CN112613995A

CN112613995A - Abnormality diagnosis method and apparatus

Info

Publication number: CN112613995A
Application number: CN202011643219.5A
Authority: CN
Inventors: 程鹏; 任政; 白佳乐; 郑杰
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2020-12-30
Filing date: 2020-12-30
Publication date: 2021-04-06

Abstract

The disclosure provides an abnormality diagnosis method and device, and belongs to the technical field of artificial intelligence. The method comprises the following steps: acquiring a first service index at a first moment in real time; acquiring the service indexes generated at N moments to obtain a reference index sequence, wherein the N moments respectively have periodic corresponding relations with the first moment, and the periodicity comprises at least one of a day period, a cycle period, a month period, a quarter period or a year period; predicting the safety range of the business index by utilizing a time series algorithm model based on the reference index sequence, wherein the time series algorithm model is an artificial intelligence model for predicting the time series change trend of the business index; and when the first service index exceeds the safety range, determining that the service is abnormal. The disclosure also provides a training method and device of the time series algorithm model, an electronic device and a computer readable storage medium.

Description

Abnormality diagnosis method and apparatus

Technical Field

The present disclosure relates to the field of artificial intelligence technology; and more particularly, to an abnormality diagnosis method and apparatus, a training method of a time series algorithm model, an electronic device, and a computer-readable storage medium.

Background

With the rapid penetration of information technology applications, business systems have been widely deployed and applied in various lines, such as finance, medical treatment, large-scale enterprises, education, and the like. The use of the service system by the user is continuously increased, and the dependence is higher and higher

Current problem diagnosis for business systems typically relies on fixed threshold alarms. Namely, when the service index exceeds a fixed threshold value, the service system is judged to be abnormal. However, on one hand, the fixed threshold value easily causes false alarm and false negative report, which leads to low diagnosis precision of the problem, and on the other hand, the fixed threshold value may cause alarm storm, so that real alarm information is covered under a large amount of false alarm information, and the efficiency of problem analysis and positioning is seriously influenced.

It can be seen that fixed threshold based anomalous transaction detection and diagnostic methods are inefficient. Therefore, how to realize flexible and high-precision abnormal transaction diagnosis is a technical problem to be solved urgently in the field.

Disclosure of Invention

In view of the above, the embodiments of the present disclosure provide an abnormality diagnosis method and apparatus by means of artificial intelligence technology, and a training method and apparatus of a time series algorithm model, an electronic device, and a computer-readable storage medium.

In a first aspect of the embodiments of the present disclosure, an abnormality diagnosis method is provided. The method comprises the following steps: acquiring a service index generated by service operation at a first moment in real time to obtain a first service index; acquiring the service indexes generated at N moments to obtain a reference index sequence, wherein the N moments respectively have a periodic corresponding relation with a first moment, the periodicity comprises at least one of a day period, a cycle period, a month period, a quarter period or a year period, and N is an integer greater than or equal to 1; based on the reference index sequence, predicting the safety range of the service index in the service operation process by using a time series algorithm model, wherein the time series algorithm model is an artificial intelligence model for predicting the time series change trend of the service index; and when the first service index exceeds the safety range, determining that the service is abnormal.

According to an embodiment of the present disclosure, the N times include the same time of the day before, the same time of the same day of the last week, and the same time of the same day of the last week from the first time.

According to an embodiment of the present disclosure, the service indicator includes at least one of: service success rate, service response time, or service transaction volume.

According to an embodiment of the present disclosure, the determining that the service is abnormal when the first service index exceeds the safety range includes: when the service index is the service success rate and the first service index is smaller than the lower limit of the safety range, determining that the service is abnormal; and/or when the service index is service response time, determining that the service is abnormal when the first service index is greater than the upper limit of the safety range; and/or when the service index is the service transaction amount and the first service index is smaller than the lower limit of the safety range, determining that the service is abnormal.

According to an embodiment of the present disclosure, the predicting, based on the reference index sequence, the safety range of the service index in the service operation process by using a time series algorithm model includes: obtaining a prediction result of the time series algorithm model, wherein the prediction result comprises a dynamic baseline representing the time series change trend of the service index; and overflowing and floating m times of the standard deviation of the service index on the basis of the dynamic baseline to obtain the safety range, wherein the standard deviation is obtained by counting the service index generated in a first time period, the first time period is a time period of pushing forward for a preset time from a first moment, and m is an integer greater than or equal to 1.

According to an embodiment of the present disclosure, training the time series algorithm model comprises: acquiring the service index generated in a first time period to obtain a first historical service index sequence; acquiring the service index generated in a second time period to obtain a second historical service index sequence; acquiring the information of whether the service is abnormal or not at the moment when each service index in the second historical service index sequence is generated to obtain a service operation information sequence; and circularly executing the following operations to train the time-series algorithm model until the detection precision of the time-series algorithm model meets the preset precision. The following operations are executed in a loop: training the time series algorithm model by using the first historical service index sequence so that the time series model outputs the dynamic baseline; testing the detection precision of the time series model by using the second historical service index sequence and the service operation information sequence; and when the detection precision of the time series algorithm model does not meet the preset precision, adjusting the parameters of the time series algorithm model.

