnormal events can indicate monitoring requirements, and therefore the monitoring indexes and the monitoring requirements of all the users in the user set when monitoring the monitored objects can be determined according to the behavior characteristic data of all the users in the user set. For example, the behavior feature data of the user may be input into a pre-constructed monitoring model to obtain a monitoring index and a monitoring requirement output by the monitoring model, and the construction process of the monitoring model is not further elaborated, or a corresponding relationship between the behavior feature data of the user and the monitoring index and the monitoring requirement is pre-constructed, so as to find the monitoring index and the monitoring requirement matching with the behavior feature data of the current user from the corresponding relationship.
104: and acquiring an initial monitoring value range of the monitoring index, and adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement to obtain a target abnormal value range suitable for all users in the user set.
The initial monitoring value range is suitable for all users monitoring in the monitoring direction indicated by the monitoring index, and the initial monitoring value range is not different due to different behavior characteristic data, that is, the initial monitoring value range is the same for all users monitoring in the monitoring direction indicated by the monitoring index, and the initial monitoring value range is used as basic data for adjustment to adjust the initial monitoring value range so as to obtain a target abnormal value range which is matched with the monitoring requirement of the user set and is suitable for all users in the user set, so that the target abnormal value range is matched with the behavior characteristic data of all users in the user set. Because the behavior characteristic data of the users in different user sets are different and the corresponding monitoring requirements are also different, the target abnormal value ranges corresponding to different user sets are also different, and the differentiation of the target abnormal value ranges taking the user sets as units is realized.
In this embodiment, one way to obtain the initial monitoring value range of the monitoring index is as follows: acquiring historical monitoring data for monitoring a monitored object according to a monitoring index, for example, acquiring historical monitoring data from a historical monitoring service system (such as an IT service management system), wherein the historical monitoring data can indicate monitoring conditions when monitoring is performed from the monitoring index, such as whether an abnormal event occurs or not, a corresponding monitoring value when the abnormal event occurs, and the like; extracting a monitoring value indicating the abnormity of a monitored object from historical monitoring data; and obtaining an initial monitoring value range of the monitoring index according to the monitoring value. The method for obtaining the initial monitoring value range of the monitoring index according to the monitoring value includes, but is not limited to, the following methods:
adjusting the monitoring value according to a statistical algorithm to obtain an initial monitoring value range, and adjusting the monitoring value based on the statistical algorithms such as percentile and poisson distribution; or the monitoring value is adjusted according to a preset dynamic threshold adjusting range, for example, the preset dynamic threshold adjusting range indicates that the maximum value of the monitoring value floats upwards in a certain range, the minimum value of the monitoring value floats downwards in a certain range, the floating ranges of the maximum value and the minimum value can be the same or different, for example, the maximum value floats upwards by 10%, and the minimum value floats downwards by 10%.
The purpose of adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement is as follows: obtaining a target abnormal value range matched with a user set to which a user belongs, so that the target abnormal value range can correspond to behavior characteristic data of the obtained monitoring requirement, wherein the process of adjusting the initial monitoring value range of the monitoring index is as follows:
and determining an adjusting parameter for adjusting the initial monitoring value range according to the monitoring requirement, adjusting the initial monitoring value range according to the adjusting parameter, wherein the adjusting parameter is used for indicating the direction of adjusting the initial monitoring value range, such as reduction or amplification. In this embodiment, the manner of extracting the monitoring value indicating the abnormality of the monitored object from the historical monitoring data to obtain the initial monitoring value range of the monitoring index may be referred to. For example, according to the monitoring requirement, a percentile interval matched with the monitoring requirement is determined, and an initial monitoring value range is adjusted in the percentile interval according to a certain threshold step length or proportion, for example, the initial monitoring value range is adjusted upwards or downwards, so that a target abnormal value range matched with the behavior feature data of all users in the user set is obtained, and the false alarm rate or the false alarm rate is reduced.
After the target abnormal value range is obtained, the data adjustment method provided in this embodiment may further send the target abnormal value range to each user end in the user set, for example, send the target abnormal value range to each user end in the user set through a preset interaction manner, such as a mail, an integrated web tool, and the like, and if a confirmation response fed back by at least one user end is received within a preset time or a feedback of each user end is not received within a preset time, monitor the target abnormal value range as a monitoring range; if a rejection response fed back by at least one user side is received within a preset time, the target abnormal value range needs to be obtained again, and the way of obtaining the target abnormal value range again is not explained.
