CN113448761A - Root cause positioning method and device - Google Patents
Root cause positioning method and device Download PDFInfo
- Publication number
- CN113448761A CN113448761A CN202110672278.3A CN202110672278A CN113448761A CN 113448761 A CN113448761 A CN 113448761A CN 202110672278 A CN202110672278 A CN 202110672278A CN 113448761 A CN113448761 A CN 113448761A
- Authority
- CN
- China
- Prior art keywords
- frequent
- item set
- abnormal
- dimensional data
- parameters
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 48
- 230000002159 abnormal effect Effects 0.000 claims abstract description 147
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 54
- 238000013138 pruning Methods 0.000 claims description 26
- 238000004140 cleaning Methods 0.000 claims description 5
- 238000013480 data collection Methods 0.000 claims description 3
- 230000004807 localization Effects 0.000 claims description 2
- 238000004458 analytical method Methods 0.000 abstract description 18
- 230000008569 process Effects 0.000 abstract description 15
- 238000004364 calculation method Methods 0.000 abstract description 12
- 230000009286 beneficial effect Effects 0.000 description 3
- 238000013461 design Methods 0.000 description 3
- 230000006870 function Effects 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000004048 modification Effects 0.000 description 3
- 230000000717 retained effect Effects 0.000 description 3
- 238000007418 data mining Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000011156 evaluation Methods 0.000 description 2
- 238000012423 maintenance Methods 0.000 description 2
- 238000005065 mining Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 101150055297 SET1 gene Proteins 0.000 description 1
- 230000005856 abnormality Effects 0.000 description 1
- 230000004075 alteration Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 238000003066 decision tree Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment of the invention provides a root cause positioning method and a root cause positioning device, wherein the root cause positioning method comprises the following steps: collecting each piece of abnormal data generated by a background during the operation of the service, and forming the collected abnormal data into an abnormal data set of the service; analyzing the abnormal data set of the service based on an improved Apriori algorithm, determining abnormal parameters by calculating the support degree of the parameters in the abnormal data set of the service, and taking the abnormal parameters as abnormal root factors of the service; wherein the support of the parameter is used for representing the value proportion of the parameter value in the abnormal data set. The root cause analysis process in the traditional manual calculation method is replaced by the improved Apriori algorithm, so that the automation of the root cause analysis is realized, and the root cause positioning speed is improved.
Description
Technical Field
The invention relates to the field of data mining, in particular to a root cause positioning method and device.
Background
When the operation and maintenance analyzes problems, relevant data are collected through service buried points or logs, relevant data are gathered through a monitoring system, and finally statistical dimension analysis of multi-dimensional data is carried out to find abnormal data. When the abnormity occurs, the reason for the operation and maintenance needs to be quickly and accurately positioned, and the normal operation of the whole system is ensured. So that the root cause positioning is particularly important.
The existing root cause analysis methods mainly comprise: in the traditional manual analysis, whether data is abnormal or not is judged, then possible dimensions are searched manually, and finally the possible dimensions are summarized manually. In the process of implementing the invention, the applicant finds that at least the following problems exist in the prior art: the manual identification method needs to judge whether the combination of one or more dimensions is the reason for causing the abnormal constant one by one; if the dimensionality is too large, a great deal of time and labor can be wasted.
Disclosure of Invention
The embodiment of the invention provides a method and a device for positioning root causes, which replace the process of root cause analysis in the traditional manual calculation method by an improved Apriori algorithm, realize the automation of the root cause analysis and improve the speed of positioning the root causes.
To achieve the above object, in one aspect, an embodiment of the present invention provides a root cause positioning method, including:
collecting each piece of abnormal data generated by a background during the operation of the service, and forming the collected abnormal data into an abnormal data set of the service;
analyzing the abnormal data set of the service based on an improved Apriori algorithm, determining abnormal parameters by calculating the support degree of the parameters in the abnormal data set of the service, and taking the abnormal parameters as abnormal root factors of the service; wherein the support of the parameter is used for representing the value proportion of the parameter value in the abnormal data set.
In another aspect, an embodiment of the present invention provides a root cause positioning apparatus, including:
the data collection module is used for collecting each piece of abnormal data generated by the background during the operation of the service and forming the collected abnormal data into an abnormal data set of the service;
a root cause positioning module for analyzing the abnormal data set of the service based on the improved Apriori algorithm, determining abnormal parameters by calculating the support degree of the parameters in the abnormal data set of the service, and taking the abnormal parameters as the abnormal root cause of the service; wherein the support of the parameter is used for representing the value proportion of the parameter value in the abnormal data set.
The technical scheme has the following beneficial effects: the root cause analysis process in the traditional manual calculation method is replaced by the improved Apriori algorithm, so that the automation of the root cause analysis is realized, and the root cause positioning speed is improved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a flow chart of a method for root cause location according to an embodiment of the present invention;
FIG. 2 is a block diagram of an exemplary embodiment of an agent-locating device;
fig. 3 is a schematic diagram of a process for implementing root cause location by Apriori algorithm according to an embodiment of the present invention.
Detailed Description
The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
As shown in fig. 1, in accordance with an embodiment of the present invention, there is provided a root cause location method, including:
s101, collecting each piece of abnormal data generated by a background during service operation, and forming the collected abnormal data into an abnormal data set of the service;
s102: analyzing the abnormal data set of the service based on an improved Apriori algorithm, determining abnormal parameters by calculating the support degree of the parameters in the abnormal data set of the service, and taking the abnormal parameters as abnormal root factors of the service; wherein the support of the parameter is used for representing the value proportion of the parameter value in the abnormal data set.