According to the embodiment of the disclosure, the time series algorithm model is an integrated algorithm model obtained by combining an ARIMA model and a Prophet model according to weight; the adjusting the parameters of the time series algorithm model comprises: determining respective weights of the ARIMA model and the Prophet model based on a detection accuracy of the ARIMA model and a detection accuracy of the Prophet model.

According to an embodiment of the present disclosure, the training the time series algorithm model further includes: preprocessing each service index in the first historical service index sequence and the second historical service index sequence, and extracting the periodic characteristic of each service index; wherein the periodic characteristics include at least one of: a day cycle variation characteristic, a week cycle variation characteristic, or a month cycle variation characteristic; and after preprocessing, taking each service index and the corresponding periodic characteristics as input data of the time series algorithm model together.

According to an embodiment of the present disclosure, the method further includes presenting the first business indicator and the safety range.

In a second aspect of the embodiments of the present disclosure, a training method of a time series algorithm model is provided, where the time series model is used to predict a time series variation trend of a service index. The training method comprises the following steps: acquiring the service index generated in a first time period to obtain a first historical service index sequence; acquiring the service index generated in a second time period to obtain a second historical service index sequence; acquiring the service index generated in a second time period to obtain a second historical service index sequence; acquiring the information of whether the service is abnormal or not at the moment when each service index in the second historical service index sequence is generated to obtain a service operation information sequence; and circularly executing the following operations to train the time series algorithm model until the detection precision of the time series algorithm model meets the preset precision. Wherein the following operation executed in a loop comprises: training the time series algorithm model by using the first historical service index sequence; testing the detection precision of the time series model by using the second historical service index sequence and the service operation information sequence; and when the detection precision of the time series algorithm model does not meet the preset precision, adjusting the parameters of the time series algorithm model.

According to the embodiment of the disclosure, the time series algorithm model is an integrated algorithm model obtained by combining an ARIMA model and a Prophet model according to weight. The adjusting the parameters of the time series algorithm model comprises determining respective weights of the ARIMA model and the Prophet model based on the detection accuracy of the ARIMA model and the detection accuracy of the Prophet model.

In a third aspect of the disclosed embodiments, an abnormality diagnostic device is provided. The abnormity diagnosis device comprises an online data acquisition module, a historical data acquisition module, an online real-time detection module and an abnormity alarm module. The online data acquisition module is used for acquiring a service index generated by service operation at a first moment in real time to obtain a first service index. The historical data acquisition module is used for acquiring the service indexes generated at N moments to obtain a reference index sequence, wherein the N moments respectively have a periodic corresponding relation with the first moment, the periodicity comprises at least one of a day period, a week period, a month period, a quarter period or a year period, and N is an integer greater than or equal to 1. The online real-time detection module is used for predicting the safety range of the service index in the service operation process by utilizing a time series algorithm model based on the reference index sequence, wherein the time series algorithm model is an artificial intelligence model used for predicting the time sequence change trend of the service index. And the abnormity alarm module is used for determining that the business is abnormal when the first business index exceeds the safety range.

According to an embodiment of the present disclosure, the apparatus further comprises a platform display module. The platform display module is used for displaying the first service index and the safety range.

In a fourth aspect of the embodiments of the present disclosure, a training apparatus for a time series algorithm model is provided. The time series model is used for predicting the time series variation trend of the service index. The training device comprises a first acquisition module, a second acquisition module, a third acquisition module and a training module. The first obtaining module is used for obtaining the service index generated in the first time period to obtain a first historical service index sequence. The second obtaining module is used for obtaining the service index generated in a second time period to obtain a second historical service index sequence. And the third acquisition module is used for acquiring the information whether the service runs abnormally at the moment when each service index in the second historical service index sequence is generated, so as to obtain a service running information sequence. The training module is used for circularly executing the following operations to train the time series algorithm model until the detection precision of the time series algorithm model meets the preset precision, and comprises the following steps: training the time series algorithm model by using the first historical service index sequence; testing the detection precision of the time series model by using the second historical service index sequence and the service operation information sequence; and when the detection precision of the time series algorithm model does not meet the preset precision, adjusting the parameters of the time series algorithm model.

In a fifth aspect of the disclosed embodiments, an electronic device is provided. The electronic device includes one or more memories, and one or more processors. The memory stores executable instructions. The processor executes the executable instructions to implement the anomaly diagnosis method of the first aspect of the embodiments of the present disclosure or the training method of the second aspect of the embodiments of the present disclosure.

In a sixth aspect of the embodiments of the present disclosure, there is provided a computer-readable storage medium having stored thereon executable instructions, which when executed by a processor, cause the processor to perform the abnormality diagnosis method of the first aspect of the embodiments of the present disclosure or the training method of the second aspect of the embodiments of the present disclosure.

In a seventh aspect of the embodiments of the present disclosure, a computer program is provided, which includes computer executable instructions, and when executed, the instructions are used to implement the abnormality diagnosis method of the first aspect of the embodiments of the present disclosure or the training method of the second aspect of the embodiments of the present disclosure.