It can be known from the above technical solutions that after obtaining the identity characteristic data of a user and the behavior characteristic data of the user, the users are divided into corresponding user sets according to the identity characteristic data of the user, each user in the user sets monitors the same monitored object, the monitoring index and the monitoring requirement of all users in the user sets when monitoring the monitored object are determined according to the behavior characteristic data of all users in the user sets, the initial monitoring value range of the monitoring index is obtained, and the initial monitoring value range of the monitoring index is adjusted according to the monitoring requirement, so that the target abnormal value range applicable to all users in the user sets is obtained, and thus, each user with the same identity characteristic data and behavior characteristic data can monitor the monitored object from the monitoring index using the same target abnormal value range, therefore, the target abnormal value range which is adaptive to the behavior characteristic data of all the users in the user set can be determined for the user set by taking the user set as a unit, and each user in the user set can adopt the target abnormal value range which is adaptive to the behavior characteristic data of the user to monitor. And the behavior characteristic data of the users in different user sets have difference, and the monitoring requirements of the corresponding different user sets for the same monitoring index are different, so that the target abnormal value ranges of the different user sets for the same monitoring index are different, and the differentiation of the target abnormal value ranges by taking the user sets as units is realized.
Referring to fig. 2, which shows a flowchart of another data adjustment method provided in the embodiment of the present application, on the basis of fig. 1, the method may further include the following steps:
105: and grouping all users in the user set to obtain each user group corresponding to the user set. In this embodiment, all users in the user set may be grouped according to any grouping condition in the preset grouping conditions, for example, grouping may be performed when the grouping condition indicates that the number of users in the user set reaches the preset value, for example, randomly grouping all users in the user set; the grouping condition indicates that grouping is performed when the number of instances monitoring the same resource in the user set reaches a preset number, and the grouping can be performed on users monitoring the resource of which the number of instances reaches the preset number.
106: and dividing the target abnormal value range to obtain the abnormal test value range of each user group.
In this embodiment, the target abnormal value range may be randomly divided to obtain multiple independent abnormal test value ranges, or overlapping values may exist in the multiple abnormal test value ranges, so that users of different user groups can test the abnormal test value ranges of the groups, thereby implementing a separation test on the target abnormal value range and improving the test efficiency.
107: and obtaining abnormal test response data of each user group, wherein the abnormal test response data represent the result of monitoring the monitored object by the users in the user group by adopting the corresponding abnormal test value range so as to indicate whether the abnormal test value range is matched with the behavior characteristic data of the users in the corresponding user group.
108: and adjusting the target abnormal value range according to the abnormal test response data of each user group and the abnormal test value range of each user group, so as to realize dynamic adjustment of the target abnormal value range.
The adjustment mode is as follows:
if the abnormal test response data of at least one user group indicates that the test is passed (the abnormal test value range of the user group is indicated to be adapted to the behavior feature data of the user in the user group), the target abnormal value range can be adjusted by taking the abnormal test value range of the user group passing the test as a reference, for example, the abnormal test value range of the user group passing the test is taken as a target abnormal value range, or at least one of up-and-down floating and poisson distribution statistics is corrected on the abnormal test value range of the user group passing the test, so that the target abnormal value range is obtained.
And if the abnormal test response data of each user group indicate that the test fails, forbidding to adjust the target abnormal value range, or recalculating the target abnormal value range.
According to the technical scheme, after the target abnormal value range is obtained, the user set can be grouped and the target abnormal value range can be divided, so that the target abnormal value range is classified and tested, and the target abnormal value range is dynamically adjusted.
For the above data adjusting method, the data adjusting method provided in this embodiment may further include the following steps: and if receiving the alarm data of the user level, triggering to group all users in the user set and divide the target abnormal value range so as to readjust the target abnormal value range, wherein the alarm data of the user level is used for indicating that the alarm is triggered by the user.
That is, if receiving the alarm data triggered by the user, which indicates that the monitoring of the currently adopted target abnormal value range is incorrect, the target abnormal value range needs to be adjusted again, where the alarm data triggered by the user may be that the monitoring system corresponding to the monitored object is changed or the version of the monitoring system is greatly updated, the user may trigger the alarm, or the user may find that monitoring through the current target abnormal value range generates a large amount of false alarms and missed alarms, so that the monitoring accuracy of the current target abnormal value range is reduced, and at this time, the user may trigger the alarm.
