CN113360359A

CN113360359A - Index abnormal data tracing method, device, equipment and storage medium

Info

Publication number: CN113360359A
Application number: CN202110734770.9A
Authority: CN
Inventors: 韩金涛; 李伟泽; 周济; 陈都; 王喜民; 焦利鹏
Original assignee: China Telecom Corp Ltd
Current assignee: Tianyi Cloud Technology Co Ltd
Priority date: 2021-06-30
Filing date: 2021-06-30
Publication date: 2021-09-07
Anticipated expiration: 2041-06-30
Also published as: WO2023273224A1; CN113360359B

Abstract

The disclosure provides an index abnormal data tracing method, device, equipment and storage medium, and relates to the technical field of data processing. The method comprises the following steps: acquiring an incidence relation between every two indexes in a plurality of indexes, wherein the plurality of indexes comprise target indexes with abnormal index data; acquiring an abnormal occurrence time sequence relation between two abnormal indexes in the multiple indexes, wherein the abnormal occurrence time sequence relation is obtained according to the probability of the abnormal index data in the index acquisition period; acquiring to-be-traced abnormal data of a target item index and abnormal indication time of the to-be-traced abnormal data; obtaining source tracing termination time according to the abnormal indication time of the abnormal data to be traced; and tracing the source of the abnormal data to be traced from the multiple indexes before the source tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation to obtain abnormal root data. The method improves the accuracy of tracing the source of the abnormal index data.

Description

Index abnormal data tracing method, device, equipment and storage medium

Technical Field

The disclosure relates to the technical field of data processing, in particular to an index abnormal data tracing method, device, equipment and readable storage medium.

Background

With the development of network information technology, the scale of network hardware and software is continuously enlarged, comprehensive monitoring information needs to be acquired to ensure the working stability of the system, and when monitoring indexes are abnormal, an alarm is given to perform timely operation and maintenance processing according to the alarm information. Correspondingly, however, a plurality of alarm messages can bring about the problem of alarm storm, and great interference is brought to manual identification and processing. Because alarm association and causal relationship often exist among alarms, root causes in alarm information are found out and displayed in time, and the method is particularly important for improving the effectiveness of the alarms and shortening the processing period of the alarms.

In the related technology, the sequence of the alarm time is taken as the sequence of the occurrence of the fault, but in the actual situation, the sampling intervals of different monitoring indexes are different, and the delay factor is synthesized again, so that the alarm sequence is possibly opposite to the sequence of the occurrence of the fault, and the accuracy of the alarm tracing method is low.

As described above, how to improve the accuracy of alarm tracing becomes an urgent problem to be solved.

The above information disclosed in this background section is only for enhancement of understanding of the background of the disclosure and therefore it may contain information that does not constitute prior art that is already known to a person of ordinary skill in the art.

Disclosure of Invention

The invention aims to provide an index abnormal data tracing method, device, equipment and readable storage medium, which at least solve the problem of lower accuracy of tracing in the prior art by taking the sequence of alarm time as the sequence of fault occurrence.

Additional features and advantages of the disclosure will be set forth in the detailed description which follows, or in part will be obvious from the description, or may be learned by practice of the disclosure.

According to an aspect of the present disclosure, there is provided an index abnormal data tracing method, including: acquiring an incidence relation between every two indexes in a plurality of indexes, wherein the plurality of indexes comprise target indexes with abnormal index data; acquiring an abnormal occurrence time sequence relation between two abnormal indexes in the multiple indexes, wherein the abnormal occurrence time sequence relation is obtained according to the probability of the abnormal index data in an index acquisition period; acquiring to-be-traced abnormal data of the target item index and abnormal indication time of the target item index; obtaining source tracing termination time according to the abnormal indication time of the abnormal data to be traced; tracing the source of the abnormal data to be traced from the multiple indexes before the source tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation, and obtaining abnormal root data.

According to an embodiment of the disclosure, a functional relationship between a probability of index data abnormality occurrence and time in an index acquisition period before a time point of the index data abnormality occurrence obeys uniform distribution.

According to an embodiment of the present disclosure, the obtaining of an abnormal occurrence time sequence relationship between two abnormal indicators of the plurality of indicators includes: acquiring sequence data of the multiple indexes in respective index acquisition periods, wherein the sequence data comprises abnormal data; acquiring an integral interval according to the index acquisition period of each of the two abnormal indexes and the abnormal indication time of the abnormal data of the two abnormal indexes; integrating the probability of the abnormal index data in the index acquisition period of the two abnormal indexes in the integration interval to obtain a time sequence coefficient between the two abnormal indexes so as to obtain an abnormal occurrence time sequence relation between the two abnormal indexes.

According to an embodiment of the present disclosure, the obtaining of the association relationship between every two indexes of the plurality of indexes includes: acquiring sequence data of the multiple indexes in respective index acquisition periods; acquiring a uniform acquisition period according to the respective index acquisition periods of the multiple indexes; dividing the sequence data of the multiple indexes according to the uniform acquisition cycle to obtain normalized cycle sequence data of the multiple indexes; and obtaining a correlation coefficient between every two indexes in the multiple indexes by adopting at least one preset correlation analysis method for the normalized periodic sequence data between every two indexes in the multiple indexes to obtain the correlation relationship, wherein the preset correlation analysis method comprises a method for performing correlation analysis by using information gain and information gain rate and a chi-square test method.

According to an embodiment of the present disclosure, the dividing the sequence data of the multiple indexes according to the uniform acquisition cycle to obtain the normalized cycle sequence data of the multiple indexes includes: and respectively performing AND operation on sequence data in the unified acquisition period for each index in the plurality of indexes, setting the data in the unified acquisition period to be 1 under the condition that abnormal data exist in the unified acquisition period, setting the data in the unified acquisition period to be 0 under the condition that abnormal data do not exist in the unified acquisition period, and obtaining standardized period sequence data in a monitoring data segment, wherein the length of the monitoring data segment is the number of the unified acquisition period in the monitoring data segment.

According to an embodiment of the present disclosure, the method further comprises: obtaining a plurality of associated indexes of the target item index according to the association relation; the obtaining of the tracing termination time according to the abnormal indication time of the abnormal data to be traced comprises: acquiring a plurality of index acquisition periods corresponding to the plurality of associated indexes; and delaying the abnormal indication time of the abnormal data to be traced by the maximum index acquisition period in the plurality of index acquisition periods to obtain the tracing termination time.

According to an embodiment of the present disclosure, the tracing the to-be-traced abnormal data from the multiple indexes within the tracing time period according to the association relationship and the abnormality occurrence timing relationship, and obtaining abnormal root data includes: obtaining root candidate item indexes from the multiple indexes according to the incidence relation, wherein the root candidate item indexes comprise candidate abnormal root data with abnormal indication time before the source tracing termination time; and judging whether the candidate abnormal root data is the abnormal root data of the abnormal data to be traced according to the abnormal occurrence time sequence relation.