Preferably, each anomaly data includes: abnormal values, parameters and parameter values of the data itself;
step 102 specifically includes:
s1021: extracting parameters and parameter values in each abnormal data, and unifying the parameters and parameter values with the same parameter type into a one-dimensional data set to obtain a one-dimensional data set of the parameters, wherein the number of the one-dimensional data sets is the same as that of the parameter types;
s1022: scanning abnormal data sets of the service, respectively calculating the support degree of each parameter in the current one-dimensional data set aiming at each one-dimensional data set, pruning all the one-dimensional data sets to reserve the parameters of which the support degree in each one-dimensional data set meets the support degree threshold value, and forming frequent 1 item set L1 for each reserved one-dimensional data set;
s1023: scanning a frequent 1 item set L1, combining and splicing every K one-dimensional data sets in the frequent 1 item set L1, combining parameters in each one-dimensional data set aiming at the K one-dimensional data sets combined together to generate a plurality of K-dimensional data, and forming a set from all the K-dimensional data to obtain a candidate K item set CK; aiming at the candidate K item set CK, keeping K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'; scanning an abnormal data set of the service, calculating the support degree of a combination parameter corresponding to each K-dimensional data aiming at each K-dimensional data in the purified candidate K item set CK', pruning each K-dimensional data to reserve the K-dimensional data of which the support degree of the combination parameter meets a support degree threshold value, and forming each reserved K-dimensional data into a frequent K item set LK; each K-dimensional data is formed by combining K parameters, the parameters of the K-dimensional data are called combined parameters, and K is more than or equal to 2;
a cycle of splicing and pruning is formed from the step of assigning 2 to K to the step of forming the frequent 2 item set L2; continuing to cycle the K assignment, wherein the increment interval of the K assignment is 1;
s1024: when the frequent K item set LK cannot be generated, the frequent K-1 item set LK-1 is the maximum frequent item set; and determining the parameters in the maximum frequent item set as abnormal parameters, and taking the abnormal parameters as abnormal root factors of the service.
Preferably, the method further comprises the following steps:
setting the attributes of the frequent item set, wherein the attributes of the frequent item set comprise: non-empty subsets of the frequent item set are frequent and a parent set of any non-frequent item set is infrequent;
in step 1023, for the candidate K item set CK, the K-dimensional data of the subset in the frequent K-1 item set LK-1 is retained to obtain a clean candidate K item set CK', which specifically includes:
according to the attribute that a non-empty subset of a frequent item set is frequent and a parent set of any non-frequent item set is infrequent, after a candidate K item set CK is generated from a frequent K-1 item set LK-1, rechecking the candidate K item set CK;
and during rechecking, judging whether each subset of each K-dimensional data in the candidate K item set CK is in the frequent K-1 item set LK-1, deleting the K-dimensional data of the subset in the candidate K item set CK when a subset is not in the frequent K-1 item set LK-1, and reserving the K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'.
Preferably, the method comprises the following steps:
the support degree of the parameters is as follows: the ratio of the parameter value to the sum of the abnormal values of all the data in the abnormal data set; when the same parameter corresponds to a plurality of parameter values, the parameter value is the sum of the plurality of parameter values; or
The support degree of the parameters is as follows: combining the ratio of the parameter values to the sum of the outliers of all the data in the outlier data set; wherein, the combined parameter value refers to the sum of all parameter values in the combined parameter.
Preferably, the failure to generate the frequent K term set LK means: the cleaning candidate K item set CK' is empty; or the generated frequent K term set LK is empty.
As shown in fig. 2, in accordance with an embodiment of the present invention, there is provided a root cause positioning apparatus, including:
the data collection module 21 is configured to collect each piece of abnormal data generated by the background during the service operation, and form the collected abnormal data into an abnormal data set of the service;
a root cause positioning module 22, configured to analyze the abnormal data set of the service based on an improved Apriori algorithm, determine an abnormal parameter through calculation of a support degree of a parameter in the abnormal data set of the service, and use the abnormal parameter as an abnormal root cause of the service; wherein the support of the parameter is used for representing the value proportion of the parameter value in the abnormal data set.
Preferably, each anomaly data includes: abnormal values, parameters and parameter values of the data itself;
the root cause location module 22 includes:
the data classification submodule 221 is configured to extract parameters and parameter values in each abnormal data, and unify the parameters and parameter values with the same parameter type into a one-dimensional data set to obtain a one-dimensional data set of the parameters, where the number of the one-dimensional data sets is the same as the number of the parameter types;
the first frequent item set generation submodule 222 is configured to scan an abnormal data set of the service, calculate, for each one-dimensional data set, a support degree of each parameter in the current one-dimensional data set, reserve a parameter, of which the support degree meets a support degree threshold, in each one-dimensional data set by pruning all the one-dimensional data sets, and form frequent 1 item sets L1 for each retained one-dimensional data set;
a frequent item set incremental generation submodule 223, configured to scan a frequent 1 item set L1, combine and splice every K one-dimensional data sets in the frequent 1 item set L1, combine the K one-dimensional data sets together, combine parameters in each one-dimensional data set to generate multiple K-dimensional data, and form a set from all the K-dimensional data to obtain a candidate K item set CK; aiming at the candidate K item set CK, keeping K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'; scanning an abnormal data set of the service, calculating the support degree of a combination parameter corresponding to each K-dimensional data aiming at each K-dimensional data in the purified candidate K item set CK', pruning each K-dimensional data to reserve the K-dimensional data of which the support degree of the combination parameter meets a support degree threshold value, and forming each reserved K-dimensional data into a frequent K item set LK; each K-dimensional data is formed by combining K parameters, the parameters of the K-dimensional data are called combined parameters, and K is more than or equal to 2;
a cycle of splicing and pruning is formed from the step of assigning 2 to K to the step of forming the frequent 2 item set L2; continuing to cycle the K assignment, wherein the increment interval of the K assignment is 1;
the root cause judgment submodule 224 is used for taking the frequent K-1 item set LK-1 as the maximum frequent item set when the frequent K item set LK cannot be generated; and determining the parameters in the maximum frequent item set as abnormal parameters, and taking the abnormal parameters as abnormal root factors of the service.