One or more of the above-described embodiments may provide the following advantages or benefits: and predicting the safety range of the business index in real time by using an artificial intelligence algorithm, and performing a systematic comparison between the actual business index acquired in real time and the predicted safety range of the business index, thereby realizing the transaction abnormity diagnosis based on the dynamic baseline.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the following description of embodiments of the present disclosure with reference to the accompanying drawings, in which:

fig. 1 schematically illustrates an application scenario of an abnormality diagnosis method and apparatus according to an embodiment of the present disclosure;

fig. 2 schematically shows a block diagram of an abnormality diagnostic apparatus according to an embodiment of the present disclosure;

FIG. 3 schematically illustrates a flow chart of an anomaly diagnosis method according to an embodiment of the present disclosure;

FIG. 4 is a schematic diagram illustrating a safety range of a business indicator obtained by using a time series algorithm model according to an embodiment of the disclosure; (ii) a

FIG. 5 schematically illustrates a block diagram of a training apparatus for a time series algorithm model according to an embodiment of the present disclosure;

FIG. 6 schematically illustrates a flow chart of a method of training a time series algorithm model according to an embodiment of the present disclosure;

FIG. 7 schematically illustrates a system architecture for anomaly diagnosis according to another embodiment of the present disclosure;

FIG. 8 schematically illustrates a flow diagram of anomaly diagnosis according to another embodiment of the present disclosure; and

FIG. 9 schematically illustrates a block diagram of a computer system suitable for implementing a method according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.). Where a convention analogous to "A, B or at least one of C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B or C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

The embodiment of the disclosure provides an abnormality diagnosis method and device. In the method, a first service index at a first moment is acquired in real time. And then acquiring service indexes generated at N moments to obtain a reference index sequence, wherein the N moments respectively have periodic corresponding relations with the first moment, and the periodicity comprises at least one of a day period, a cycle period, a month period, a quarter period or a year period. And then, based on the reference index sequence, predicting the safety range of the business index by using a time series algorithm model, wherein the time series algorithm model is an artificial intelligence model for predicting the time series change trend of the business index. And then determining that the service is abnormal when the first service index exceeds the safety range.

According to the embodiment of the disclosure, the safety range of the business index is predicted in real time by using an artificial intelligence algorithm, and the actual business index is compared with the predicted safety range of the business index in a systematic way, so that the transaction abnormity diagnosis based on the dynamic baseline is realized.

Compared with a fixed threshold diagnosis mode, the method disclosed by the embodiment of the disclosure can predict the safety range of the service index when the service normally operates at the first moment based on the service index data of N moments having a periodic corresponding relation with the first moment by means of the artificial intelligence model, can associate the abnormal diagnosis of the service with the time sequence change characteristic of the service, is more flexible and intelligent than the judgment based on the fixed threshold, is more suitable for the characteristic that the service dynamically changes along with the environment or situation in practice, and has higher diagnosis precision.

It should be noted that the abnormality diagnosis method and apparatus determined by the embodiment of the present disclosure may be used in the financial field, and may also be used in any field other than the financial field (for example, medical treatment, education, military industry, logistics, etc.), and the present disclosure does not limit the application field.

Fig. 1 schematically illustrates an application scenario 100 of the anomaly diagnosis method and apparatus according to an embodiment of the present disclosure.

As shown in fig. 1, the application scenario 100 may include a business system 101, an abnormality diagnosis apparatus 102, and a training apparatus 103 of a time series algorithm model.

The abnormality diagnosis device 102 may collect the service index from the service system 101, execute the abnormality diagnosis method according to the embodiment of the present disclosure, and perform real-time diagnosis on the operation state of the service system 101. When determining that the service operation in the service system 101 is abnormal, reporting the abnormality to the service system 101.

According to an embodiment of the present disclosure, the service index that the abnormality diagnosing apparatus 102 may collect from the service system 101 may be, for example, a service success rate, a service response time, or a service transaction amount.

In one implementation, business system 101 may be a network transaction system. For example, the transaction system may count the service success rate, service response time, and/or service transaction amount once per minute. The abnormality diagnosing apparatus 102 may obtain the service index in the network transaction system in real time, and compare the service index with the safety range of the service index predicted by the time series algorithm model and supposed to be located at the current time to determine whether there is an abnormality in the network transaction system.

According to the implementation of the disclosure, when the safety range where the service index should be located at the current time is obtained by the time series algorithm model, the time sequence change characteristic of the service index is predicted based on the service index obtained in real time and the periodic characteristic data of the service index. For example, when the service index is obtained, the historical service index corresponding to the day cycle, week cycle, and/or month cycle of the service index is correspondingly obtained. So that the day cycle, week cycle, and/or month cycle variation characteristics of the service index can be obtained based on the historical service indexes. The day cycle variation characteristic can be characterized by the relative difference or variation value of the service index at the same time every day. Similarly, the weekly cycle variation feature and the monthly cycle variation feature are also contemplated.

According to the embodiment of the disclosure, the dynamic baseline of the service index is output by using the time series algorithm model, and is used for representing the trend of the service index in the prediction time period. The dynamic baseline upper limit and dynamic baseline lower limit may be derived by overflowing and floating the traffic indicator on the basis of the dynamic baseline by m times the standard deviation of the traffic indicator over the prediction time (e.g., m — 3). Therefore, the range between the dynamic baseline upper limit and the dynamic baseline lower limit is used as the current safety range of the business index.