According to still another aspect of the present disclosure, an index abnormal data tracing apparatus is provided, including: the incidence relation acquisition module is used for acquiring the incidence relation between every two indexes in a plurality of indexes, wherein the plurality of indexes comprise target item indexes with abnormal index data; the sequence relation acquisition module is used for acquiring an abnormal occurrence time sequence relation between two abnormal indexes in the multiple indexes, and the abnormal occurrence time sequence relation is obtained according to the probability of the abnormal index data in an index acquisition period; the abnormal data acquisition module is used for acquiring the abnormal data to be traced of the target item index and the abnormal indication time of the abnormal data; a source tracing termination time obtaining module, configured to obtain a source tracing termination time according to the abnormal indication time of the abnormal data to be traced; and the root alarm output module is used for tracing the source of the abnormal data to be traced from the multiple indexes before the source tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation to obtain abnormal root data.

According to an embodiment of the present disclosure, the apparatus further comprises: the monitoring data acquisition module is used for acquiring sequence data of the multiple indexes in respective index acquisition periods, and the sequence data comprises abnormal data; the order relation obtaining module comprises: an integral interval obtaining module, configured to obtain an integral interval according to the index acquisition period of each of the two abnormal indexes and the abnormal indication time of the abnormal data of the two abnormal indexes; and the alarm sequence analysis module is used for integrating the probability of the abnormal index data in the index acquisition period of the two abnormal indexes in the integral interval to obtain a time sequence coefficient between the two abnormal indexes so as to obtain an abnormal occurrence time sequence relation between the two abnormal indexes.

According to an embodiment of the present disclosure, the association obtaining module includes: the parameter setting module is used for obtaining a uniform acquisition cycle according to the respective index acquisition cycles of the multiple indexes; the data windowing module is used for dividing the sequence data of the multiple indexes according to the uniform acquisition cycle so as to obtain the normalized cycle sequence data of the multiple indexes; and the correlation coefficient analysis module is used for obtaining the correlation coefficient between every two indexes in the multiple indexes by adopting at least one preset correlation analysis method for the normalized periodic sequence data between every two indexes in the multiple indexes so as to obtain the correlation relationship, wherein the preset correlation analysis method comprises a correlation analysis method and a chi-square test method by utilizing information gain and an information gain rate.

According to an embodiment of the present disclosure, the association obtaining module further includes: and the data discretization module is used for respectively performing AND operation on the sequence data in the unified acquisition period for each index in the multiple indexes, setting the data in the unified acquisition period to be 1 under the condition that abnormal data exist in the unified acquisition period, setting the data in the unified acquisition period to be 0 under the condition that abnormal data do not exist in the unified acquisition period, and obtaining the standardized period sequence data in the monitoring data segment, wherein the length of the monitoring data segment is the number of the unified acquisition period in the monitoring data segment.

According to an embodiment of the present disclosure, the root cause alarm output module includes: an association index obtaining module, configured to obtain multiple association indexes of the target item index according to the association relation; the source tracing termination time obtaining module comprises: the index acquisition period obtaining module is used for obtaining a plurality of index acquisition periods corresponding to the plurality of associated indexes; and the period delay module is used for delaying the abnormal indication time of the abnormal data to be traced to the maximum index acquisition period in the plurality of index acquisition periods to obtain the tracing termination time.

According to an embodiment of the present disclosure, the root cause alarm output module further includes: a root candidate item index obtaining module, configured to obtain a root candidate item index from the multiple items of indexes according to the association relationship, where the root candidate item index includes candidate abnormal root data with an abnormal indication time before the source tracing termination time; and the source tracing judging module is used for judging whether the candidate abnormal root data is the abnormal root data of the abnormal data to be traced according to the abnormal occurrence time sequence relation.

According to yet another aspect of the present disclosure, there is provided an apparatus comprising: a memory, a processor and executable instructions stored in the memory and executable in the processor, the processor implementing any of the methods described above when executing the executable instructions.

According to yet another aspect of the present disclosure, there is provided a computer-readable storage medium having stored thereon computer-executable instructions that, when executed by a processor, implement any of the methods described above.

According to the index abnormal data tracing method provided by the embodiment of the disclosure, the incidence relation between every two indexes in the multiple indexes is obtained, the abnormal occurrence time sequence relation between the two abnormal indexes in the multiple indexes is obtained according to the probability of the abnormal index data occurring in the index acquisition period, the tracing termination time is obtained according to the abnormal indication time of the abnormal data to be traced, the abnormal data to be traced is traced from the multiple indexes before the tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation, and the abnormal root data is obtained, so that the accuracy of tracing the abnormal index data can be improved.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings.

Fig. 1 shows a schematic diagram of a system architecture in an embodiment of the disclosure.

Fig. 2 shows a flowchart of an index abnormal data tracing method in an embodiment of the present disclosure.

Fig. 3 is a schematic diagram illustrating a processing procedure of step S202 shown in fig. 2 in an embodiment.

FIG. 4A illustrates a distribution of monitoring item indicator data points in a coordinate axis.

Fig. 4B shows the distribution of the index data points after binarization in fig. 4A in the coordinate axis.

Fig. 5A shows the distribution of index data points of two monitoring terms after binarization in the coordinate axis.

Fig. 5B shows the distribution of the index data points in the coordinate axis after the periodic normalization in fig. 5A.

Fig. 6 is a schematic diagram of a flow of obtaining a correlation coefficient according to fig. 3.

Fig. 7 is a schematic diagram illustrating a processing procedure of step S204 shown in fig. 2 in an embodiment.

Fig. 8 is a schematic diagram illustrating a processing procedure of step S208 shown in fig. 2 in an embodiment.

Fig. 9 is a schematic diagram illustrating an abnormal data tracing process according to fig. 2 to 8.

FIG. 10 is a block diagram of an apparatus for anomaly data tracing according to the method shown in FIG. 9.

Fig. 11 shows a block diagram of an index abnormal data tracing apparatus in an embodiment of the present disclosure.

Fig. 12 is a block diagram illustrating another index abnormal data tracing apparatus in the embodiment of the present disclosure.

Fig. 13 shows a schematic structural diagram of an electronic device in an embodiment of the present disclosure.

Detailed Description

Example embodiments will now be described more fully with reference to the accompanying drawings. Example embodiments may, however, be embodied in many different forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of example embodiments to those skilled in the art. The drawings are merely schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and thus their repetitive description will be omitted.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the subject matter of the present disclosure can be practiced without one or more of the specific details, or with other methods, apparatus, steps, etc. In other instances, well-known structures, methods, devices, implementations, or operations are not shown or described in detail to avoid obscuring aspects of the disclosure.