Preferably, an attribute configuration module 23 is further included, wherein:
a property configuration module 23, configured to set properties of a frequent item set, where the properties of the frequent item set include: non-empty subsets of the frequent item set are frequent and a parent set of any non-frequent item set is infrequent;
the frequent item set incremental generation sub-module 223 is specifically configured to, when generating a purified candidate K item set CK' for a candidate K item set CK, recheck the candidate K item set CK after generating the candidate K item set CK from the frequent K-1 item set LK-1 according to an attribute that a non-empty subset of the frequent item set is frequent and a parent set of any non-frequent item set is infrequent;
and during rechecking, judging whether each subset of each K-dimensional data in the candidate K item set CK is in the frequent K-1 item set LK-1, deleting the K-dimensional data of the subset in the candidate K item set CK when a subset is not in the frequent K-1 item set LK-1, and reserving the K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'.
Preferably, the support degree of the parameters refers to: the ratio of the parameter value to the sum of the abnormal values of all the data in the abnormal data set; when the same parameter corresponds to a plurality of parameter values, the parameter value is the sum of the plurality of parameter values; or
The support degree of the parameters is as follows: combining the ratio of the parameter values to the sum of the outliers of all the data in the outlier data set; wherein, the combined parameter value refers to the sum of all parameter values in the combined parameter.
Preferably, the failure to generate the frequent K term set LK means: the cleaning candidate K item set CK' is empty; or the generated frequent K term set LK is empty.
The beneficial effects obtained by the invention are as follows:
the Apriori algorithm is applied to mining of association rules, calculation of support degrees in the Apriori algorithm is redefined, root causes are analyzed through proportion, and the Apriori algorithm support degrees are innovatively modified to analyze the root causes. The method replaces the process of root cause analysis in the traditional manual calculation method, and realizes the automation of the root cause analysis. In the process of splicing the Apriori algorithm to pruning, the judgment of the subsets is added according to the set 2 properties, the generation quantity of candidate sets is reduced, excessive scanning of a full set is avoided, IO (input/output) operation is reduced, the complexity of the algorithm is reduced, and the speed of the algorithm is increased.
The above technical solutions of the embodiments of the present invention are described in detail below with reference to specific application examples, and reference may be made to the foregoing related descriptions for technical details that are not described in the implementation process.
The invention relates to the field of data mining, in particular to root cause positioning of abnormal data, which is an application method based on an improved Apriori algorithm in a root cause positioning analysis scene. The method combines an Apriori algorithm, and can realize the rapid and accurate positioning of the root cause.
The invention realizes an accurate, rapid and automatic root cause analysis positioning method by improving the Apriori algorithm. The traditional manual work judges whether a certain value in a certain dimension is a main cause of an abnormal value by calculating the ratio of different values in the dimension to the abnormal value, if the ratio is larger than a certain threshold value, the certain value in the dimension is considered to be the main cause of the abnormal value, and then the same calculation is carried out on other dimensions on the basis until all the dimensions are calculated. Thus, the operations of the foregoing method may be implemented using Apriori's algorithm. Wherein:
apriori's algorithm is an algorithm commonly used to mine data association rules, and is used to find data sets that occur frequently in data values, and to find patterns of these sets to help make decisions. The frequent item set evaluation standard of the algorithm comprises support degree, confidence degree and promotion degree, and the support degree is selected as an evaluation index. The algorithm aims to find the largest frequent K item set, firstly, a candidate 1 item set is generated, the support degree of the 1 item set is calculated by scanning the full set, then, the frequent 1 item set is generated by pruning according to a support degree threshold value (removing unnecessary intermediate results), a candidate 2 item set is generated by self-connection of the frequent 1 item set, the support degree of the candidate 2 item set is calculated by scanning the full set again, then, the frequent 2 item set is generated by pruning the 2 item set according to the support degree threshold value, the steps of splicing and pruning are repeated until the support degree cannot be met or the candidate set cannot be generated, and finally, the largest frequent K item set and the dimension where the root cause is positioned are output.
Table 1 below is an example of exception data. If calculated according to the normal Apriori algorithm, assuming that the support degree is 1, the obtained frequent item set is: { Feature _1: a, Feature _2:3, and Feature _3: IOS }, however, it can be seen from the observation data that Feature _3 ═ unbnow is the main cause of abnormal data. Therefore, if the calculation is directly carried out according to the Apriori algorithm, the real influencing factors cannot be located.
TABLE 1 Exception data sample
| Feature_1 | Feature_2 | Feature_3 | Error_value |
| A | 3 | IOS | 10 |
| B | 2 | Android | 12 |
| T | 3 | unknow | 100 |
| A | 3 | IOS | 3 |
The invention modifies the support of Apriori algorithm into the ratio of parameter abnormal value in dimension to the sum of abnormal values (Error _ value), and a set calculated by aiming at the abnormal data sample of table 1 is shown in table 2. Wherein, Feature _1, Feature _2 and Feature _3, the parameters are: feature _1 is a server type, Feature _2 is a machine room type, Feature _3 is a user system, and Error _ value is an abnormal value of the data (namely the number of times of the abnormal data); the parameter value is the same as the abnormal value of the data itself of the abnormal data in which it is located. When the Apriori algorithm is applied, assuming that the support threshold is 10%, the obtained frequent item set is { Feature _1: T, Feature _2:3, Feature _3: unbnow }, so that the abnormality cause can be located.
TABLE 2 example of abnormal data support data
Therefore, when the Apriori algorithm is used in the root cause analysis to calculate the support degree, the weight value of the calculation object (the ratio of the dimension value to the abnormal value, which can also be expressed as the numerical ratio of the parameter value in the abnormal data set) can be converted, so that the cause can be accurately located. The method also conforms to the idea of finding the abnormal events in the actual service, and the frequently-occurring events are not required to be found, but the abnormal and sudden events are positioned.
Apriori algorithm principle is as follows:
assuming a data set D, the support threshold is a fixed value α.
D＝{Feature_1：[x1，x2，…，xn]，Feature_2：[y1，y2，…，yn]，…，error_value：[v1，v2，…，vn]}
α(XY)＝error_value(XY)/error_value(AllSamples)
Wherein Feature _1 and Feature _2 … Feature _ n are dimensions 1 to n, error _ value is an abnormal value, v is an abnormal value1，v2，…，vnThe values indicate abnormal values corresponding to Feature _1 and Feature _2 … Feature _ n, and α (XY) is the XY support.
Firstly, scanning a complete set D and pruning according to a support degree threshold value to obtain a frequent 1 item set L1:
L1＝{xi：α(xi)，yi：α(yi)，...}，i＝1，2，…n
wherein, α (x)i) Alpha and alpha (y)i)＞α。
After the frequent 1 item set L1 is obtained, a candidate 2 item set C2 is generated from L1, the full set D is scanned again, and the support of C2 is calculated. And pruning is carried out according to the support degree threshold value, so as to obtain a frequent 2 item set L2.
Candidate 2 item set C2: c2 ═ xiyJ：α(xiyJ)，...}，i＝1，2，…
Frequent 2 item set L2: l2 ═ { x ═ xiyJ：α(xiyJ)，...}，i＝1，2，…
Among them, L2 should satisfy α (x)i yJ)＞α。
After the frequent 2 item set L2 is obtained, a candidate 3 item set C3 is generated from L2, the full set D is scanned again, and the support of C3 is calculated. And pruning is carried out according to the support degree threshold value, and a frequent 3 item set L3 is obtained.
Candidate 3-item set C3: c3 ═ xiyJ：α(xiyJzk)，...}，i＝1，2，…；j＝1，2，…；k＝1，2，…
Frequent 3 item set L3: l3 ═ { x ═ xiyJ：α(xiyJzk)，...}，i＝1，2，…；j＝1，2，…；k＝1，2，…
Wherein the L3 is required to satisfy alpha (x)iyJzk)＞α。
And then the pruning-splicing process is circularly carried out all the time. Until the K frequent item sets cannot be generated, the K-1 frequent item set is the largest frequent item set to be found.
As described above, the association relationship between data can be calculated by Apriori algorithm, in practice, Apriori algorithm scans the corpus during each pruning process, and generates too many candidate sets, and if the data size is particularly large, IO is increased, thereby reducing the efficiency of the algorithm. In order to solve the whole problem, the property of Apriori algorithm can be utilized to reduce the size of the candidate set when generating the candidate set. Therefore, in the present invention, Apriori algorithm is improved, and properties of Apriori algorithm are set as follows:
(1) non-empty subsets of the frequent item set must be frequent.
(2) Any superset of the infrequent item set (i.e., the superset) must also be infrequent.
According to the properties (1) and (2), it is considered that when the candidate set Ck +1 is generated from the frequent K item set Lk, a determination is made as to whether all K item subsets of each set Ck +1 are in the Lk item set, if not, corresponding items are deleted from the candidate set Ck +1 (corresponding to the attribute that "a non-empty subset of a frequently occurring item set is frequent and a parent set of any non-frequently occurring item set is not frequent), a re-check is performed on the candidate K item set Ck after the candidate K item set Ck is generated from the frequent K-1 item set Lk-1; at the time of the re-check, it is determined whether each subset of each K dimensional data in the candidate K item set Ck is in the frequent K-1 item set-1, when a subset is not in the frequent K-1 item set Ck-1, K dimensional data of the subset is deleted within the candidate K item set Ck, K dimensional data of the subset within the frequent K-1 item set is retained, and a purified candidate K item set CK' ") is obtained, that is, the support degree of the set does not need to be calculated by scanning the complete set, so that the number of candidate sets can be reduced, the scanning of the complete set is also reduced, and the efficiency of the algorithm is finally improved.
Finally, the present invention achieves root cause analysis localization as shown in FIG. 3 below. Collecting each piece of abnormal data generated by a background during the operation of the service, and forming the collected abnormal data into an abnormal data set of the service; analyzing the abnormal data set of the service based on an improved Apriori algorithm, determining abnormal parameters by calculating the support degree of the parameters in the abnormal data set of the service, and taking the abnormal parameters as abnormal root factors of the service; wherein the support of the parameter is used for representing the value proportion of the parameter value in the abnormal data set. The specific process is as follows:
(1) and acquiring a data set D to be detected, and setting a support degree threshold value a. The data set D refers to abnormal data summarization in data recorded in a background when a certain service runs.
(2) And obtaining 1 candidate set C1, scanning a complete set, calculating the support degree of C1, and pruning according to the support degree to generate a frequent item set L1. Specifically, the abnormal data sets of the service are scanned, the support degree of each parameter in the current one-dimensional data set is calculated for each one-dimensional data set, parameters with the support degree meeting the support degree threshold value in each one-dimensional data set are reserved by pruning all the one-dimensional data sets, and the reserved one-dimensional data sets form a frequent 1 item set L1.
(3) Generating 2 candidate sets according to the frequent item set L1, judging whether the subset of the 2 candidate sets is in L1, deleting items which do not exist in L1 to obtain the 2 candidate sets after screening, scanning the full set again, calculating the support degree of C2, and generating the frequent item set L2 according to the support degree pruning.
(4) And (4) repeating the step (3).
The specific operations of the step (3) and the step (4) are as follows: scanning a frequent 1 item set L1, combining and splicing every K one-dimensional data sets in the frequent 1 item set L1, combining parameters in each one-dimensional data set aiming at the K one-dimensional data sets combined together to generate a plurality of K-dimensional data, and forming a set from all the K-dimensional data to obtain a candidate K item set CK; aiming at the candidate K item set CK, keeping K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'; scanning an abnormal data set of the service, calculating the support degree of a combination parameter corresponding to each K-dimensional data aiming at each K-dimensional data in the purified candidate K item set CK', pruning each K-dimensional data to reserve the K-dimensional data of which the support degree of the combination parameter meets a support degree threshold value, and forming each reserved K-dimensional data into a frequent K item set LK; each K-dimensional data is formed by combining K parameters, the parameters of the K-dimensional data are called combined parameters, and K is more than or equal to 2;
a cycle of splicing and pruning is formed from the step of assigning 2 to K to the step of forming the frequent 2 item set L2; and continuing to cycle the K assignment, wherein the increment interval of the K assignment is 1.
Wherein: the support degree of the parameters is as follows: the ratio of the parameter value to the sum of the abnormal values of all the data in the abnormal data set; when the same parameter corresponds to a plurality of parameter values, the parameter value is the sum of the plurality of parameter values.
The support degree of the parameters is as follows: combining the ratio of the parameter values to the sum of the outliers of all the data in the outlier data set; wherein, the combined parameter value refers to the sum of all parameter values in the combined parameter.
(5) Until the frequent item set cannot be generated, the last frequent K item set is the maximum K item set, namely the positioning reason of the algorithm. Specifically, when the frequent K item set LK cannot be generated, the frequent K-1 item set LK-1 is the maximum frequent item set; and determining the parameters in the maximum frequent item set as abnormal parameters, and taking the abnormal parameters as abnormal root factors of the service. Wherein, the failure to generate the frequent K item set LK means: the cleaning candidate K item set CK' is empty; or the generated frequent K term set LK is empty.
The beneficial effects obtained by the invention are as follows:
the Apriori algorithm is applied to mining of association rules, calculation of support degrees in the Apriori algorithm is redefined, root causes are analyzed through proportion, and the Apriori algorithm support degrees are innovatively modified to analyze the root causes. The method replaces the process of root cause analysis in the traditional manual calculation method, and realizes the automation of the root cause analysis. In the process of splicing the Apriori algorithm to pruning, the judgment of the subsets is added according to the set 2 properties, the generation quantity of candidate sets is reduced, excessive scanning of a full set is avoided, IO (input/output) operation is reduced, the complexity of the algorithm is reduced, and the speed of the algorithm is increased. It is not necessary to find frequently occurring events, but rather to locate the abnormally mutated event.
The invention realizes the application in the scene of root cause analysis through the improved Apriori algorithm, and the calculation method of the support degree is modified to make the method accord with the corresponding service scene. The method has higher phase rate compared with the traditional method which still identifies.
The number of candidate sets is reduced by the Apriori algorithm, the complexity of the algorithm is reduced, and the root cause is positioned more quickly by the algorithm.
The method can be widely applied to the root cause judgment of any abnormal data, solves the problem that the root causes of the abnormal data of newly added services and indexes cannot be analyzed and positioned depending on expert experience, and has universal applicability.
The judgment of a decision tree algorithm is avoided, and the model is trained according to the existing positive and negative sample data. However, the abnormal data is often less, which causes the problem of imbalance between positive and negative samples, resulting in poor algorithm performance and being unable to be applied to actual service scenarios ".
It should be understood that the specific order or hierarchy of steps in the processes disclosed is an example of exemplary approaches. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the processes may be rearranged without departing from the scope of the present disclosure. The accompanying method claims present elements of the various steps in a sample order, and are not intended to be limited to the specific order or hierarchy presented.
In the foregoing detailed description, various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments of the subject matter require more features than are expressly recited in each claim. Rather, as the following claims reflect, invention lies in less than all features of a single disclosed embodiment. Thus, the following claims are hereby expressly incorporated into the detailed description, with each claim standing on its own as a separate preferred embodiment of the invention.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. To those skilled in the art; various modifications to these embodiments will be readily apparent, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the disclosure. Thus, the present disclosure is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
What has been described above includes examples of one or more embodiments. It is, of course, not possible to describe every conceivable combination of components or methodologies for purposes of describing the aforementioned embodiments, but one of ordinary skill in the art may recognize that many further combinations and permutations of various embodiments are possible. Accordingly, the embodiments described herein are intended to embrace all such alterations, modifications and variations that fall within the scope of the appended claims. Furthermore, to the extent that the term "includes" is used in either the detailed description or the claims, such term is intended to be inclusive in a manner similar to the term "comprising" as "comprising" is interpreted when employed as a transitional word in a claim. Furthermore, any use of the term "or" in the specification of the claims is intended to mean a "non-exclusive or".
Those of skill in the art will further appreciate that the various illustrative logical blocks, units, and steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate the interchangeability of hardware and software, various illustrative components, elements, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design requirements of the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present embodiments.
The various illustrative logical blocks, or elements, described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor, an Application Specific Integrated Circuit (ASIC), a field programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. For example, a storage medium may be coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC, which may be located in a user terminal. In the alternative, the processor and the storage medium may reside in different components in a user terminal.
In one or more exemplary designs, the functions described above in connection with the embodiments of the invention may be implemented in hardware, software, firmware, or any combination of the three. If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media that facilitate transfer of a computer program from one place to another. Storage media may be any available media that can be accessed by a general purpose or special purpose computer. For example, such computer-readable media can include, but is not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to carry or store program code in the form of instructions or data structures and which can be read by a general-purpose or special-purpose computer, or a general-purpose or special-purpose processor. Additionally, any connection is properly termed a computer-readable medium, and, thus, is included if the software is transmitted from a website, server, or other remote source via a coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL), or wirelessly, e.g., infrared, radio, and microwave. Such discs (disk) and disks (disc) include compact disks, laser disks, optical disks, DVDs, floppy disks and blu-ray disks where disks usually reproduce data magnetically, while disks usually reproduce data optically with lasers. Combinations of the above may also be included in the computer-readable medium.
The above-mentioned embodiments are intended to illustrate the objects, technical solutions and advantages of the present invention in further detail, and it should be understood that the above-mentioned embodiments are merely exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made within the spirit and principle of the present invention should be included in the scope of the present invention.
Claims (10)
1. A method for root cause location, comprising:
collecting each piece of abnormal data generated by a background during the operation of the service, and forming the collected abnormal data into an abnormal data set of the service;
analyzing the abnormal data set of the service based on an improved Apriori algorithm, determining abnormal parameters by calculating the support degree of the parameters in the abnormal data set of the service, and taking the abnormal parameters as abnormal root factors of the service; wherein the support of the parameter is used for representing the value proportion of the parameter value in the abnormal data set.
2. The root cause localization method according to claim 1, wherein each piece of anomaly data includes: abnormal values, parameters and parameter values of the data itself;
the analyzing an abnormal data set of the service based on the improved Apriori algorithm, determining an abnormal parameter by calculating a support degree of a parameter in the abnormal data set of the service, and taking the abnormal parameter as an abnormal root factor of the service specifically includes:
extracting parameters and parameter values in each abnormal data, and unifying the parameters and parameter values with the same parameter type into a one-dimensional data set to obtain a one-dimensional data set of the parameters, wherein the number of the one-dimensional data sets is the same as that of the parameter types;
scanning abnormal data sets of the service, respectively calculating the support degree of each parameter in the current one-dimensional data set aiming at each one-dimensional data set, pruning all the one-dimensional data sets to reserve the parameters of which the support degree in each one-dimensional data set meets the support degree threshold value, and forming frequent 1 item set L1 for each reserved one-dimensional data set;
scanning a frequent 1 item set L1, combining and splicing every K one-dimensional data sets in the frequent 1 item set L1, combining parameters in each one-dimensional data set aiming at the K one-dimensional data sets combined together to generate a plurality of K-dimensional data, and forming a set from all the K-dimensional data to obtain a candidate K item set CK; aiming at the candidate K item set CK, keeping K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'; scanning an abnormal data set of the service, calculating the support degree of a combination parameter corresponding to each K-dimensional data aiming at each K-dimensional data in the purified candidate K item set CK', pruning each K-dimensional data to reserve the K-dimensional data of which the support degree of the combination parameter meets a support degree threshold value, and forming each reserved K-dimensional data into a frequent K item set LK; each K-dimensional data is formed by combining K parameters, the parameters of the K-dimensional data are called combined parameters, and K is more than or equal to 2;
a cycle of splicing and pruning is formed from the step of assigning 2 to K to the step of forming the frequent 2 item set L2; continuing to cycle the K assignment, wherein the increment interval of the K assignment is 1;
when the frequent K item set LK cannot be generated, the frequent K-1 item set LK-1 is the maximum frequent item set; and determining the parameters in the maximum frequent item set as abnormal parameters, and taking the abnormal parameters as abnormal root factors of the service.
3. The root cause positioning method according to claim 2, further comprising:
setting the attributes of the frequent item set, wherein the attributes of the frequent item set comprise: non-empty subsets of the frequent item set are frequent and a parent set of any non-frequent item set is infrequent;
the method for obtaining the purified candidate K item set CK' by keeping the K-dimensional data of the subset in the frequent K-1 item set LK-1 for the candidate K item set CK specifically includes:
according to the attribute that a non-empty subset of a frequent item set is frequent and a parent set of any non-frequent item set is infrequent, after a candidate K item set CK is generated from a frequent K-1 item set LK-1, rechecking the candidate K item set CK;
and during rechecking, judging whether each subset of each K-dimensional data in the candidate K item set CK is in the frequent K-1 item set LK-1, deleting the K-dimensional data of the subset in the candidate K item set CK when a subset is not in the frequent K-1 item set LK-1, and reserving the K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'.
4. The root cause positioning method according to claim 2, comprising:
the support degree of the parameters is as follows: the ratio of the parameter value to the sum of the abnormal values of all the data in the abnormal data set; when the same parameter corresponds to a plurality of parameter values, the parameter value is the sum of the plurality of parameter values; or
The support degree of the parameters is as follows: combining the ratio of the parameter values to the sum of the outliers of all the data in the outlier data set; wherein, the combined parameter value refers to the sum of all parameter values in the combined parameter.
5. The root cause positioning method according to claim 3, wherein the failure to generate the frequent K term set LK is: the cleaning candidate K item set CK' is empty; or the generated frequent K term set LK is empty.
6. A root cause positioning device, comprising:
the data collection module is used for collecting each piece of abnormal data generated by the background during the operation of the service and forming the collected abnormal data into an abnormal data set of the service;
a root cause positioning module for analyzing the abnormal data set of the service based on the improved Apriori algorithm, determining abnormal parameters by calculating the support degree of the parameters in the abnormal data set of the service, and taking the abnormal parameters as the abnormal root cause of the service; wherein the support of the parameter is used for representing the value proportion of the parameter value in the abnormal data set.
7. The root cause location device of claim 6, wherein each anomaly data comprises: abnormal values, parameters and parameter values of the data itself;
the root cause location module includes:
the data classification submodule is used for extracting each parameter and parameter value in each abnormal data, unifying the parameters and parameter values with the same parameter type into a one-dimensional data set and obtaining a one-dimensional data set of the parameters, wherein the number of the one-dimensional data sets is the same as that of the parameter types;
the first frequent item set generation submodule is used for scanning the abnormal data set of the service, respectively calculating the support degree of each parameter in the current one-dimensional data set aiming at each one-dimensional data set, reserving the parameters of which the support degree meets the support degree threshold value in each one-dimensional data set by pruning all the one-dimensional data sets, and forming the reserved one-dimensional data sets into frequent 1 item sets L1;
the frequent item set incremental generation submodule is used for scanning a frequent 1 item set L1, combining and splicing every K one-dimensional data sets in a frequent 1 item set L1, combining and splicing the K one-dimensional data sets, taking parameters in each one-dimensional data set to generate a plurality of K-dimensional data aiming at the K one-dimensional data sets combined together, and forming a set from all the K-dimensional data to obtain a candidate K item set CK; aiming at the candidate K item set CK, keeping K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'; scanning an abnormal data set of the service, calculating the support degree of a combination parameter corresponding to each K-dimensional data aiming at each K-dimensional data in the purified candidate K item set CK', pruning each K-dimensional data to reserve the K-dimensional data of which the support degree of the combination parameter meets a support degree threshold value, and forming each reserved K-dimensional data into a frequent K item set LK; each K-dimensional data is formed by combining K parameters, the parameters of the K-dimensional data are called combined parameters, and K is more than or equal to 2;
a cycle of splicing and pruning is formed from the step of assigning 2 to K to the step of forming the frequent 2 item set L2; continuing to cycle the K assignment, wherein the increment interval of the K assignment is 1;
the root cause judgment submodule is used for taking the frequent K-1 item set LK-1 as the maximum frequent item set when the frequent K item set LK cannot be generated; and determining the parameters in the maximum frequent item set as abnormal parameters, and taking the abnormal parameters as abnormal root factors of the service.
8. The root cause location device of claim 7, further comprising an attribute configuration module, wherein:
the attribute configuration module is used for setting the attributes of the frequent item set, and the attributes of the frequent item set comprise: non-empty subsets of the frequent item set are frequent and a parent set of any non-frequent item set is infrequent;
the frequent item set incremental generation submodule is specifically used for rechecking the candidate K item set CK after the candidate K item set CK is generated from the frequent K-1 item set LK-1 according to the properties that a non-empty subset of the frequent item set is frequent and a parent set of any non-frequent item set is infrequent when the purified candidate K item set CK' is generated for the candidate K item set CK; and during rechecking, judging whether each subset of each K-dimensional data in the candidate K item set CK is in the frequent K-1 item set LK-1, deleting the K-dimensional data of the subset in the candidate K item set CK when a subset is not in the frequent K-1 item set LK-1, and reserving the K-dimensional data of the subset in the frequent K-1 item set LK-1 to obtain a purified candidate K item set CK'.
9. The root cause positioning device of claim 7,
the support degree of the parameters is as follows: the ratio of the parameter value to the sum of the abnormal values of all the data in the abnormal data set; when the same parameter corresponds to a plurality of parameter values, the parameter value is the sum of the plurality of parameter values; or
The support degree of the parameters is as follows: combining the ratio of the parameter values to the sum of the outliers of all the data in the outlier data set; wherein, the combined parameter value refers to the sum of all parameter values in the combined parameter.
10. The root cause locating device according to claim 8, wherein the failure to generate the frequent K term set LK is: the cleaning candidate K item set CK' is empty; or the generated frequent K term set LK is empty.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110672278.3A CN113448761A (en) | 2021-06-17 | 2021-06-17 | Root cause positioning method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110672278.3A CN113448761A (en) | 2021-06-17 | 2021-06-17 | Root cause positioning method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113448761A true CN113448761A (en) | 2021-09-28 |
Family
ID=77811562
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110672278.3A Pending CN113448761A (en) | 2021-06-17 | 2021-06-17 | Root cause positioning method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113448761A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115756919A (en) * | 2022-11-10 | 2023-03-07 | 上海鼎茂信息技术有限公司 | Root cause positioning method and system for multidimensional data |
| CN116757462A (en) * | 2023-06-21 | 2023-09-15 | 国网浙江省电力有限公司宁波供电公司 | Abnormal data monitoring method based on engineering data analysis model |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180060150A1 (en) * | 2016-08-26 | 2018-03-01 | International Business Machines Corporation | Root cause analysis |
| CN109767617A (en) * | 2018-12-20 | 2019-05-17 | 北京航空航天大学 | A kind of public security traffic control service exception data analysis method based on Apriori |
| CN111444247A (en) * | 2020-06-17 | 2020-07-24 | 北京必示科技有限公司 | KPI (Key performance indicator) -based root cause positioning method and device and storage medium |
| CN111552684A (en) * | 2020-04-29 | 2020-08-18 | 腾讯科技（深圳）有限公司 | Abnormal data positioning method and device, computer equipment and storage medium |
| CN111858245A (en) * | 2020-07-17 | 2020-10-30 | 北京奇艺世纪科技有限公司 | Abnormal data analysis method and device, electronic equipment and storage medium |
-
2021
- 2021-06-17 CN CN202110672278.3A patent/CN113448761A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20180060150A1 (en) * | 2016-08-26 | 2018-03-01 | International Business Machines Corporation | Root cause analysis |
| CN109767617A (en) * | 2018-12-20 | 2019-05-17 | 北京航空航天大学 | A kind of public security traffic control service exception data analysis method based on Apriori |
| CN111552684A (en) * | 2020-04-29 | 2020-08-18 | 腾讯科技（深圳）有限公司 | Abnormal data positioning method and device, computer equipment and storage medium |
| CN111444247A (en) * | 2020-06-17 | 2020-07-24 | 北京必示科技有限公司 | KPI (Key performance indicator) -based root cause positioning method and device and storage medium |
| CN111858245A (en) * | 2020-07-17 | 2020-10-30 | 北京奇艺世纪科技有限公司 | Abnormal data analysis method and device, electronic equipment and storage medium |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115756919A (en) * | 2022-11-10 | 2023-03-07 | 上海鼎茂信息技术有限公司 | Root cause positioning method and system for multidimensional data |
| CN115756919B (en) * | 2022-11-10 | 2023-10-31 | 上海鼎茂信息技术有限公司 | Root cause positioning method and system for multidimensional data |
| CN116757462A (en) * | 2023-06-21 | 2023-09-15 | 国网浙江省电力有限公司宁波供电公司 | Abnormal data monitoring method based on engineering data analysis model |
| CN116757462B (en) * | 2023-06-21 | 2023-11-28 | 国网浙江省电力有限公司宁波供电公司 | Abnormal data monitoring method based on engineering data analysis model |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Chou et al. | DNA sequence quality trimming and vector removal | |
| CN113448761A (en) | Root cause positioning method and device | |
| CN111339129B (en) | Remote meter reading abnormity monitoring method and device, gas meter system and cloud server | |
| US20050256788A1 (en) | Apparatus and method for tracking products | |
| CN108763420B (en) | Data object classification method, device, terminal and computer-readable storage medium | |
| CN107016018B (en) | Database index creation method and device | |
| CN107153652B (en) | Method and device for converting target character string into normalized character string | |
| CN105446705A (en) | Method and device used for determining configuration file feature | |
| CN116185758A (en) | Alarm data convergence method based on sliding window and association rule analysis | |
| CN112783749A (en) | Static code scanning optimization method and device, electronic equipment and storage medium | |
| CN111324781A (en) | Data analysis method, device and equipment | |
| CN110795614A (en) | Index automatic optimization method and device | |
| WO2024067358A1 (en) | Efficiency analysis method and system for warehouse management system, and computer device | |
| CN111966339B (en) | Buried point parameter input method and device, computer equipment and storage medium | |
| CN104794234A (en) | Data processing method and device for benchmarking | |
| CN111427875B (en) | Sampling method, system and storage medium for data quality detection | |
| CN109634845B (en) | Method and device for generating context record text | |
| CN114325232B (en) | Fault positioning method and device | |
| JP5940018B2 (en) | Data name extraction device and program | |
| KR20160120361A (en) | method and apparatus of distinguishing type of dust | |
| CN111130921B (en) | Method and device for processing performance index of core network element | |
| CN109993193B (en) | Method and device for identifying key points of three-dimensional curve | |
| CN112783751A (en) | Incremental code scanning method and device, electronic equipment and storage medium | |
| CN111353860A (en) | Product information pushing method and system | |
| CN116757334B (en) | Financial data processing method, system, readable storage medium and computer |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20230423 Address after: Room 501-502, 5/F, Sina Headquarters Scientific Research Building, Block N-1 and N-2, Zhongguancun Software Park, Dongbei Wangxi Road, Haidian District, Beijing, 100193 Applicant after: Sina Technology (China) Co.,Ltd. Address before: 100193 7th floor, scientific research building, Sina headquarters, plot n-1, n-2, Zhongguancun Software Park, Dongbei Wangxi Road, Haidian District, Beijing, 100193 Applicant before: Sina.com Technology (China) Co.,Ltd. |