For the above data adjusting method, the data adjusting method provided in this embodiment may further include the following steps: if no alarm occurs within the preset time for monitoring the monitored object through the target abnormal value range, calculating the standard deviation between the values within the target abnormal value range; and if the standard deviation between the numerical values is smaller than the threshold value, removing the monitoring index corresponding to the target abnormal value range from the monitoring index range of the user set.
If the standard deviation between the values is smaller than the threshold, it indicates that the monitoring index to which the target abnormal value-taking range belongs is less necessary to monitor, or even has no necessity to monitor, and at this time, the monitoring index corresponding to the target abnormal value-taking range can be removed from the monitoring index range of the user set, so that one monitoring index is reduced, more system resources can be provided for the monitoring index to be monitored, and the monitoring efficiency is improved.
While, for purposes of simplicity of explanation, the foregoing method embodiments have been described as a series of acts or combination of acts, it will be appreciated by those skilled in the art that the present application is not limited by the order of acts or acts described, as some steps may occur in other orders or concurrently with other steps in accordance with the application. Further, those skilled in the art should also appreciate that the embodiments described in the specification are preferred embodiments and that the acts and modules referred to are not necessarily required in this application.
Corresponding to the foregoing method embodiment, an embodiment of the present application further provides a data adjusting apparatus, which has a structure as shown in fig. 3, and may include: an acquisition unit 11, a dividing unit 12, a determination unit 13, and an adjustment unit 14.
The acquiring unit 11 is used for acquiring the identity characteristic data of the user and acquiring the behavior characteristic data of the user.
Wherein the identity characteristic data of the user is used for indicating the user identity for monitoring the monitored object so as to indicate the engineer identity of the user for monitoring the monitored object at present, and the obtaining of the identity characteristic data of the user in the embodiment includes: acquiring pre-marked identity characteristic data of a user; or, the acquiring the identity characteristic data of the user comprises: and acquiring at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user, and acquiring the identity characteristic data of the user according to at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user.
In this embodiment, the behavior feature data of the user is used to represent the behavior generated when the user monitors the monitored object, such as monitoring an abnormal event of the monitored object and responding to the monitoring of the abnormal event, so as to represent the monitoring index corresponding to the user and the monitoring requirement when monitoring is performed in the monitoring direction indicated by the monitoring index. The step of acquiring the behavior characteristic data of the user comprises the following steps: the method comprises the steps of obtaining an abnormal event obtained when a user monitors a monitored object and response data of the user to the abnormal event, wherein the abnormal event represents a monitoring index, and the response data represents a monitoring requirement.
The dividing unit 12 is configured to divide users into corresponding user sets according to the identity feature data of the users, where each user in the user sets monitors the same monitored object.
The determining unit 13 is configured to determine, according to the behavior feature data of all users in the user set, a monitoring index and a monitoring requirement of all users in the user set when monitoring the monitored object, where the monitoring index is used to indicate a monitoring direction in which the monitored object is monitored, and the monitoring requirement is used to represent a requirement in which the monitored object is monitored from the monitoring direction.
The obtaining unit 11 is further configured to obtain an initial monitoring value range of the monitoring index. The initial monitoring value range is applicable to all users who monitor in the monitoring direction that the monitoring index instructed, and this initial monitoring value range can not be different because of the difference of behavior characteristic data, that is to say to all users who monitor in the monitoring direction that the monitoring index instructed, its initial monitoring value range is all the same, and in this embodiment, the initial monitoring value range that obtains the monitoring index includes: acquiring historical monitoring data for monitoring a monitored object according to the monitoring index; extracting a monitoring value indicating the abnormity of a monitored object from historical monitoring data; obtaining an initial monitoring value range of the monitoring index according to the monitoring value
And the adjusting unit 14 is configured to adjust the initial monitoring value range of the monitoring index according to the monitoring requirement, so as to obtain a target abnormal value range applicable to all users in the user set.
In this embodiment, the purpose of adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement is as follows: obtaining a target abnormal value range matched with a user set to which a user belongs, so that the target abnormal value range can correspond to behavior characteristic data of the obtained monitoring requirement, wherein the process of adjusting the initial monitoring value range of the monitoring index is as follows:
and determining an adjusting parameter for adjusting the initial monitoring value range according to the monitoring requirement, and adjusting the initial monitoring value range according to the adjusting parameter.