Furthermore, the terms "first", "second", etc. are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the present disclosure, "a plurality" means at least two, e.g., two, three, etc., unless explicitly specifically limited otherwise. The symbol "/" generally indicates that the former and latter associated objects are in an "or" relationship.

In the present disclosure, unless otherwise expressly specified or limited, the terms "connected" and the like are to be construed broadly, e.g., as meaning electrically connected or in communication with each other; may be directly connected or indirectly connected through an intermediate. The specific meaning of the above terms in the present disclosure can be understood by those of ordinary skill in the art as appropriate.

As described above, in the related art, the sequence of the alarm time is used as the sequence of the occurrence of the fault, but in an actual situation, the difference of the sampling intervals of different monitoring indexes and the delay factor may cause the alarm sequence to be opposite to the sequence of the occurrence of the fault. Therefore, the method for tracing the source of the index abnormal data obtains the abnormal occurrence time sequence relation between two abnormal indexes in the multiple indexes according to the probability of the abnormal index data occurring in the index acquisition period, traces the source of the to-be-traced abnormal data from the multiple indexes before the tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation, and obtains the abnormal root data, so that the accuracy of tracing the source of the index abnormal data can be improved.

Fig. 1 illustrates an exemplary system architecture 10 to which the index anomaly data tracing method or the index anomaly data tracing apparatus of the present disclosure may be applied.

As shown in fig. 1, system architecture 10 may include a terminal device 102, a network 104, a server 106, and a database 108. The terminal device 102 may be a variety of electronic devices having a display screen and supporting input, output, including but not limited to smart phones, tablets, laptop portable computers, desktop computers, wearable devices, virtual reality devices, smart homes, and the like. Network 104 is the medium used to provide communication links between terminal device 102 and server 106. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few. The server 106 may be a server or a cluster of servers, etc. that provide various services. The database 108 may be a large database software installed on a server or a small database software installed on a computer for storing data.

A user may use terminal device 102 to interact with server 106 and database 108 via network 104 to receive or transmit data and the like. Data may also be received from database 108 or sent to database 108, etc. at server 106 via network 104. For example, a user inputs an index monitoring parameter on the terminal device 102, uploads the index monitoring parameter to the server 106 through the network 104, and the server 106 obtains the sequence data of the monitoring index from the database 108 through the network 104, and then performs alarm monitoring on the sequence data according to the index monitoring parameter. For another example, the server 106 may be a background processing server, and is configured to obtain the sequence data of the monitoring index from the database 108 through the network 104, perform correlation analysis and timing analysis on the sequence data of the monitoring index, and the like.

It should be understood that the number of terminal devices, networks, servers, and databases in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, servers, and databases, as desired for implementation.

FIG. 2 is a flow diagram illustrating a method for index anomaly data tracing according to an example embodiment. The method shown in fig. 2 may be applied to, for example, a server side of the system, and may also be applied to a terminal device of the system.

Referring to fig. 2, a method 20 provided by an embodiment of the present disclosure may include the following steps.

In step S202, an association relationship between every two indexes in the plurality of indexes is obtained, where the plurality of indexes includes a target index where the index data is abnormal.

In some embodiments, multiple indicators may be monitored, for example, in a network system, when some components are abnormal, the components associated with the components may be affected to different degrees, and therefore, after an alarm occurs due to the abnormal monitoring indicators of some components, the components associated with the components may also be alarmed. The association relationship between every two indexes in the multiple indexes can be considered, and the difference is that the association degrees are different.

In some embodiments, the indexes with different sampling frequencies may be divided according to a uniform acquisition period to measure the association relationship between the indexes with different sampling frequencies, and specific embodiments may refer to fig. 3 to 6.

In step S204, an abnormality occurrence time sequence relationship between two abnormal indexes of the multiple indexes is obtained, and the abnormality occurrence time sequence relationship is obtained according to the probability of abnormality occurrence of the index data in the index acquisition period.

In some embodiments, the abnormal occurrence time sequence relationship between the two abnormal indexes may be calculated according to the probability of the abnormal index data occurring in the index acquisition period, that is, the occurrence sequence of the abnormal is determined by determining whether another alarm occurs when a certain alarm occurs, and the specific implementation manner may refer to fig. 7.

In some embodiments, a functional relationship between the probability of occurrence of an anomaly in the index data and time in an index acquisition period before a time point of occurrence of the anomaly in the index data is subject to uniform distribution, that is, the probability of occurrence of the anomaly is uniformly increased in a sampling period before the occurrence of the anomaly, and a specific implementation manner of obtaining the anomaly occurrence timing relationship by using the functional relationship may refer to fig. 7.

In step S206, the to-be-traced abnormal data of the target item index and the abnormal indication time thereof are acquired.

In some embodiments, for example, the anomaly indication time of the to-be-traced abnormal data of the target item indicator may be the time when the abnormal data of the indicator is collected.

In some embodiments, for example, according to the actual application situation, the abnormal indication time of the to-be-traced abnormal data for obtaining the target item index is the index alarm time, and there may be a short delay between the time of acquiring the abnormal data and the index alarm time.

In step S208, a tracing termination time is obtained according to the abnormal indication time of the abnormal data to be traced.

In some embodiments, for example, there may be a delay in sampling the index data, that is, a related alarm of one monitoring item may occur, but a sampling period of the monitoring item of the related alarm is long, and the data is not acquired yet, and a time of waiting for one period of all related monitoring items may be delayed as a source tracing termination time, so as to ensure that all latest sampling is completed, thereby performing more accurate source tracing. Reference may be made to fig. 8 for a specific embodiment.

In step S210, tracing the source of the abnormal data to be traced from the multiple indexes before the source tracing termination time according to the association relationship and the abnormal occurrence timing relationship, and obtaining abnormal root data.

In some embodiments, after the tracing termination time is determined, alarm data up to the tracing termination time may be acquired for the to-be-traced abnormal data, and the most recent alarm information of the monitoring item with the highest correlation coefficient value is acquired in the correlation coefficient table (or the correlation coefficient matrix) between the monitoring items acquired in fig. 3 or fig. 6. Then searching a historical sequence coefficient table (or sequence coefficient matrix) obtained in the figure 7, judging whether the historical sequence coefficient table (or sequence coefficient matrix) is a front alarm of abnormal data to be traced according to sequence coefficients of two monitoring items, if so, repeating the step, and continuously searching a front alarm of the alarm information; if not, traversing and tracing the source according to the high and low sequence of the correlation coefficient value until the root alarm information is found.

In other embodiments, a root candidate index may be obtained from the multiple indexes according to the association relationship, where the root candidate index includes candidate abnormal root data whose abnormal indication time is before the tracing termination time, and whether the candidate abnormal root data is abnormal root data of the abnormal data to be traced is determined according to the abnormal occurrence timing relationship. For example, a plurality of monitoring items with the highest correlation coefficient values are selected from the correlation coefficient table as root candidate item indexes, then the history sequence is judged one by one, the steps are repeated to trace the source, and finally a root alarm list with the high and low correlation degrees is output.