The training means 103 may be used to train a time series algorithm model. The training device 103 may train a time series algorithm model to learn the time sequence variation trend of the service index by using the historical service index data collected from the service system 101 over a period of time.

According to one embodiment of the present disclosure, the time series algorithm model is an integrated algorithm model obtained by combining an ARIMA model and a Prophet model according to weights.

The Prophet model can output future time series trends by inputting known time series timestamps and corresponding values and inputting the length of the time series that needs to be predicted. And the output results can provide necessary statistical indicators including fitted curves, upper and lower bounds, and the like.

The ARIMA model (differential Integrated Moving Average Autoregressive model) can predict a variable itself by describing a relationship between a current value and a historical value and using historical time data of the variable itself.

In the time series algorithm model, the weights of the ARIMA model and the Prophet model can be determined according to the detection accuracy of the ARIMA model and the detection accuracy of the Prophet model. For example, in one embodiment, the detection accuracy of the two algorithms can be detected based on the monthly service index data as the training data and the weekly service index data as the test data, and the detection accuracy can be used as the weight of the two algorithms, and the respective weights of the algorithms can be combined to form the integrated algorithm, so that the diagnosis accuracy and the stability of the model can be improved.

When the time series algorithm model is trained, the historical service index data collected from the service system 101 may be preprocessed, the cycle characteristic of each service index is extracted, and then the historical service index data and the cycle characteristic of each service index are used as the input of the time series algorithm model together to train the time series algorithm model to learn the time series variation trend of each service index. The period characteristic may be, for example, a day period variation characteristic, a week period variation characteristic, a month period variation characteristic, or the like.

It is to be understood that the training device 103 provided in the abnormality diagnostic device 102 in fig. 1 is merely an exemplary embodiment. In other embodiments, the training device 103 may be provided independently of the abnormality diagnostic device 102.

According to an embodiment of the present disclosure, the abnormality diagnostic apparatus 102 may be implemented as the following abnormality diagnostic apparatus 200, or the computer system 900, or the computer-readable storage medium, or the computer program, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the training apparatus 103 may be implemented as the following abnormality diagnosis apparatus 500, or the computer system 900, or the computer readable storage medium, or the computer program, and the present disclosure is not limited thereto.

It should be noted that fig. 1 is only an example of a system architecture to which the embodiments of the present disclosure may be applied to help those skilled in the art understand the technical content of the present disclosure, and does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments or scenarios.

Fig. 2 schematically shows a block diagram of an abnormality diagnostic device 200 according to an embodiment of the present disclosure. The abnormality diagnostic device 200 is a specific embodiment of the abnormality diagnostic device 102.

As shown in fig. 2, the abnormality diagnostic apparatus 200 according to an embodiment of the present disclosure may include an online data acquisition module 210, a historical data acquisition module 220, an online real-time detection module 230, and an abnormality alarm module 240. According to another embodiment of the present disclosure, the abnormality diagnostic apparatus 200 may further include a platform display module 250.

The online data obtaining module 210 is configured to obtain a service index generated by service operation at a first time in real time, so as to obtain a first service index. The frequency of acquiring the service index in real time may be the same as or different from the frequency of generating the service index by the service system 101; may or may not be synchronized. The generic traffic indicator may be time stamped when generated. The first service index in the disclosure refers to a service index of which the timestamp is the first time, which is obtained in real time.

The historical data obtaining module 220 is configured to obtain service indicators generated at N moments to obtain a reference indicator sequence, where the N moments respectively have a periodic correspondence with a first moment, where the periodicity includes at least one of a day period, a cycle period, a month period, a quarter period, or a year period, where N is an integer greater than or equal to 1.

The online real-time detection module 230 is configured to predict a safety range of a service index in a service operation process by using a time series algorithm model based on a reference index sequence, where the time series algorithm model is an artificial intelligence model for predicting a time sequence variation trend of the service index. The periodic variation characteristics of the service index, such as a day period variation characteristic, a week period variation characteristic, a month period variation characteristic, a quarter period variation characteristic, or a year period variation characteristic, can be obtained by referring to the index sequence. The time series algorithm model can predict the periodic variation trend of the service index through learning the periodic characteristics of the service index corresponding to the reference index sequence.

The anomaly alarm module 240 is configured to determine that there is an anomaly in the service when the first service index exceeds the safety range.

The platform display module 250 is used for displaying the first service index and the safety range.

The abnormality diagnosis apparatus 200 may be used to implement the abnormality diagnosis method according to the embodiment of the present disclosure, and specifically, refer to the following description related to fig. 3 to 4.

Fig. 3 schematically shows a flow chart of an abnormality diagnosis method according to an embodiment of the present disclosure.

As shown in fig. 3, the abnormality diagnosis method according to the embodiment of the present disclosure may include operations S310 to S360.

In operation S310, a service index generated by service operation at a first time is obtained in real time, so as to obtain a first service index.

In operation S320, the service indicators generated at N moments are obtained to obtain a reference indicator sequence, where the N moments respectively have a periodic correspondence with the first moment, where the periodicity includes at least one of a day period, a cycle period, a month period, a quarter period, or a year period, where N is an integer greater than or equal to 1.