According to the technical scheme, the target abnormal value range which is adaptive to the behavior characteristic data of all the users in the user set can be determined for the user set by taking the user set as a unit, so that each user in the user set can adopt the target abnormal value range which is adaptive to the behavior characteristic data of the user to monitor. And the behavior characteristic data of the users in different user sets have difference, and the monitoring requirements of the corresponding different user sets for the same monitoring index are different, so that the target abnormal value ranges of the different user sets for the same monitoring index are different, and the differentiation of the target abnormal value ranges by taking the user sets as units is realized.
Referring to fig. 4, another data adjustment apparatus according to an embodiment of the present application is shown, and based on the foregoing fig. 3, the apparatus may further include: a grouping unit 15 and an obtaining unit 16.
And the grouping unit 15 is configured to group all users in the user set to obtain each user group corresponding to the user set. And the abnormal value range is used for dividing the target abnormal value range to obtain the abnormal test value range of each user group.
In this embodiment, all users in the user set may be grouped according to any grouping condition in the preset grouping conditions, for example, grouping may be performed when the grouping condition indicates that the number of users in the user set reaches the preset value, for example, randomly grouping all users in the user set; the grouping condition indicates that grouping is performed when the number of instances monitoring the same resource in the user set reaches a preset number, and the grouping can be performed on users monitoring the resource of which the number of instances reaches the preset number.
When the target abnormal value range is divided, the target abnormal value range can be randomly divided to obtain multiple independent abnormal test value ranges, or the multiple abnormal test value ranges have overlapped values, so that users of different user groups can test the abnormal test value ranges of all the groups, the separation test of the target abnormal value range is realized, and the test efficiency is improved.
The obtaining unit 16 is configured to obtain abnormal test response data of each user group, where the abnormal test response data represents a result of monitoring the monitored object by using a corresponding abnormal test value range for a user in the user group, so as to indicate whether the abnormal test value range is adapted to behavior feature data of the user in the corresponding user group.
The adjusting unit 14 is further configured to adjust the target abnormal value range according to the abnormal test response data of each user group and the abnormal test value range of each user group, so as to dynamically adjust the target abnormal value range. The adjustment mode is as follows:
if the abnormal test response data of at least one user group indicates that the test is passed (the abnormal test value range of the user group is indicated to be adapted to the behavior feature data of the user in the user group), the target abnormal value range can be adjusted by taking the abnormal test value range of the user group passing the test as a reference, for example, the abnormal test value range of the user group passing the test is taken as a target abnormal value range, or at least one of up-and-down floating and poisson distribution statistics is corrected on the abnormal test value range of the user group passing the test, so that the target abnormal value range is obtained.
And if the abnormal test response data of each user group indicate that the test fails, forbidding to adjust the target abnormal value range, or recalculating the target abnormal value range.
According to the technical scheme, after the target abnormal value range is obtained, the user set can be grouped and the target abnormal value range can be divided, so that the target abnormal value range is classified and tested, and the target abnormal value range is dynamically adjusted.
For the data adjusting apparatus, the data adjusting apparatus provided in this embodiment may further include: and the triggering unit is used for triggering the grouping unit to re-group all the users in the user set and divide the target abnormal value range to re-adjust the target abnormal value range if the user-level alarm data is received, and the user-level alarm data is used for indicating that the alarm is triggered by the user.
For the data adjusting apparatus, the data adjusting apparatus provided in this embodiment may further include: the monitoring index control unit is used for calculating the standard deviation between the numerical values in the target abnormal value range if no alarm occurs in the preset time for monitoring the monitored object through the target abnormal value range; and if the standard deviation between the numerical values is smaller than the threshold value, removing the monitoring index corresponding to the target abnormal value range from the monitoring index range of the user set.
It should be noted that, in the present specification, the embodiments are all described in a progressive manner, each embodiment focuses on differences from other embodiments, and the same and similar parts among the embodiments may be referred to each other. For the device-like embodiment, since it is basically similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.
Finally, it should also be noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the application. Thus, the present application is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
The foregoing is only a preferred embodiment of the present application and it should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present application, and these improvements and modifications should also be considered as the protection scope of the present application.
Claims (10)
1. A method of data adjustment, comprising:
acquiring identity characteristic data of a user and behavior characteristic data of the user;
dividing the users into corresponding user sets according to the identity characteristic data of the users, wherein each user in the user sets monitors the same monitored object;
determining monitoring indexes and monitoring requirements of all users in the user set when monitoring the monitored object according to the behavior characteristic data of all users in the user set, wherein the monitoring indexes are used for indicating the monitoring direction of monitoring the monitored object, and the monitoring requirements are used for representing the requirements of monitoring the monitored object from the monitoring direction;
and acquiring an initial monitoring value range of the monitoring index, and adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement to obtain a target abnormal value range suitable for all users in the user set.