According to the index abnormal data tracing method provided by the embodiment of the disclosure, the incidence relation between every two indexes in the multiple indexes is obtained, the abnormal occurrence time sequence relation between the two abnormal indexes in the multiple indexes is obtained according to the probability of the abnormal index data occurring in the index acquisition period, the tracing termination time is obtained according to the abnormal indication time of the abnormal data to be traced, the abnormal data to be traced is traced from the multiple indexes before the tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation, and the abnormal root data is obtained. By processing the time sequence data completely based on monitoring acquisition, a complex network topological relation graph and expert experience are not required to be introduced, the workload of monitoring and tracing is greatly reduced, the alarm source is quickly positioned, and the response speed of operation and maintenance personnel is improved; the time sequence relation among the monitoring items is obtained through calculation of historical data and used for deducing the sequence of alarm occurrence, the problem of data alarm sequence caused by sampling interval difference is effectively solved, and therefore the accuracy of tracing the abnormal index data can be improved.

Fig. 3 is a schematic diagram illustrating a processing procedure of step S202 shown in fig. 2 in an embodiment. As shown in fig. 3, in the embodiment of the present disclosure, the step S202 may further include the following steps.

Step S302, acquiring sequence data of a plurality of indexes in respective index acquisition periods.

In some embodiments, after the original index data of a plurality of monitoring items in a preset time period is collected, binary discretization processing may be performed on all continuous index data to obtain sequence data in respective index collection periods. The index data of the monitoring item has two basic types of a continuous type and a discrete type, the Boolean discrete type data cannot directly establish a corresponding relation with the continuous type to carry out feature extraction and correlation calculation, and the correlation relation can be established with the discrete type index data and the correlation calculation can be carried out by carrying out binarization processing on the continuous index data. For example, the original monitoring index data set of a certain monitoring item is obtained as { x }₁,x₂,x₃,x₄.., the rule when the binarization processing is carried out is as follows: if the monitoring item presets an alarm threshold K_min,K_maxWhen K is present_min＜x＜K_max，x∈{x₁，x₂，x₃，x₄.., when x 'is 0, otherwise, x' is 1, and x 'is x, the binary sequence data { x'₁,x'₂,x'₃,x'₄...}. Similarly, binarized sequence data of a plurality of indices in respective index acquisition periods may be obtained, and if there are Z monitoring items in total, binarized sequence data of monitoring item 1 may be expressed as { x'_1，1,x′_1，2,x′_1，3,x′_1，4.., the binarized sequence data for monitoring term 2 may be represented as { x'_2，1,x'_2，2,x'_2，3,x'_2，4.., the binarized sequence data for monitoring item 3 may be represented as { x'_3，1,x'_3，2,x'_3，3,x'_3，4... } … … binary sequence data for the monitoring term Z may be represented as { x'_Z，1,x'_Z，2,x'_Z，3,x'_Z，4...}。

In some embodiments, for example, fig. 4A and 4B show a comparison graph before and after a binary-type discretization process. As shown in fig. 4A, fig. 4A is a distribution of monitoring item indicator data points in a coordinate axis, a horizontal axis is a time unit, a vertical axis is an indicator value, which includes A, B, … …, I, and other 9 data points, and it can be seen that the indicator value of these data points is a continuous value between 0 and 6. As shown in fig. 4B, fig. 4B shows the distribution of the index data points after binarization in fig. 4A on the coordinate axis, the horizontal axis and the vertical axis in fig. 4B have the same meaning as those shown in fig. 4A, and after binary conversion, the values of the 9 data points such as A, B, … …, I, etc. are 0 or 1.

In other embodiments, the alarm threshold calculation may be performed using a quartile in the event that the alarm threshold is not preset by the monitoring item. For example, for a monitored item, the set of index data { x }₁,x₂,x₃,x₄A, wherein the lower quartile is Q₁Median is Q₂Upper quartile of Q₃Then the minimum estimate of the set of data sequences is Q₁-k(Q₃-Q₁) Maximum estimated value Q₁+k(Q₃-Q₁) At this time, the alarm threshold may be set to K_min＝Q₁-k(Q₃-Q₁)，K_max＝Q₁+k(Q₃-Q₁) The value of k may be determined according to actual conditions, for example, k may be 1.25, 1.5, or 1.75, and the larger the value of k, the larger the upper and lower limits of the alarm threshold are. After the alarm threshold is obtained by calculation, the binarization processing method in the above embodiment may be adopted to obtain the binarization sequence data of multiple indexes in respective index acquisition periods.

In other embodiments, the above embodiments may be applied to obtain corresponding binary discrete time sequence data for a non-binary discrete time sequence.

And step S304, acquiring a uniform acquisition cycle according to the respective index acquisition cycles of the plurality of indexes.

In some embodiments, there may be instances where the sampling frequencies (and corresponding sampling periods) of different target monitoring items are not uniform. For example, if there are Z monitoring items, the sampling intervals of the index data of the Z monitoring items may be T₁,T₂,T₃...T_ZThe unified acquisition period T can be set to take the value T as max (T)₁,T₂,T₃.., Tz), namely, the index acquisition cycle with the longest multiple indexes is taken as a uniform acquisition cycle.

In some embodiments, for example, the longest index acquisition period may also be multiplied by a preset multiple, such as 2 times, 3 times, or 4 times, etc., as a uniform acquisition period.

And S306, dividing the sequence data of the multiple indexes according to a uniform acquisition cycle to obtain the normalized cycle sequence data of the multiple indexes.

In some embodiments, different sampling periods of the monitoring items may cause different sampling timestamps of different monitoring items in the same time interval, and a one-to-one correspondence relationship cannot be established. And respectively performing AND operation on sequence data in the unified acquisition period for each index in the multiple indexes, setting the data in the unified acquisition period to be 1 under the condition that abnormal data exist in the unified acquisition period, setting the data in the unified acquisition period to be 0 under the condition that abnormal data do not exist in the unified acquisition period, and obtaining the standardized period sequence data in the monitoring data segment, wherein the length of the monitoring data segment is the number of the unified acquisition period in the monitoring data segment. For example, with the uniform acquisition period T as an interval, the binary sequence data of each index is re-divided, that is, the and operation is performed on the sequence data in each period, and if an abnormal alarm value exists in the period of time, the data in the period of time is set to 1. Forming a monitoring data segment by N uniform sampling periods, wherein the duration of the data segment is N x T, and different monitoring item information of originally different sampling frequencies are uniformly binary discrete sequence data D with the sampling period of T in one monitoring data segment_m(the data value is 0 or 1), J monitoring data segments are taken to carry out the operation, and then J monitoring sequence data with uniform period are obtained by the monitoring item

J may be a positive integer greater than or equal to 100. Then for Z monitoring terms, Z normalized periodic sequence data can be obtained, each term is a set of J binary discrete sequence data with the length of N x T, for exampleFor 50 monitoring items, for example, 50 pieces of normalized periodic sequence data can be obtained, each piece being a set of J binary discrete sequence data with the length of N × T.