In operation S330, a safety range of the service index in the service operation process is predicted using a time series algorithm model based on the reference index sequence, wherein the time series algorithm model is an artificial intelligence model for predicting a time series variation trend of the service index.

According to an embodiment of the present disclosure, the N times include: the same time of the day before, the same time of the same day of the last week, and the same time of the same day of the last week from the first time. Therefore, the day cycle change characteristic, the cycle change characteristic of the last week and the cycle change characteristic of the last two weeks of the service index from the first moment can be obtained.

Furthermore, the time series algorithm model can predict the safety range of the service index in the service operation process based on three-dimensional data of the previous day, the previous week and the previous week from the first time.

In operation S340, it is determined whether the first service index is beyond a safety range. If so, operation S350 determines that the service is abnormal. If not, in operation S360, it is determined that the service is operating normally.

Fig. 4 schematically illustrates a schematic diagram of obtaining a safety range of a service indicator by using a time-series algorithm model in operation S330 according to an embodiment of the present disclosure.

As shown in fig. 4, operation S330 may include operation S431 and operation S432 according to an embodiment of the present disclosure.

In operation S431, a prediction result of the time-series algorithm model is obtained, where the prediction result includes a dynamic baseline that characterizes a time-series variation trend of the service indicator.

In operation S432, a safety range is obtained by m times of a standard deviation of the overflow and float service indicators on the basis of the dynamic baseline, where the standard deviation may be obtained by counting the service indicators generated in a first time period, the first time period is a time period from a first time point to a preset time period, and m is an integer greater than or equal to 1. In one embodiment, the first time period may be a time period corresponding to a historical traffic indicator for training the time series algorithm model, or the first time period may also be a time period for predicting a time-series variation trend of the characteristic traffic indicator.

And when the first service index is within the upper and lower limits of the safety range, determining that the service is safe to operate.

And when the service index is the service success rate, determining that the service is abnormal when the first service index is smaller than the lower limit of the safety range.

Or when the service index is service response time and the first service index is greater than the upper limit of the safety range, determining that the service is abnormal.

Or when the service index is the service transaction amount and the first service index is smaller than the lower limit of the safety range, determining that the service is abnormal.

Fig. 5 schematically illustrates a block diagram of a training apparatus 500 of a time series algorithm model according to an embodiment of the present disclosure. The time series model is used for predicting the time series variation trend of the service index. The exercise device 500 is one embodiment of the exercise device 103 shown in FIG. 1.

As shown in fig. 5, the training apparatus 500 of the time series algorithm model according to the embodiment of the present disclosure may include a first obtaining module 510, a second obtaining module 520, a third obtaining module 530, and a training module 540.

The first obtaining module 510 is configured to obtain a service indicator generated within a first time period (for example, one month away from the current time), and obtain a first historical service indicator sequence.

The second obtaining module 520 is configured to obtain the service indicators generated in a second time period (e.g., one week away from the current time), so as to obtain a second historical service indicator sequence.

The third obtaining module 530 is configured to obtain information about whether a service is abnormal or not at a moment when each service indicator in the second historical service indicator sequence is generated, so as to obtain a service operation information sequence.

The training module 540 is configured to cyclically execute the following operations to train the time-series algorithm model until the detection precision of the time-series algorithm model meets the preset precision. Specifically, a time sequence algorithm model is trained by utilizing a first historical service index sequence; testing the detection precision of the time sequence model by using a second historical service index sequence and a service operation information sequence; and when the detection precision of the time series algorithm model does not meet the preset precision, adjusting the parameters of the time series algorithm model.

The training apparatus 500 may be used to implement the training method of the time series algorithm model according to the embodiment of the present disclosure, and specifically, refer to the following description of fig. 6.

FIG. 6 schematically shows a flow chart of a method of training a time series algorithm model according to an embodiment of the present disclosure.

As shown in fig. 6, the training method of the time-series algorithm model may include operations S610 to S680.

In operation S610, a service indicator generated in a first time period (e.g., one month from the current time) is obtained, and a first historical service indicator sequence is obtained.

In operation S620, the service indicators generated in the second time period (for example, one week from the current time) are obtained, and a second historical service indicator sequence is obtained.

In operation S630, information about whether the service operation is abnormal at the time when each service indicator in the second historical service indicator sequence is generated is obtained, so as to obtain a service operation information sequence.

In operation S640, a time series algorithm model is trained using the first historical traffic indicator sequence.

In operation S650, the detection accuracy of the time series model is tested using the second historical service index sequence and the service operation information sequence.

Specifically, when the time series algorithm model is tested, the safety range of the second service index at each time in the second time period can be predicted based on the trained time series algorithm model, and the safety range is compared with the two historical service index sequences to obtain information about whether the service system 101 is abnormal or not at each time in the second time period through the prediction of the model. And comparing the predicted information whether the time is abnormal or not at each moment in the second time period with the actual service operation information sequence, so as to calculate the detection precision of the time sequence algorithm model.

According to an embodiment of the present disclosure, in the process of training and testing the time series algorithm model, each service index in the first historical service index sequence and the second historical service index sequence may be preprocessed first, and the cycle characteristic of each service index is extracted. Wherein the periodic characteristics include at least one of: a day cycle variation characteristic, a week cycle variation characteristic, or a month cycle variation characteristic. And then, after preprocessing, taking each service index and the corresponding periodic characteristics as input data of the time series algorithm model together to train the time series algorithm model.

In operation S660, it is determined whether the detection accuracy satisfies a preset accuracy.

If so, the time-series algorithm model is output in operation S680.

If not, in operation S670, the parameters of the time-series algorithm model are adjusted, and the operation S640 is returned to train the time-series algorithm model again.

According to an embodiment of the disclosure, the time series algorithm model is an integrated algorithm model obtained by combining an ARIMA model and a Prophet model according to weights. Adjusting the parameters of the time series algorithm model in operation S670 may be, for example, determining the respective weights of the ARIMA model and the Prophet model based on the detection accuracy of the ARIMA model and the detection accuracy of the Prophet model.

An exemplary application of the present disclosure is further illustrated in fig. 7 and 8 below. It is to be understood that the examples of fig. 7 and 8 are illustrative only and not limiting.

Fig. 7 schematically illustrates a system architecture 700 for anomaly diagnosis according to another embodiment of the present disclosure.

As shown in fig. 7, the system architecture 700 may include a data collection interface 701, a historical data acquisition module 220, an online data acquisition module 210, an offline modeling analysis module 702, an online real-time detection module 230, a model interface 703 for interfacing big data with an artificial intelligence platform, a prediction result storage module 704, a platform presentation module 250, and an anomaly alarm module 240. Wherein the modules with the same names and labels as above represent the same objects, which are only briefly described here.

The data acquisition interface 701 and the online data acquisition module 210 are developed by using a SpringBoot project, are manufactured into mirror images, are deployed in a K8s cluster to run in real time, acquire statistical data (service success rate, service transaction amount and/or service response time) from Kafka every 10 seconds, acquire data of a current month from an ElasticSearch in which the historical data acquisition module 220 is located, replace newly acquired data into data of a month to form metadata of a latest month, transmit data of three days of yesterday, last week and last week to the online real-time detection module 230, complete non-threshold monitoring and alarm by calling the online real-time detection module 230, and store returned detection results of whether the data is abnormal and the metadata of the latest month into the ElasticSearch in which the prediction result storage module 704 is located. If the detection result is abnormal, an alarm is sent to the service system through the abnormal alarm module 240.

The offline modeling analysis module 702 is mainly based on a machine learning algorithm, and trains a time series algorithm model by using one month inventory data to construct a dynamic safety range of a business index.

Training data (data of three indexes, namely, yesterday, last week and last week three days, service success rate, service transaction amount and response time) required by a time series algorithm model and a service index (namely, a first service index) acquired in real time are acquired from an elastic search where the historical data acquisition module 220 is located, the acquired data are transmitted to the time series algorithm model for prediction after being preprocessed and subjected to characteristic processing, and a dynamic safety range of the service index is returned.

The prediction result storage module 704 realizes storage of the non-threshold monitoring metadata and the detection result, including the metadata and the detection result of the service success rate, the service transaction amount and the service response time, establishes an index according to the application and the time, and retains the metadata for one month and the detection result for one week.

The platform display module 250 is mainly used for displaying the upper limit, the lower limit and the metadata of the dynamic baseline by the background code in the time period of obtaining the metadata and the detection value of the application selection from the elastic search in real time in the form of a line graph in the time period of selecting the good viewing when the application is displayed at the front end.

FIG. 8 schematically shows a flow chart of anomaly diagnosis according to another embodiment of the present disclosure.

As shown in fig. 8, the abnormality diagnosis includes steps S801 to S805.

Step S801: and analyzing the historical transaction log, and selecting fields with characterization meanings as characteristic values. For example, the service success rate, the service response time, and the service transaction amount are selected as the characteristic values.

Step S802: and respectively extracting the characteristics of the service success rate, the service response time, the day period, the week period and the month period of the service transaction amount.

Step S803: based on one month data as training data and one week data as test data, the transaction state is predicted by using time series algorithms ARIMA and Prophet, and 3 times of standard deviation of overflow and underflow service indexes are used as a dynamic baseline upper limit and a dynamic baseline lower limit on the basis of a prediction result.

Step S804: the actual value is within the dynamic baseline lower limit and the dynamic baseline upper limit as a normal state. The service success rate is an abnormal state under the dynamic baseline lower limit. Traffic response time above the dynamic baseline upper limit is an abnormal condition. Traffic volume below the dynamic baseline lower limit is an abnormal condition.

Step S805: the detection precision of the two algorithms is respectively detected by using the test data of one week, the detection precision is used as the weight of the two algorithms, and the respective weights of the algorithms are combined into an integrated algorithm, so that the diagnosis precision is improved.

Any number of modules, sub-modules, units, sub-units, or at least part of the functionality of any number thereof according to embodiments of the present disclosure may be implemented in one module. Any one or more of the modules, sub-modules, units, and sub-units according to the embodiments of the present disclosure may be implemented by being split into a plurality of modules. Any one or more of the modules, sub-modules, units, sub-units according to embodiments of the present disclosure may be implemented at least in part as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in any other reasonable manner of hardware or firmware by integrating or packaging a circuit, or in any one of or a suitable combination of software, hardware, and firmware implementations. Alternatively, one or more of the modules, sub-modules, units, sub-units according to embodiments of the disclosure may be at least partially implemented as a computer program module, which when executed may perform the corresponding functions.

For example, any plurality of the online data acquisition module 210, the historical data acquisition module 220, the online real-time detection module 230, the anomaly alarm module 240, the platform presentation module 250, the first acquisition module 510, the second acquisition module 520, the third acquisition module 530, the training module 540, the data acquisition interface 701, and the prediction result storage module 702 may be combined and implemented in one module, or any one of them may be split into a plurality of modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of the other modules and implemented in one module. According to the embodiment of the present disclosure, at least one of the online data obtaining module 210, the historical data obtaining module 220, the online real-time detecting module 230, the anomaly alarm module 240, the platform displaying module 250, the first obtaining module 510, the second obtaining module 520, the third obtaining module 530, the training module 540, the data collecting interface 701, and the prediction result storing module 702 may be at least partially implemented as a hardware circuit, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented by hardware or firmware in any other reasonable manner of integrating or packaging a circuit, or implemented by any one of three implementation manners of software, hardware, and firmware, or a suitable combination of any of them. Alternatively, at least one of the online data acquisition module 210, the historical data acquisition module 220, the online real-time detection module 230, the abnormality alarm module 240, the platform presentation module 250, the first acquisition module 510, the second acquisition module 520, the third acquisition module 530, the training module 540, the data collection interface 701, and the prediction result storage module 702 may be at least partially implemented as a computer program module, which, when executed, may perform a corresponding function.

FIG. 9 schematically illustrates a block diagram of a computer system 900 suitable for implementing a method according to an embodiment of the present disclosure. The computer system 900 shown in fig. 9 is only an example and should not bring any limitations to the functionality or scope of use of the embodiments of the present disclosure.

As shown in fig. 9, a computer system 900 according to an embodiment of the present disclosure includes a processor 901 which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)902 or a program loaded from a storage section 908 into a Random Access Memory (RAM) 903. Processor 901 may comprise, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 901 may also include on-board memory for caching purposes. The processor 901 may comprise a single processing unit or a plurality of processing units for performing the different actions of the method flows according to embodiments of the present disclosure.

In the RAM 903, various programs and data necessary for the operation of the system 900 are stored. The processor 901, the ROM 902, and the RAM 903 are connected to each other through a bus 904. The processor 901 performs various operations of the method flows according to the embodiments of the present disclosure by executing programs in the ROM 902 and/or the RAM 903. Note that the programs may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also perform various operations of the method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

System 900 may also include an input/output (I/O) interface 905, input/output (I/O) interface 905 also connected to bus 904, according to an embodiment of the present disclosure. The system 900 may also include one or more of the following components connected to the I/O interface 905: an input portion 906 including a keyboard, a mouse, and the like; an output section 907 including components such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage portion 908 including a hard disk and the like; and a communication section 909 including a network interface card such as a LAN card, a modem, or the like. The communication section 909 performs communication processing via a network such as the internet. The drive 910 is also connected to the I/O interface 905 as necessary. A removable medium 911 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 910 as necessary, so that a computer program read out therefrom is mounted into the storage section 908 as necessary.

According to embodiments of the present disclosure, method flows according to embodiments of the present disclosure may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable storage medium, the computer program containing program code for performing the method illustrated by the flow chart. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 909, and/or installed from the removable medium 911. The computer program, when executed by the processor 901, performs the above-described functions defined in the system of the embodiment of the present disclosure. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM 902 and/or the RAM 903 described above and/or one or more memories other than the ROM 902 and the RAM 903.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the method provided by the embodiments of the present disclosure, when the computer program product is run on an electronic device, the program code being adapted to cause the electronic device to carry out the image recognition method provided by the embodiments of the present disclosure.

The computer program, when executed by the processor 901, performs the above-described functions defined in the system/apparatus of the embodiments of the present disclosure. The systems, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

In one embodiment, the computer program may be hosted on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted, distributed in the form of a signal on a network medium, and downloaded and installed through the communication section 909 and/or installed from the removable medium 911. The computer program containing program code may be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

In accordance with embodiments of the present disclosure, program code for executing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, these computer programs may be implemented using high level procedural and/or object oriented programming languages, and/or assembly/machine languages. The programming language includes, but is not limited to, programming languages such as Java, C + +, python, the "C" language, or the like. The program code may execute entirely on the user computing device, partly on the user device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. In particular, various combinations and/or combinations of the features recited in the various embodiments and/or claims of the present disclosure may be made without departing from the spirit or teaching of the present disclosure. All such combinations and/or associations are within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. An abnormality diagnostic method comprising:

acquiring a service index generated by service operation at a first moment in real time to obtain a first service index;

acquiring the service indexes generated at N moments to obtain a reference index sequence, wherein the N moments respectively have a periodic corresponding relation with a first moment, the periodicity comprises at least one of a day period, a cycle period, a month period, a quarter period or a year period, and N is an integer greater than or equal to 1;

based on the reference index sequence, predicting the safety range of the service index in the service operation process by using a time series algorithm model, wherein the time series algorithm model is an artificial intelligence model for predicting the time series change trend of the service index; and

and when the first service index exceeds the safety range, determining that the service is abnormal.

2. The method of claim 1, wherein the N time instants comprise:

the same time of the day before, the same time of the same day of the last week, and the same time of the same day of the last week from the first time.

3. The method of claim 1, wherein the traffic indicator comprises at least one of: service success rate, service response time, or service transaction volume.

4. The method of claim 3, wherein the determining that the traffic is anomalous when the first traffic indicator is outside the safe range comprises:

when the service index is the service success rate and the first service index is smaller than the lower limit of the safety range, determining that the service is abnormal; and/or

When the service index is service response time, determining that the service is abnormal when the first service index is larger than the upper limit of the safety range; and/or

And when the service index is the service transaction amount and the first service index is smaller than the lower limit of the safety range, determining that the service is abnormal.

5. The method of claim 1, wherein the predicting the safety range of the business index in the business operation process by using a time series algorithm model based on the reference index sequence comprises:

obtaining a prediction result of the time series algorithm model, wherein the prediction result comprises a dynamic baseline representing the time series change trend of the service index;

and overflowing and floating m times of the standard deviation of the service index on the basis of the dynamic baseline to obtain the safety range, wherein the standard deviation is obtained by counting the service index generated in a first time period, the first time period is a time period of pushing forward for a preset time from a first moment, and m is an integer greater than or equal to 1.

6. The method of claim 5, wherein training the time series algorithm model comprises:

acquiring the service index generated in a first time period to obtain a first historical service index sequence;

acquiring the service index generated in a second time period to obtain a second historical service index sequence;

acquiring the information of whether the service is abnormal or not at the moment when each service index in the second historical service index sequence is generated to obtain a service operation information sequence;

circularly executing the following operations to train the time series algorithm model until the detection precision of the time series algorithm model meets the preset precision, wherein the operations comprise:

training the time series algorithm model by using the first historical service index sequence;

testing the detection precision of the time series model by using the second historical service index sequence and the service operation information sequence;

and when the detection precision of the time series algorithm model does not meet the preset precision, adjusting the parameters of the time series algorithm model.

7. The method according to claim 6, wherein the time series algorithm model is an integrated algorithm model obtained by combining an ARIMA model and a Prophet model according to weights; the adjusting the parameters of the time series algorithm model comprises:

determining respective weights of the ARIMA model and the Prophet model based on a detection accuracy of the ARIMA model and a detection accuracy of the Prophet model.

8. The method of claim 7, wherein the training the time series algorithm model further comprises:

preprocessing each service index in the first historical service index sequence and the second historical service index sequence, and extracting the periodic characteristic of each service index; wherein the periodic characteristics include at least one of: a day cycle variation characteristic, a week cycle variation characteristic, or a month cycle variation characteristic; and

and after preprocessing, taking each service index and the corresponding periodic characteristics as input data of the time series algorithm model together.

9. The method of claim 1, wherein the method further comprises:

and displaying the first service index and the safety range.

10. A training method of a time series algorithm model, wherein the time series model is used for predicting the time series variation trend of a business index, and the training method comprises the following steps:

11. The training method according to claim 10, wherein the time series algorithm model is an integrated algorithm model obtained by combining an ARIMA model and a Prophet model according to weights; the adjusting the parameters of the time series algorithm model comprises:

12. The training method of claim 11, wherein said training said time series algorithm model further comprises:

13. An abnormality diagnostic device comprising:

the online data acquisition module is used for acquiring a service index generated by service operation at a first moment in real time to obtain a first service index;

a historical data obtaining module, configured to obtain the service indicators generated at N times to obtain a reference indicator sequence, where the N times respectively have a periodic correspondence with a first time, where the periodicity includes at least one of a day period, a week period, a month period, a quarter period, or a year period, where N is an integer greater than or equal to 1;

the online real-time detection module is used for predicting the safety range of the service index in the service operation process by utilizing a time series algorithm model based on the reference index sequence, wherein the time series algorithm model is an artificial intelligence model used for predicting the time sequence variation trend of the service index; and

and the abnormity alarm module is used for determining that the business is abnormal when the first business index exceeds the safety range.

14. A training device of a time series algorithm model, the time series model is used for predicting the time series variation trend of a business index, wherein the training device comprises:

the first acquisition module is used for acquiring the service indexes generated in a first time period to obtain a first historical service index sequence;

the second acquisition module is used for acquiring the service indexes generated in a second time period to obtain a second historical service index sequence;

a third obtaining module, configured to obtain information about whether the service operation is abnormal at a time when each service index in the second historical service index sequence is generated, so as to obtain a service operation information sequence;

the training module is used for circularly executing the following operations to train the time series algorithm model until the detection precision of the time series algorithm model meets the preset precision, and comprises the following steps:

15. An electronic device, comprising:

one or more memories storing executable instructions; and

one or more processors executing the executable instructions to implement:

the method for diagnosing an abnormality according to any one of claims 1 to 9, or

The training method according to any one of claims 10 to 12.

16. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform:

The training method according to any one of claims 10 to 12.