2. The method of claim 1, further comprising:
grouping all users in the user set to obtain each user group corresponding to the user set;
dividing the target abnormal value range to obtain an abnormal test value range of each user group;
obtaining abnormal test response data of each user group, wherein the abnormal test response data represent the results of monitoring the monitored object by the users in the user groups by adopting the corresponding abnormal test value range;
and adjusting the target abnormal value range according to the abnormal test response data of each user group and the abnormal test value range of each user group.
3. The method of claim 2, further comprising: and if receiving the alarm data of the user level, triggering the grouping of all the users in the user set and the division of the target abnormal value range so as to readjust the target abnormal value range, wherein the alarm data of the user level is used for indicating that the alarm is triggered by the user.
4. The method of claim 2 or 3, further comprising: if no alarm occurs within the preset time for monitoring the monitored object through the target abnormal value range, calculating a standard deviation between values within the target abnormal value range;
and if the standard deviation between the numerical values is smaller than the threshold value, removing the monitoring index corresponding to the target abnormal value range from the monitoring index range of the user set.
5. The method of claim 1, the obtaining identity data of a user comprising: acquiring pre-marked identity characteristic data of a user;
or
The acquiring of the identity characteristic data of the user comprises: and acquiring at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user, and acquiring the identity characteristic data of the user according to at least one of the information of the workgroup to which the user belongs, the type of the resource accessed by the user and the access record data of the user.
6. The method of claim 1, the obtaining behavioral characteristic data of a user comprising: and acquiring an abnormal event obtained when the user monitors the monitored object and response data of the user to the abnormal event, wherein the abnormal event represents the monitoring index, and the response data represents the monitoring requirement.
7. The method according to any one of claims 1, 2, 3, 5, and 6, wherein the obtaining of the initial monitoring value range of the monitoring index includes:
acquiring historical monitoring data for monitoring the monitored object according to the monitoring index;
extracting a monitoring value indicating the abnormity of the monitored object from the historical monitoring data;
and obtaining an initial monitoring value range of the monitoring index according to the monitoring value.
8. The method according to any one of claims 1, 2, 3, 5, and 6, wherein adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement includes:
and determining an adjusting parameter for adjusting the initial monitoring value range according to the monitoring requirement, and adjusting the initial monitoring value range according to the adjusting parameter.
9. A data adjustment apparatus comprising:
the acquiring unit is used for acquiring the identity characteristic data of the user and acquiring the behavior characteristic data of the user;
the dividing unit is used for dividing the users into corresponding user sets according to the identity characteristic data of the users, and each user in the user sets monitors the same monitored object;
a determining unit, configured to determine, according to behavior feature data of all users in the user set, a monitoring index and a monitoring requirement when all users in the user set monitor the monitored object, where the monitoring index is used to indicate a monitoring direction in which the monitored object is monitored, and the monitoring requirement is used to represent a requirement when the monitored object is monitored from the monitoring direction;
the acquisition unit is further configured to acquire an initial monitoring value range of the monitoring index;
and the adjusting unit is used for adjusting the initial monitoring value range of the monitoring index according to the monitoring requirement to obtain a target abnormal value range suitable for all users in the user set.