In some embodiments, for example, fig. 5A and 5B show a comparison of before and after a period normalization process. As shown in fig. 5A, fig. 5A is a distribution of index data points of two binarized monitoring items in a coordinate axis, where a horizontal axis is a time unit and a vertical axis is an index value, and the distribution includes A, B, C, D, E, F, G, H, I, L, M, N and other 12 data points, where an acquisition cycle of a monitoring item corresponding to A, B, C, D, E, F, G, H, I is 1 time unit, and an acquisition cycle of a monitoring item corresponding to L, M, N is 3 time units. As shown in fig. 5B, fig. 5B is a distribution of the index data points in the coordinate axis after the period normalization of fig. 5A, the horizontal axis and the vertical axis of fig. 5B have the same meaning as those shown in fig. 5A, and after the period normalization, the acquisition periods of A, D, G, L, M, N data points are all normalized to 3 time units.

Step S308, at least one preset correlation analysis method is adopted for the normalized cycle sequence data between every two indexes in the multiple indexes, and correlation coefficients between every two indexes in the multiple indexes are obtained to obtain a correlation relationship, wherein the preset correlation analysis method comprises a method for performing correlation analysis by using information gain and information gain rate and a chi-square test method.

In some embodiments, the normalized periodic sequence data is in the form of binary discrete data, and for sequence data of different monitoring items in the same time period, a correlation coefficient between the monitoring items can be obtained by using a mathematically known correlation calculation method, including but not limited to correlation analysis using information gain and information gain rate, correlation analysis using the pierce chi-square test method, and the like. For example, for the same time interval, the correlation coefficient between every two indexes is obtained, and for 1-Z monitoring items, the correlation coefficient between every two monitoring items can be analyzed and calculated as follows:

TABLE 1

	Monitoring item 1	Monitoring item 2		Monitoring item Z
					Monitoring item 1	L₁₁	L₁₂	……	L_1Z
Monitoring item 2	L₂₁	L₂₂	……	L_2Z
					……	……	……	……	……
Monitoring item Z	L_Z1	L_Z2	……	L_ZZ

The matrix M can be used for the correlation coefficients in Table 1_LExpressed as:

similarly, for each monitoring data segment in the J monitoring data segments of each type of monitoring item, the correlation coefficient calculation between every two indexes is carried out, and J correlation coefficient matrixes are obtained in total

Wherein the content of the first and second substances,

and so on. The matrix of J monitoring data segments can be added to obtain the final monitoring correlation coefficient matrix M_R：

According to the incidence relation obtaining method provided by the embodiment of the disclosure, the problem of inconsistent data types of monitoring items is solved by performing binary discretization processing on the original data of the monitoring indexes, a uniform acquisition period is introduced, the result deviation caused by different sampling frequencies of different monitoring items is reduced, and the problem of data correlation processing caused by sampling interval difference is effectively solved.

Fig. 6 is a schematic diagram of a flow of obtaining a correlation coefficient according to fig. 3. As shown in fig. 6, first, a monitoring data set is obtained (S602), for example, 50 monitoring items such as CPU utilization, network information, and machine on/off information are obtained, and if the preset monitoring time period is 7 days, all 50 monitoring item data within the preset 7 days are obtained. Then, judging whether the index data of each monitoring item is binary discrete data one by one according to the acquired data of all the monitoring items (S604), and if so, directly dividing the data according to a uniform acquisition cycle to obtain standard cycle sequence data (S610); if not, the alarm threshold of the monitoring item is determined by the quartile (S606), then discretization is performed (S608), and the process goes to step S610. After the conversion of the standardization period, the discrete correlation analysis is performed by using the pilman chi-square test, the correlation coefficient between every two monitoring items is obtained and recorded (S612), then the correlation coefficient is filled in a correlation coefficient table (shown as table 1) according to the monitoring data section, and when newly-added acquisition data is added, the correlation coefficient table is updated according to the process (S614).

Fig. 7 is a schematic diagram illustrating a processing procedure of step S204 shown in fig. 2 in an embodiment. As shown in fig. 7, in the embodiment of the present disclosure, the step S204 may further include the following steps.

Step S702, acquiring sequence data of a plurality of indexes in respective index acquisition periods, wherein the sequence data comprises abnormal data.

Step S704, obtaining an integral interval according to the index acquisition period of each of the two abnormal indexes and the abnormal indication time of the abnormal data.

Step S706, integrating the probability of the abnormal index data in the index acquisition period in the integration interval of the two abnormal indexes to obtain the time sequence coefficient between the two abnormal indexes so as to obtain the abnormal occurrence time sequence relation between the two abnormal indexes. The time sequence coefficient refers to the probability of the first occurrence of the monitoring item a relative to the monitoring item b when the related alarm between the two monitoring items a and b occurs at one time, namely when the time sequence coefficient takes 1, the abnormal occurrence of the monitoring item a is definitely earlier than that of the monitoring item b, and when the time sequence coefficient takes-1, the opposite is true.

In some embodiments, it may be considered that the probability of occurrence of the fault is uniformly increased in the sampling period before the alarm occurs, and the correlation P between the probability of occurrence of the fault and the time may be obtained_tExpressed as:

wherein T represents the time interval (separated by an index acquisition period T) between the first time point of alarm occurrence and the last time point of fault-free alarm₁)，t₁Represents the time point of alarm occurrence, wherein the probability of actual fault (not collected) of any time point t is P_t，P_tThe time point when the alarm occurs is 1, and a normal sampling point (the time point of the last alarm without failure) before the time point when the alarm occurs is 0, during which it is considered as a uniform distribution. The closer to this alarm indicator sampling point, the higher the probability that it may have failed (not yet collected).

For a pair of (possible) associated alarms between any two monitoring items a and b, the sampling periods are respectively T_a，T_bThe first time of the alarm occurrence is respectively recorded as t_a，t_bThe corresponding parameter is substituted for the expression (3), which is integrated, and the time sequence coefficient B between the two monitoring terms a, B can be obtained_abExpressed as:

assuming that an abnormal alarm occurs in the index data of each monitoring item (if not, the following Z is replaced by the corresponding number of items with abnormal alarms), performing the time sequence coefficient calculation on each two monitoring items for the initial alarm, and analyzing and calculating the time sequence coefficient between each two monitoring items for 1-Z monitoring items, wherein the time sequence coefficient is as follows:

TABLE 2

	Monitoring item 1	Monitoring item 2		Monitoring item Z
					Monitoring item 1	B₁₁	B₁₂	……	B_1Z
Monitoring item 2	B₂₁	B₂₂	……	B_2Z
					……	……	……	……	……
Monitoring item Z	B_Z1	B_Z2	……	B_ZZ

The sequential coefficient matrix M for the time sequence coefficient in Table 1 can be used_BExpressed as:

similarly, for J monitoring data segments of each type of monitoring item, assuming that each monitoring data segment has an abnormal alarm (if not, the following J is replaced by the corresponding time segment number in which the abnormal alarm occurs), performing time sequence coefficient calculation between every two indexes on each monitoring data segment, and obtaining J sequence coefficient matrix matrices in total

Wherein the content of the first and second substances,

and so on. The matrix of J monitoring data segments can be added to obtain the final historical sequence coefficient matrix M_S：

According to the time sequence relation obtaining method provided by the embodiment of the disclosure, by proposing the concept of the time sequence coefficient, sampling frequency difference factors are considered in alarm sequence judgment, and by recording the form of the historical sequence coefficient recording table, historical monitoring information data is fully utilized, so that the problem that the credibility of the time sequence obtained by single alarm acquisition is low due to the sampling frequency difference, alarm delay and other reasons of the monitoring data can be solved, and the influence caused by single sampling errors is reduced.

Fig. 8 is a schematic diagram illustrating a processing procedure of step S208 shown in fig. 2 in an embodiment. As shown in fig. 8, in the embodiment of the present disclosure, the step S208 may further include the following steps.

Step S802, a plurality of associated indexes of the target item index are obtained according to the association relation.

Step S804, a plurality of index acquisition periods corresponding to the plurality of associated item indexes are obtained.

Step S806, delaying the abnormal indication time of the abnormal data to be traced by the maximum index collection period of the multiple index collection periods, to obtain the tracing termination time.

In some embodiments, when performing exception tracing, a relevant monitoring item set { a ] of a monitoring item index corresponding to exception data to be traced may be queried in the monitoring association coefficient matrix obtained in fig. 3 according to an association coefficient threshold preset according to an actual situation₁,A₂,A₃...}. If the abnormal indication time point of the abnormal data to be traced is t_nThe index collection period of each related monitoring item is { T }_a1,T_a2,T_a3.., the monitoring data set can take t_n+max({T_a1,T_a2,T_a3...) perform correlation tracing for the termination time.

According to the method for obtaining the traceability termination time, provided by the embodiment of the disclosure, the abnormity indication time of the abnormal data to be traced is delayed by the maximum index acquisition period in the acquisition periods of the associated indexes, so that the difference of the index acquisition periods of different monitoring items can be taken into account, and the accuracy of the abnormity traceability is improved.

Fig. 9 is a schematic diagram illustrating an abnormal data tracing process according to fig. 2 to 8. As shown in fig. 9, collecting all the monitoring item information in the preset time period includes acquiring an index collection period and initial collection data of each monitoring item (S902). Then, the continuous initial data in all the monitoring item indexes is subjected to binary discretization processing through a set abnormal threshold or an error parameter (S904). Then, the index acquisition periods of the monitoring items are compared, the maximum period is determined to be a uniform acquisition period, and the normalization processing of the uniform acquisition period is performed to obtain normalized period sequence data (S906). For the binarized normalized periodic sequence data of different monitoring items in the same time period, the correlation coefficient between the monitoring items can be obtained by using a correlation calculation method known in mathematics, a plurality of correlation coefficient tables of different time periods can be established, and the tables are updated when the latest data is acquired (S908). While the correlation calculation is performed, the time series coefficient between two monitoring items where abnormality occurs may be calculated according to the failure occurrence probability (S903), a time series coefficient table for a plurality of different time periods may be established, and the table may be updated when the latest data is acquired (S905). Obtaining a correlation coefficient table and a time sequence coefficient table, wherein the correlation coefficient table can be firstly obtained in a delayed manner according to the latest alarm information of all the correlation monitoring items for obtaining the current alarm to be traced and according to the index acquisition period of each monitoring item (S910); and then obtaining a root alarm list of the current alarm to be traced according to the association coefficient table and the time sequence coefficient table, sorting according to the association coefficient (S912), and outputting a source alarm list (S914). After one alarm tracing is performed, the association coefficient table and the timing coefficient table of each monitoring item can be updated according to the above steps S902-S908 by combining the alarm data, so that the alarm association table and the alarm timing table can be updated in real time, and the change of the monitoring type and data can be better dealt with.

FIG. 10 is a block diagram of an apparatus for anomaly data tracing according to the method shown in FIG. 9. As shown in fig. 10, the apparatus may include a monitoring data collection module 1002, a data discretization module 1004, a data windowing module 1006, a correlation coefficient analysis module 1008, a parameter setting module 1005, an alarm sequence analysis module 10010, a sequence coefficient table update module 10012, and a root cause alarm output module 10014.

The parameter setting module 1005 may be configured to set an alarm threshold, a size of a related table, a length of a data collection interval, and the like.

The monitoring data collection module 1002 may be configured to read and record historical monitoring data of all monitoring items within a preset time.

The data discretization module 1004 can be used for discretizing the non-boolean monitoring data into a binary discrete sequence by a method of presetting a threshold or automatically acquiring a threshold.

The data windowing module 1006 may be configured to divide data by taking a uniform acquisition period as a window and standardize the uniform acquisition period for the problem of alarm frequency difference.

The correlation coefficient analysis module 1008 may be configured to calculate and record the correlation coefficient by using a common discrete data correlation analysis method such as chi-square test.

The alarm sequence analysis module 10010 may be configured to calculate a time sequence coefficient between monitoring items where an abnormality occurs.

The sequential coefficient table update module 10012 may be configured to create and/or update a table of alarm timing coefficients based on historical data.

The root alarm output module 10014 may be configured to, after the current to-be-traced alarm information is specified, iteratively determine and output the root alarm information of the current to-be-traced alarm information through the alarm correlation coefficient table and the timing coefficient table.

FIG. 11 is a block diagram illustrating an index anomaly data tracing apparatus according to an example embodiment. The apparatus shown in fig. 11 may be applied to, for example, a server side of the system, and may also be applied to a terminal device of the system.

Referring to fig. 11, the apparatus 110 provided in the embodiment of the present disclosure may include an association relation obtaining module 1102, a sequential relation obtaining module 1104, an abnormal data obtaining module 1106, a tracing expiration time obtaining module 1108, and a root cause alarm outputting module 1110.

The association relationship obtaining module 1102 may be configured to obtain an association relationship between every two indexes in the multiple indexes, where the multiple indexes include target indexes in which the index data is abnormal.

The sequence relation obtaining module 1104 may be configured to obtain an abnormal occurrence time sequence relation between two abnormal indicators of the multiple indicators, where the abnormal occurrence time sequence relation is obtained according to a probability of occurrence of an abnormality in the indicator data in the indicator collection period.

The abnormal data obtaining module 1106 may be configured to obtain the abnormal data to be traced and the abnormal indication time thereof of the target item indicator.

The tracing expiration time obtaining module 1108 may be configured to obtain the tracing expiration time according to the abnormal indication time of the abnormal data to be traced.

The root alarm output module 1110 may be configured to trace the source of the to-be-traced abnormal data from the multiple indexes before the source tracing termination time according to the association relationship and the abnormal occurrence timing relationship, so as to obtain abnormal root data.

FIG. 12 is a block diagram illustrating another metric anomaly data tracing apparatus in accordance with an illustrative embodiment. The apparatus shown in fig. 12 may be applied to, for example, a server side of the system, and may also be applied to a terminal device of the system.

Referring to fig. 12, the apparatus 120 provided in the embodiment of the present disclosure may include a monitoring data acquisition module 1201, an association relationship acquisition module 1202, a sequential relationship acquisition module 1204, an abnormal data acquisition module 1206, a tracing termination time acquisition module 1208, and a root alarm output module 1210, where the association relationship acquisition module 1202 may include a parameter setting module 12022, a data windowing module 12024, a data discretization module 12025, and a correlation coefficient analysis module 12026, the sequential relationship acquisition module 1204 may include an integration interval acquisition module 12042 and an alarm sequence analysis module 12044, the tracing termination time acquisition module 1208 may include an indicator acquisition period acquisition module 12082 and a period delay module 12084, and the root alarm output module 1210 may include an association indicator acquisition module 12102, a root candidate indicator acquisition module 12104, and a tracing determination module 12106.

The monitoring data acquisition module 1201 may be configured to acquire sequence data of a plurality of indicators in respective indicator acquisition periods, where the sequence data includes abnormal data.

The association obtaining module 1202 may be configured to obtain an association between every two indexes in a plurality of indexes, where the plurality of indexes include target indexes of the index data that are abnormal.

The parameter setting module 12022 may be configured to obtain a uniform acquisition period according to respective index acquisition periods of multiple indexes.

The data windowing module 12024 may be configured to divide the sequence data of multiple indicators according to a uniform acquisition cycle to obtain normalized cycle sequence data of multiple indicators.

The data discretization module 12025 may be configured to perform an and operation on the sequence data in the unified acquisition period for each of the multiple indexes, respectively, set the data in the unified acquisition period to 1 when abnormal data exists in the unified acquisition period, set the data in the unified acquisition period to 0 when abnormal data does not exist in the unified acquisition period, and obtain the normalized period sequence data in the monitoring data segment, where the length of the monitoring data segment is the number of the unified acquisition period in the monitoring data segment.

The correlation coefficient analysis module 12026 may be configured to obtain a correlation coefficient between every two indexes in the multiple indexes by using at least one preset correlation analysis method for the normalized cycle sequence data between every two indexes in the multiple indexes to obtain a correlation relationship, where the preset correlation analysis method includes a method of performing correlation analysis by using information gain and an information gain rate and a chi-square test method.

The sequence relation obtaining module 1204 may be configured to obtain an abnormal occurrence time sequence relation between two abnormal indicators of the multiple indicators, where the abnormal occurrence time sequence relation is obtained according to a probability of occurrence of an abnormality in the indicator data in the indicator collection period. The function relation of the probability of the index data being abnormal and the time in the index acquisition period before the time point of the index data being abnormal obeys uniform distribution.

The integral interval obtaining module 12042 may be configured to obtain an integral interval according to an index acquisition period of each of the two indexes having the abnormality and an abnormality indication time of the abnormal data thereof.

The alarm sequence analysis module 12044 may be configured to integrate the probability that the abnormal two indexes have abnormality in the index acquisition period in an integration interval, and obtain a time sequence coefficient between the two abnormal indexes, so as to obtain an abnormality occurrence time sequence relationship between the two abnormal indexes.

The abnormal data obtaining module 1206 may be configured to obtain the to-be-traced abnormal data of the target item indicator and the abnormal indication time thereof.

The tracing termination time obtaining module 1208 may be configured to obtain the tracing termination time according to the abnormal indication time of the abnormal data to be traced.

The index acquisition period obtaining module 12082 may be configured to obtain a plurality of index acquisition periods corresponding to a plurality of associated indexes.

The period delay module 12084 may be configured to delay the abnormal indication time of the abnormal data to be traced to a maximum index acquisition period in the multiple index acquisition periods, so as to obtain a tracing termination time.

The root alarm output module 1210 may be configured to trace the source of the to-be-traced abnormal data from the multiple indexes before the source tracing termination time according to the association relationship and the abnormal occurrence timing relationship, and obtain abnormal root data.

The association index obtaining module 12102 may be configured to obtain a plurality of association indexes of the target item index according to the association relationship.

The root candidate index obtaining module 12104 may be configured to obtain a root candidate index from the multiple indexes according to the association relationship, where the root candidate index includes candidate abnormal root data with an abnormal indication time before the source tracing termination time.

The tracing module 12106 may be configured to determine whether the candidate abnormal root data is the abnormal root data of the abnormal data to be traced according to the abnormal occurrence timing relationship.

The specific implementation of each module in the apparatus provided in the embodiment of the present disclosure may refer to the content in the foregoing method, and is not described herein again.

Fig. 13 shows a schematic structural diagram of an electronic device in an embodiment of the present disclosure. It should be noted that the apparatus shown in fig. 13 is only an example of a computer system, and should not bring any limitation to the function and the scope of the application of the embodiments of the present disclosure.

As shown in fig. 13, the apparatus 1300 includes a Central Processing Unit (CPU)1301 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)1302 or a program loaded from a storage section 1308 into a Random Access Memory (RAM) 1303. In the RAM 1303, various programs and data necessary for the operation of the device 1300 are also stored. The CPU1301, the ROM 1302, and the RAM 1303 are connected to each other via a bus 1304. An input/output (I/O) interface 1305 is also connected to bus 1304.

The following components are connected to the I/O interface 1305: an input portion 1306 including a keyboard, a mouse, and the like; an output section 1307 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage portion 1308 including a hard disk and the like; and a communication section 1309 including a network interface card such as a LAN card, a modem, or the like. The communication section 1309 performs communication processing via a network such as the internet. A drive 1310 is also connected to the I/O interface 1305 as needed. A removable medium 1311 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 1310 as necessary, so that a computer program read out therefrom is mounted into the storage portion 1308 as necessary.

In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method illustrated in the flow chart. In such embodiments, the computer program may be downloaded and installed from a network via communications component 1309 and/or installed from removable media 1311. The above-described functions defined in the system of the present disclosure are executed when the computer program is executed by a Central Processing Unit (CPU) 1301.

It should be noted that the computer readable media shown in the present disclosure may be computer readable signal media or computer readable storage media or any combination of the two. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples of the computer readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In contrast, in the present disclosure, a computer-readable signal medium may include a propagated data signal with computer-readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take many forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, fiber optic cable, RF, etc., or any suitable combination of the foregoing.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The modules described in the embodiments of the present disclosure may be implemented by software or hardware. The described modules may also be provided in a processor, which may be described as: a processor comprises an incidence relation acquisition module, a sequence relation acquisition module, an abnormal data acquisition module, a source tracing termination time acquisition module and a root alarm output module. The names of these modules do not form a limitation to the module itself in some cases, for example, the association obtaining module may also be described as a "module for obtaining an association between monitoring items according to collected sequence data".

As another aspect, the present disclosure also provides a computer-readable medium, which may be contained in the apparatus described in the above embodiments; or may be separate and not incorporated into the device. The computer readable medium carries one or more programs which, when executed by a device, cause the device to comprise:

acquiring an incidence relation between every two indexes in a plurality of indexes, wherein the plurality of indexes comprise target indexes with abnormal index data; acquiring an abnormal occurrence time sequence relation between two abnormal indexes in the multiple indexes, wherein the abnormal occurrence time sequence relation is obtained according to the probability of the abnormal index data in the index acquisition period; acquiring to-be-traced abnormal data of a target item index and abnormal indication time of the to-be-traced abnormal data; obtaining source tracing termination time according to the abnormal indication time of the abnormal data to be traced; and tracing the source of the abnormal data to be traced from the multiple indexes before the source tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation to obtain abnormal root data.

Exemplary embodiments of the present disclosure are specifically illustrated and described above. It is to be understood that the present disclosure is not limited to the precise arrangements, instrumentalities, or instrumentalities described herein; on the contrary, the disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A tracing method for index abnormal data is characterized by comprising the following steps:

acquiring an incidence relation between every two indexes in a plurality of indexes, wherein the plurality of indexes comprise target indexes with abnormal index data;

acquiring an abnormal occurrence time sequence relation between two abnormal indexes in the multiple indexes, wherein the abnormal occurrence time sequence relation is obtained according to the probability of the abnormal index data in an index acquisition period;

acquiring to-be-traced abnormal data of the target item index and abnormal indication time of the target item index;

obtaining source tracing termination time according to the abnormal indication time of the abnormal data to be traced;

tracing the source of the abnormal data to be traced from the multiple indexes before the source tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation, and obtaining abnormal root data.

2. The method of claim 1, wherein the function of the time and the probability of the index data being abnormal in the index collection period before the time point of the index data being abnormal is subject to uniform distribution.

3. The method according to claim 2, wherein the obtaining of the abnormality occurrence time-series relationship between two of the plurality of indexes in which an abnormality occurs comprises:

acquiring sequence data of the multiple indexes in respective index acquisition periods, wherein the sequence data comprises abnormal data;

acquiring an integral interval according to the index acquisition period of each of the two abnormal indexes and the abnormal indication time of the abnormal data of the two abnormal indexes;

integrating the probability of the abnormal index data in the index acquisition period of the two abnormal indexes in the integration interval to obtain a time sequence coefficient between the two abnormal indexes so as to obtain an abnormal occurrence time sequence relation between the two abnormal indexes.

4. The method according to claim 1, wherein the obtaining of the association relationship between every two indexes comprises:

acquiring sequence data of the multiple indexes in respective index acquisition periods;

acquiring a uniform acquisition period according to the respective index acquisition periods of the multiple indexes;

dividing the sequence data of the multiple indexes according to the uniform acquisition cycle to obtain normalized cycle sequence data of the multiple indexes;

and obtaining a correlation coefficient between every two indexes in the multiple indexes by adopting at least one preset correlation analysis method for the normalized periodic sequence data between every two indexes in the multiple indexes to obtain the correlation relationship, wherein the preset correlation analysis method comprises a method for performing correlation analysis by using information gain and information gain rate and a chi-square test method.

5. The method of claim 4, wherein the dividing the sequence data of the plurality of indicators according to the uniform acquisition cycle to obtain the normalized cycle sequence data of the plurality of indicators comprises:

and respectively performing AND operation on sequence data in the unified acquisition period for each index in the plurality of indexes, setting the data in the unified acquisition period to be 1 under the condition that abnormal data exist in the unified acquisition period, setting the data in the unified acquisition period to be 0 under the condition that abnormal data do not exist in the unified acquisition period, and obtaining standardized period sequence data in a monitoring data segment, wherein the length of the monitoring data segment is the number of the unified acquisition period in the monitoring data segment.

6. The method of claim 1, further comprising:

obtaining a plurality of associated indexes of the target item index according to the association relation;

the obtaining of the tracing termination time according to the abnormal indication time of the abnormal data to be traced comprises:

acquiring a plurality of index acquisition periods corresponding to the plurality of associated indexes;

and delaying the abnormal indication time of the abnormal data to be traced by the maximum index acquisition period in the plurality of index acquisition periods to obtain the tracing termination time.

7. The method according to claim 1, wherein the tracing the abnormal data to be traced from the plurality of indicators within the tracing time period according to the incidence relation and the abnormality occurrence time sequence relation, and obtaining abnormal root data comprises:

obtaining root candidate item indexes from the multiple indexes according to the incidence relation, wherein the root candidate item indexes comprise candidate abnormal root data with abnormal indication time before the source tracing termination time;

and judging whether the candidate abnormal root data is the abnormal root data of the abnormal data to be traced according to the abnormal occurrence time sequence relation.

8. An index abnormal data tracing device is characterized by comprising:

the incidence relation acquisition module is used for acquiring the incidence relation between every two indexes in a plurality of indexes, wherein the plurality of indexes comprise target item indexes with abnormal index data;

the sequence relation acquisition module is used for acquiring an abnormal occurrence time sequence relation between two abnormal indexes in the multiple indexes, and the abnormal occurrence time sequence relation is obtained according to the probability of the abnormal index data in an index acquisition period;

the abnormal data acquisition module is used for acquiring the abnormal data to be traced of the target item index and the abnormal indication time of the abnormal data;

a source tracing termination time obtaining module, configured to obtain a source tracing termination time according to the abnormal indication time of the abnormal data to be traced;

and the root alarm output module is used for tracing the source of the abnormal data to be traced from the multiple indexes before the source tracing termination time according to the incidence relation and the abnormal occurrence time sequence relation to obtain abnormal root data.

9. An apparatus, comprising: memory, processor and executable instructions stored in the memory and executable in the processor, characterized in that the processor implements the method according to any of claims 1-7 when executing the executable instructions.

10. A computer-readable storage medium having stored thereon computer-executable instructions, which when executed by a processor, implement the method of any one of claims 1-7.