10. The apparatus of claim 9, the apparatus further comprising:
the grouping unit is used for grouping all users in the user set to obtain each user group corresponding to the user set; the target abnormal value range is divided to obtain the abnormal test value range of each user group;
the acquiring unit is used for acquiring abnormal test response data of each user group, and the abnormal test response data represents a result that the users in the user groups adopt corresponding abnormal test value ranges to monitor the monitored object;
and the adjusting unit is further used for adjusting the target abnormal value range according to the abnormal test response data of each user group and the abnormal test value range of each user group.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911419499.9A CN111190796B (en) | 2019-12-31 | 2019-12-31 | Data adjusting method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911419499.9A CN111190796B (en) | 2019-12-31 | 2019-12-31 | Data adjusting method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111190796A true CN111190796A (en) | 2020-05-22 |
| CN111190796B CN111190796B (en) | 2021-10-22 |
Family
ID=70707967
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911419499.9A Active CN111190796B (en) | 2019-12-31 | 2019-12-31 | Data adjusting method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111190796B (en) |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101047836A (en) * | 2006-03-30 | 2007-10-03 | 英保达股份有限公司 | Monitoring system and method |
| US20100232268A1 (en) * | 2009-03-16 | 2010-09-16 | Hitachi Consumer Electronics Co., Ltd. | Method and apparatus for recording and reproducing optical information, and recording medium |
| CN101931534A (en) * | 2010-08-30 | 2010-12-29 | 中兴通讯股份有限公司 | Management method and device of operator resource usage license |
| CN102117306A (en) * | 2010-01-04 | 2011-07-06 | 阿里巴巴集团控股有限公司 | Method and system for monitoring ETL (extract-transform-load) data processing process |
| CN102427462A (en) * | 2012-01-13 | 2012-04-25 | 潘薇 | 'Gene network identity management' method based on depth identification and registration |
| CN103412911A (en) * | 2013-08-02 | 2013-11-27 | 中国工商银行股份有限公司 | Method and device for monitoring performance of database system |
| CN110262944A (en) * | 2019-06-21 | 2019-09-20 | 四川长虹电器股份有限公司 | The method that a kind of pair of K8s cluster container resource is monitored and is alerted |
-
2019
- 2019-12-31 CN CN201911419499.9A patent/CN111190796B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101047836A (en) * | 2006-03-30 | 2007-10-03 | 英保达股份有限公司 | Monitoring system and method |
| US20100232268A1 (en) * | 2009-03-16 | 2010-09-16 | Hitachi Consumer Electronics Co., Ltd. | Method and apparatus for recording and reproducing optical information, and recording medium |
| CN102117306A (en) * | 2010-01-04 | 2011-07-06 | 阿里巴巴集团控股有限公司 | Method and system for monitoring ETL (extract-transform-load) data processing process |
| CN101931534A (en) * | 2010-08-30 | 2010-12-29 | 中兴通讯股份有限公司 | Management method and device of operator resource usage license |
| CN102427462A (en) * | 2012-01-13 | 2012-04-25 | 潘薇 | 'Gene network identity management' method based on depth identification and registration |
| CN103412911A (en) * | 2013-08-02 | 2013-11-27 | 中国工商银行股份有限公司 | Method and device for monitoring performance of database system |
| CN110262944A (en) * | 2019-06-21 | 2019-09-20 | 四川长虹电器股份有限公司 | The method that a kind of pair of K8s cluster container resource is monitored and is alerted |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111190796B (en) | 2021-10-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8352589B2 (en) | System for monitoring computer systems and alerting users of faults | |
| US8463899B2 (en) | System, method and computer program product for optimized root cause analysis | |
| US20070168696A1 (en) | System for inventing computer systems and alerting users of faults | |
| CN107888441B (en) | Network traffic baseline self-learning self-adaption method | |
| US8543689B2 (en) | Apparatus and method for analysing a computer infrastructure | |
| KR20190006032A (en) | Method for determining importance of abnormality data and method for determining importance of abnormality data | |
| CN108718303B (en) | Safe operation and maintenance management method and system | |
| WO2003005279A1 (en) | System and methods for monitoring performance metrics | |
| CN103392176A (en) | Network event management | |
| US9600391B2 (en) | Operations management apparatus, operations management method and program | |
| CN101471808A (en) | Alarm display system and method of cluster storage system | |
| CN114201201A (en) | Method, device and equipment for detecting abnormity of business system | |
| CN106951360B (en) | Data statistical integrity calculation method and system | |
| CN105721719A (en) | Fault detection system and method of call center | |
| CN111190796B (en) | Data adjusting method and device | |
| CN113342625A (en) | Data monitoring method and system | |
| CN113190426B (en) | Stability monitoring method for big data scoring system | |
| KR100984282B1 (en) | An enterprise security management system using an memory cache | |
| CN114531338A (en) | Monitoring alarm and tracing method and system based on call chain data | |
| CN110600112B (en) | Method, device and equipment for discovering quality problems of parts | |
| CN114860543A (en) | Anomaly detection method, device, equipment and computer readable storage medium | |
| CN114564469A (en) | Method and system for processing collected data | |
| CN114020585A (en) | Service processing method, device and computer readable storage medium | |
| JP7081953B2 (en) | Alert notification device and alert notification method | |
| CN112131083B (en) | Alarm transaction processing method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |