CN113723956A - Abnormity monitoring method, device, equipment and storage medium - Google Patents
Abnormity monitoring method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN113723956A CN113723956A CN202110907896.1A CN202110907896A CN113723956A CN 113723956 A CN113723956 A CN 113723956A CN 202110907896 A CN202110907896 A CN 202110907896A CN 113723956 A CN113723956 A CN 113723956A
- Authority
- CN
- China
- Prior art keywords
- success rate
- transaction
- historical
- time period
- threshold
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012544 monitoring process Methods 0.000 title claims abstract description 234
- 238000000034 method Methods 0.000 title claims abstract description 60
- 238000012549 training Methods 0.000 claims abstract description 23
- 238000012806 monitoring device Methods 0.000 claims abstract description 6
- 230000002159 abnormal effect Effects 0.000 claims description 56
- 238000012937 correction Methods 0.000 claims description 41
- 238000004422 calculation algorithm Methods 0.000 claims description 27
- 238000004590 computer program Methods 0.000 claims description 25
- 230000006870 function Effects 0.000 claims description 9
- 238000004364 calculation method Methods 0.000 claims description 8
- 230000005856 abnormality Effects 0.000 description 13
- 230000008569 process Effects 0.000 description 8
- 238000010586 diagram Methods 0.000 description 5
- 230000000694 effects Effects 0.000 description 3
- 238000000605 extraction Methods 0.000 description 3
- 238000007781 pre-processing Methods 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 2
- 230000001360 synchronised effect Effects 0.000 description 2
- 230000002123 temporal effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 238000006243 chemical reaction Methods 0.000 description 1
- 238000004140 cleaning Methods 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 238000007637 random forest analysis Methods 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000011144 upstream manufacturing Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/389—Keeping log of transactions for guaranteeing non-repudiation of a transaction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/302—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a software system
Abstract
The application relates to an anomaly monitoring method, an anomaly monitoring device, anomaly monitoring equipment and a storage medium, wherein the method comprises the following steps: acquiring the transaction success rate of the service transaction system in a monitoring time period according to the transaction log of the service transaction system; acquiring time characteristics corresponding to the monitoring time period, and inputting the time characteristics into a preset threshold prediction model to obtain a success rate threshold corresponding to the monitoring time period; the threshold prediction model is obtained by training by adopting a transaction sample; the transaction sample comprises the historical transaction success rate of the service transaction system in the historical monitoring time period and the historical time characteristic corresponding to the historical monitoring time period; and determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold. The technical scheme provided by the embodiment of the application can improve the monitoring accuracy of the abnormity of the service system.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to an anomaly monitoring method, an anomaly monitoring device, an anomaly monitoring apparatus, and a storage medium.
Background
The business transaction system is an information technology system for providing services for transacting various businesses for users, and the normal operation of the business transaction system is the basis for the normal development of various businesses. Whether the business transaction system normally operates or not is mainly reflected in whether the transaction success rate of the business transaction system is within a normal numerical range or not, and on the basis, in order to ensure the normal operation of the business transaction system, the abnormity of the business transaction system needs to be monitored in real time according to the transaction success rate.
In the conventional method, when the abnormality of the service transaction system is monitored in real time based on the transaction success rate, the service monitoring system can acquire the transaction success rate of the service transaction system, compare the transaction success rate with a fixed monitoring threshold value, and determine whether the service transaction system operates abnormally according to the comparison result.
However, since the service features of the service transaction system at different time periods are different, the fixed monitoring threshold is used as a criterion for judging whether the service transaction system is abnormal, so that a misjudgment situation may occur, and the accuracy of monitoring the abnormality of the service system is poor.
Disclosure of Invention
Based on this, the embodiment of the application provides an anomaly monitoring method, an anomaly monitoring device, equipment and a storage medium, which can improve the monitoring accuracy of the anomaly of a service system.
In a first aspect, an anomaly monitoring method is provided, and the method includes:
acquiring the transaction success rate of the service transaction system in a monitoring time period according to the transaction log of the service transaction system; acquiring time characteristics corresponding to the monitoring time period, and inputting the time characteristics into a preset threshold prediction model to obtain a success rate threshold corresponding to the monitoring time period; the threshold prediction model is obtained by training by adopting a transaction sample; the transaction sample comprises the historical transaction success rate of the service transaction system in the historical monitoring time period and the historical time characteristic corresponding to the historical monitoring time period; and determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold.
In one embodiment, the method further includes:
acquiring historical time characteristics corresponding to historical monitoring time periods; determining a sample threshold corresponding to a historical monitoring time period according to the historical transaction success rate; and training the initial threshold prediction model according to a preset loss function to obtain the threshold prediction model.
In one embodiment, determining a sample threshold corresponding to a historical monitoring time period according to a historical transaction success rate includes:
determining whether the service transaction system is judged to be abnormal in operation state at the historical monitoring moment according to the historical abnormal monitoring result; and if not, inputting the historical transaction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
In one embodiment, the method further includes:
if the service transaction system is judged to be abnormal in operation state at the historical monitoring time, correcting the transaction sample to obtain the correction success rate of the historical monitoring time period; and inputting the correction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
In one embodiment, the success rate threshold includes a success rate threshold upper limit and a success rate threshold lower limit, and the correcting the transaction sample to obtain the correction success rate of the historical monitoring time period includes:
acquiring a success rate threshold upper limit and a success rate threshold lower limit adopted by a monitoring system when abnormal monitoring is carried out in a historical monitoring time period; determining a correction success rate according to the success rate threshold upper limit and the success rate threshold lower limit; the correction success rate is a value between the upper limit of the success rate threshold and the lower limit of the success rate threshold.
In one embodiment, the time characteristic includes at least one of a periodicity characteristic, a holiday characteristic, and a date-specific characteristic.
In one embodiment, the method further includes:
and if the running states of the business transaction system in the continuous preset number of monitoring time periods are all abnormal, sending a system abnormal alarm.
In a second aspect, there is provided an anomaly monitoring apparatus, comprising:
the first acquisition module is used for acquiring the transaction success rate of the business transaction system in a monitoring time period according to the transaction log of the business transaction system;
the first calculation module is used for acquiring time characteristics corresponding to the monitoring time period, inputting the time characteristics into a preset threshold prediction model and acquiring a success rate threshold corresponding to the monitoring time period; the threshold prediction model is obtained by training by adopting a transaction sample; the transaction sample comprises the historical transaction success rate of the service transaction system in the historical monitoring time period and the historical time characteristic corresponding to the historical monitoring time period;
and the first determining module is used for determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold.
In a third aspect, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, the computer program, when executed by the processor, implementing the method steps in any of the embodiments of the first aspect.
In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, which computer program, when being executed by a processor, is adapted to carry out the method steps of any of the embodiments of the first aspect described above.
According to the abnormity monitoring method, the abnormity monitoring device, the abnormity monitoring equipment and the storage medium, the transaction success rate of the business transaction system in the monitoring time period is obtained according to the transaction log of the business transaction system; acquiring time characteristics corresponding to the monitoring time period, and inputting the time characteristics into a preset threshold prediction model to obtain a success rate threshold corresponding to the monitoring time period; and determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold. In the technical scheme provided by the embodiment of the application, compared with the traditional method, the set success rate threshold can comprise the upper success rate threshold and the lower success rate threshold, so that corresponding monitoring intervals can be formed according to the service characteristics of the service transaction system in different time periods, and the abnormity of the service transaction system is monitored according to the comparison result of the transaction success rate and the success rate threshold, so that the abnormity monitoring accuracy of the service system is improved.
Drawings
FIG. 1 is a block diagram of a computer device provided by an embodiment of the present application;
fig. 2 is a flowchart of an anomaly monitoring method according to an embodiment of the present application;
fig. 3 is a flowchart of a method for generating a threshold prediction model according to an embodiment of the present application;
fig. 4 is a flowchart for obtaining a sample threshold according to an embodiment of the present application;
fig. 5 is a flowchart of another method for obtaining a sample threshold according to an embodiment of the present disclosure;
fig. 6 is a flowchart of generating a correction success rate according to an embodiment of the present disclosure;
fig. 7 is a flowchart of an anomaly monitoring method according to an embodiment of the present application;
fig. 8 is a block diagram of an abnormality monitoring apparatus according to an embodiment of the present application.
Detailed Description
To make the objects, technical solutions and advantages of the present application more clear, embodiments of the present application will be described in further detail below with reference to the accompanying drawings.
The anomaly monitoring method provided by the application can be applied to computer equipment, the computer equipment can be a server or a terminal, the server can be a server or a server cluster consisting of a plurality of servers, the anomaly monitoring method is not particularly limited in this embodiment, and the terminal can be but is not limited to various personal computers, notebook computers, smart phones, tablet computers and portable wearable equipment.
Taking the example of a computer device being a server, FIG. 1 shows a block diagram of a server, which may include a processor and memory connected by a system bus, as shown in FIG. 1. Wherein the processor of the server is configured to provide computing and control capabilities. The memory of the server comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The computer program is executed by a processor to implement an anomaly monitoring method.
Those skilled in the art will appreciate that the architecture shown in fig. 1 is a block diagram of only a portion of the architecture associated with the subject application, and does not constitute a limitation on the servers to which the subject application applies, and that servers may alternatively include more or fewer components than those shown, or combine certain components, or have a different arrangement of components.
It should be noted that the execution subject of the embodiment of the present application may be a computer device, or may be an abnormality monitoring apparatus, and the following method embodiment is described with reference to a computer device as an execution subject.
In one embodiment, as shown in fig. 2, a flowchart of an anomaly monitoring method provided by an embodiment of the present application is shown, and the method may include the following steps:
and step 220, acquiring the transaction success rate of the business transaction system in the monitoring time period according to the transaction log of the business transaction system.
The transaction log is a record of the business transaction system on all transaction events, and can be acquired through the transaction log of the business transaction system when the transaction success rate of the business transaction system in a monitoring time period is acquired. The transaction log may include transaction request information and transaction return information, the transaction request information may include transaction time, transaction name or transaction code, and the transaction return information may include transaction success or transaction failure information, serial number, response time, upstream and downstream channels, and the like. The transaction request information and the transaction return information can be output to the transaction log according to a fixed format by presetting a transaction log buried point, then the transaction log is collected uniformly, and the information required for calculating the transaction success rate is extracted by adopting a regular expression field extraction algorithm. When extracting the information required for calculating the transaction success rate, other types of field extraction algorithms may also be used, which is not specifically limited in this embodiment.
The information required for calculating the transaction success rate can comprise transaction success or transaction failure information, transaction time, transaction name or transaction code, and the field information extracted from the transaction log is according to the transaction time, the transaction name or the transaction code and the likeThe information is aggregated, so that the transaction success rate grouped according to the transaction name or the transaction code in the monitoring time period can be calculated, and the transaction success rate grouped according to the transaction name or the transaction code in each monitoring time period in an acquisition period T can be obtained. During specific calculation, the total transaction request number of a certain transaction name or transaction code can be acquired as R for each monitoring time period T in the acquisition period TtThe request success number of the transaction name or the transaction code is StAnd calculating the transaction success rate Y of the monitoring time period ttComprises the following steps: y ist＝St/RtThen, for T e T, the transaction success rate set in the acquisition period T is { Y ∈ Tt1,Yt2,Yt3,......}。
The time characteristics are used for representing the time characteristics of the transaction success rate corresponding to the monitoring time period, and a time characteristic set F in the period T is collectedtIs { Ft1,Ft2,Ft3,.. }, the time characteristics may include a periodic characteristic, a holiday characteristic, a specific date characteristic, and the like, and may also include other time characteristics, for example, characteristics such as specific times of different transactions, and the like, which is not limited in this embodiment. After the time characteristics corresponding to the monitoring time period are obtained, the time characteristics can be input into a preset threshold prediction model, so that a success rate threshold corresponding to the monitoring time period is obtained through calculation. The success rate threshold is a predicted normal transaction success rate, the success rate threshold can be a numerical value, and can also comprise a success rate threshold upper limit and a success rate threshold lower limit, so as to form a range interval, and the range interval can be a range between the success rate threshold upper limit and the success rate threshold lower limit, and can also be the success rate threshold upper limit so as to form a range intervalUpper and lower success rate threshold.
The threshold prediction model is obtained by training transaction samples, wherein the transaction samples can comprise historical transaction success rates of the service transaction system in historical monitoring time periods and historical time characteristics corresponding to the historical monitoring time periods, the historical transaction success rates and the corresponding historical time characteristics are input into the initial threshold prediction model for learning, so that the threshold prediction model is obtained by training, and the threshold prediction model can be recorded as modelt，Yt)。
And step 260, determining the operation state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold.
The collected transaction success rate can be compared with a success rate threshold predicted by a threshold prediction model, so that the operation state of the service transaction system in the monitoring time period can be determined according to the comparison result, and the operation state of the service transaction system in the monitoring time period can include a normal state and an abnormal state. For example, if the threshold of the success rate is a numerical value, the operation state of the service transaction system in the monitoring time period can be determined according to the comparison result of the transaction success rate and the numerical value; the success rate threshold may also be a range interval formed by a success rate threshold upper limit and a success rate threshold lower limit, and the operation state of the service transaction system in the monitoring time period may be determined according to a comparison result between the transaction success rate and the range interval.
In the embodiment, the transaction success rate of the business transaction system in the monitoring time period is obtained according to the transaction log of the business transaction system; acquiring time characteristics corresponding to the monitoring time period, and inputting the time characteristics into a preset threshold prediction model to obtain a success rate threshold corresponding to the monitoring time period; and determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold. Compared with the traditional method, the set success rate threshold can comprise the success rate threshold upper limit and the success rate threshold lower limit, so that corresponding monitoring intervals can be formed according to the service characteristics of the service transaction system in different time periods, and the abnormity of the service transaction system is monitored according to the comparison result of the transaction success rate and the success rate threshold, so that the monitoring accuracy of the abnormity of the service system is improved.
In one embodiment, as shown in fig. 3, which illustrates a flowchart of an anomaly monitoring method provided in an embodiment of the present application, specifically, a possible process for generating a threshold prediction model, the method may include the following steps:
and step 320, acquiring historical time characteristics corresponding to the historical monitoring time period.
And 340, determining a sample threshold corresponding to the historical monitoring time period according to the historical transaction success rate.
And 360, taking the historical time characteristics as the reference input of the initial threshold prediction model, taking the sample threshold as the reference output of the initial threshold prediction model, and training the initial threshold prediction model according to a preset loss function to obtain the threshold prediction model.
When the threshold prediction model is trained, historical transaction success rate data needs to be adopted, so that historical time features corresponding to historical monitoring time periods need to be obtained. Before extracting the historical time features, data preprocessing can be performed on the historical transaction success rate, such as preprocessing processes of data format conversion, data cleaning and the like, and other preprocessing processes can also be included, so that the feature extraction and analysis can be performed on the preprocessed transaction success rate, and the historical time features corresponding to the historical transaction success rate can be obtained.
And determining a sample threshold corresponding to the historical monitoring time period according to the historical transaction success rate, taking the historical time characteristics as the reference input of an initial threshold prediction model, and taking the sample threshold as the reference output of the initial threshold prediction model, so that after the corresponding prediction success rate threshold output by the initial threshold prediction model is compared with the reference output, the parameters of the initial threshold prediction model are updated, and the threshold prediction model is generated according to the updated model parameters. When the success rate threshold output by the initial threshold prediction model is compared with the reference output to update the parameters of the initial threshold prediction model, the model parameters can be updated by adopting a gradient descent algorithm or other algorithms by solving the preset loss function value. The threshold prediction model may be a random forest regression model, or may be other types of machine learning models, which is not specifically limited in this embodiment.
In this embodiment, a historical time characteristic corresponding to a historical monitoring time period is obtained, a sample threshold corresponding to the historical monitoring time period is determined according to a historical transaction success rate, the historical time characteristic is used as a reference input of an initial threshold prediction model, the sample threshold is used as a reference output of the initial threshold prediction model, and the initial threshold prediction model is trained according to a preset loss function to obtain a threshold prediction model. Model parameters are updated through the sample threshold and the prediction threshold, and the training efficiency of the threshold prediction model is improved.
In one embodiment, as shown in fig. 4, which illustrates a flowchart of an anomaly monitoring method provided in an embodiment of the present application, specifically, a possible process for obtaining a sample threshold, the method may include the following steps:
and step 420, determining whether the service transaction system is judged to be abnormal in operation state at the historical monitoring moment according to the historical abnormal monitoring result.
And step 440, if not, inputting the historical transaction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
When the sample threshold corresponding to the historical monitoring time period is determined according to the historical transaction success rate, whether the service transaction system is determined to be abnormal in the operation state at the historical monitoring time can be determined according to the historical abnormal monitoring result. If the service transaction system is not in an abnormal operation state at the historical monitoring time, the historical transaction success rate can be directly input into a preset algorithm, so that a sample threshold corresponding to the historical monitoring time period is obtained through calculation. If the business transaction system is in an abnormal operation state at the historical monitoring time, optionally, as shown in fig. 5, it shows a flowchart of an abnormal monitoring method provided in the embodiment of the present application, and specifically relates to another possible process of obtaining the sample threshold, the method may include the following steps:
and step 520, if the service transaction system is judged to be abnormal in operation state at the historical monitoring time, correcting the transaction sample to obtain the correction success rate of the historical monitoring time period.
And 540, inputting the correction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
If the service transaction system is judged to be abnormal in operation state at the historical monitoring time, the transaction samples need to be corrected, so that the correction success rate of the historical monitoring time period is obtained, the correction success rate is the transaction success rate of the service transaction system in the normal operation state, the correction success rate is input into a preset algorithm, and the sample threshold corresponding to the historical monitoring time period is obtained through calculation. The preset algorithm may be a Prophet algorithm, i.e., a time sequence prediction algorithm, or may be other algorithms capable of calculating the sample threshold, which is not specifically limited in this embodiment.
When obtaining the correction success rate of the historical monitoring time period, optionally, as shown in fig. 6, it shows a flowchart of an anomaly monitoring method provided in the embodiment of the present application, and specifically relates to another possible process for generating the correction success rate, where the method may include the following steps:
and step 620, acquiring the upper limit and the lower limit of the success rate threshold value adopted by the monitoring system when abnormal monitoring is carried out in the historical monitoring time period.
The success rate threshold may include a success rate threshold upper limit and a success rate threshold lower limit, and the success rate correction may be determined according to the success rate threshold upper limit and the success rate threshold lower limit, by acquiring the success rate threshold upper limit and the success rate threshold lower limit that are adopted when the monitoring system performs abnormal monitoring in the historical monitoring time period, where the success rate correction is a value between the success rate threshold upper limit and the success rate threshold lower limit. The correction success rate can be a value arbitrarily selected between the upper limit of the success rate threshold and the lower limit of the success rate threshold, and can also be a value calculated according to a preset algorithm.
In the embodiment, whether the operation state of the business transaction system is judged to be abnormal at the historical monitoring moment is determined according to the historical abnormal monitoring result, if not, the historical transaction success rate is input into a preset algorithm, and a sample threshold corresponding to the historical monitoring time period is obtained; if so, correcting the transaction sample to obtain the correction success rate of the historical monitoring time period, inputting the correction success rate into a preset algorithm, and obtaining a sample threshold corresponding to the historical monitoring time period. The historical transaction success rate under the abnormal condition of the business transaction system is corrected, so that the accuracy of threshold prediction model training is improved.
In one embodiment, if the operation states of the business transaction system in the continuous preset number of monitoring time periods are all abnormal, a system abnormal alarm is sent.
If the operation state of the business transaction system is abnormal, abnormality judgment can be further carried out, and only if the operation states in a continuous preset number of monitoring time periods are abnormal, system abnormality alarm is sent. The continuous preset number of monitoring time periods can belong to the time period in the same acquisition cycle, and can also belong to the time periods in a plurality of continuous acquisition cycles. The continuous preset quantity can be manually set according to historical experience, and after a business transaction system is determined, an abnormal alarm can be given. The alarm information may be formatted, and an external mail server, a telephone short message, or a webhook outside the alarm notification platform may be called to implement a mail alarm, a telephone short message alarm, or a webhook alarm, and notify the user, which may be an alarm in other manners, but is not limited in this embodiment of the present application. By alarming the service transaction system in the abnormal operation state, operation and maintenance personnel can timely cope with the abnormality of the service transaction system, so that the reliable operation of the service transaction system is ensured.
In one embodiment, as shown in fig. 7, a flowchart of an anomaly monitoring method provided by an embodiment of the present application is shown, and the method may include the following steps:
step 701, applying a transaction log file.
And acquiring a transaction log of the service transaction system.
Step 702, transaction data acquisition.
And collecting transaction request information and transaction return information of the business transaction system from the transaction log.
Step 703, transaction success rate data.
And calculating the transaction success rate of the monitoring time period according to the transaction request information and the transaction return information.
And step 704, training data acquisition.
Acquiring historical time characteristics corresponding to historical monitoring time periods; and determining a sample threshold corresponding to the historical monitoring time period according to the historical transaction success rate.
Step 705, data correction.
Determining whether the service transaction system is judged to be abnormal in operation state at the historical monitoring moment according to the historical abnormal monitoring result; if the service transaction system is judged to be abnormal in operation state at the historical monitoring time, correcting the transaction sample to obtain the correction success rate of the historical monitoring time period; and inputting the correction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
Step 706, model training.
And training the initial threshold prediction model according to a preset loss function to obtain the threshold prediction model.
And step 707, model prediction.
And acquiring time characteristics corresponding to the monitoring time period, and inputting the time characteristics into a preset threshold prediction model.
Step 708, predict data.
And calculating to obtain a success rate threshold corresponding to the monitoring time period through a threshold prediction model.
And step 709, judging by monitoring logic.
And if the running states of the business transaction system in the continuous preset number of monitoring time periods are all abnormal, sending a system abnormal alarm.
And step 710, judging whether the abnormal condition exists.
And step 711, outputting an alarm.
And formatting the alarm information, calling an external mail server of the alarm notification platform, and calling a telephone short message or a webhook to realize mail alarm, telephone short message alarm or webhook alarm and notify the user.
The implementation principle and technical effect of each step in the anomaly monitoring method provided in this embodiment are similar to those in the foregoing embodiments of each anomaly monitoring method, and are not described herein again. The implementation manner of each step in the embodiment of fig. 7 is only an example, and is not limited to this, and the order of each step may be adjusted in practical application as long as the purpose of each step can be achieved.
In the technical scheme provided by the embodiment of the application, the set success rate threshold can include a success rate threshold upper limit and a success rate threshold lower limit, so that corresponding monitoring intervals can be formed according to the service characteristics of the service transaction system in different time periods, and then the abnormity of the service transaction system is monitored according to the comparison result of the transaction success rate and the success rate threshold, thereby improving the monitoring accuracy of the abnormity of the service system.
It should be understood that although the various steps in the flow charts of fig. 2-7 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 2-7 may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, which are not necessarily performed in sequence, but may be performed in turn or alternately with other steps or at least some of the other steps.
Referring to fig. 8, a block diagram of an anomaly monitoring apparatus 800 according to an embodiment of the present application is shown. As shown in fig. 8, the abnormality monitoring apparatus 800 may include: a first obtaining module 802, a first calculating module 804, and a first determining module 806, wherein:
the first obtaining module 802 is configured to obtain a transaction success rate of the business transaction system in the monitoring time period according to the transaction log of the business transaction system.
The first calculation module 804 is configured to obtain a time characteristic corresponding to a monitoring time period, input the time characteristic into a preset threshold prediction model, and obtain a success rate threshold corresponding to the monitoring time period; the threshold prediction model is obtained by training by adopting a transaction sample; the transaction sample comprises historical transaction success rate of the business transaction system in a historical monitoring time period and historical time characteristics corresponding to the historical monitoring time period.
A first determining module 806, configured to determine an operation state of the service transaction system in the monitoring time period according to a comparison result between the transaction success rate and the success rate threshold.
In one embodiment, the anomaly monitoring apparatus 800 further includes a second obtaining module 808, a second determining module 810, and a training module 812, wherein:
and a second obtaining module 808, configured to obtain a historical time characteristic corresponding to the historical monitoring time period.
The second determining module 810 is configured to determine a sample threshold corresponding to the historical monitoring time period according to the historical transaction success rate.
The training module 812 is configured to train the initial threshold prediction model according to a preset loss function by using the historical time characteristics as reference input of the initial threshold prediction model and using the sample threshold as reference output of the initial threshold prediction model, so as to obtain the threshold prediction model.
In one embodiment, the second determining module 810 includes a determining unit and a calculating unit, where the determining unit is configured to determine whether the service transaction system is determined to be in an abnormal operating state at the historical monitoring time according to the historical abnormal monitoring result; and the calculating unit is used for inputting the historical transaction success rate into a preset algorithm if the historical transaction success rate is not the preset algorithm, and obtaining a sample threshold corresponding to the historical monitoring time period.
In one embodiment, the anomaly monitoring apparatus 800 further comprises a correction module 814 and a second calculation module 816, wherein:
the correcting module 814 is configured to correct the transaction sample to obtain a correction success rate of the historical monitoring time period if the service transaction system is determined to be abnormal in the operation state at the historical monitoring time.
The second calculating module 816 is configured to input the correction success rate into a preset algorithm, and obtain a sample threshold corresponding to the historical monitoring time period.
In an embodiment, the success rate threshold includes a success rate threshold upper limit and a success rate threshold lower limit, and the correction module 814 includes an obtaining unit and a determining unit, where the obtaining unit is configured to obtain the success rate threshold upper limit and the success rate threshold lower limit that are adopted when the monitoring system performs anomaly monitoring in the historical monitoring time period; the determining unit is used for determining the correction success rate according to the upper limit of the success rate threshold and the lower limit of the success rate threshold; the correction success rate is a value between the upper limit of the success rate threshold and the lower limit of the success rate threshold.
In one embodiment, the time characteristic includes at least one of a periodicity characteristic, a holiday characteristic, and a date-specific characteristic.
In one embodiment, the abnormality monitoring apparatus 800 further includes an alarm module 818, where the alarm module 818 is configured to send a system abnormality alarm if the operation states of the business transaction system in the continuous preset number of monitoring time periods are all abnormal.
For the specific definition of the abnormality monitoring device, reference may be made to the above definition of the abnormality monitoring method, which is not described herein again. The modules in the above-mentioned abnormality monitoring apparatus may be implemented wholly or partially by software, hardware, or a combination thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute the operations of the modules.
In one embodiment of the present application, there is provided a computer device comprising a memory and a processor, the memory having stored therein a computer program, the processor implementing the following steps when executing the computer program:
acquiring the transaction success rate of the service transaction system in a monitoring time period according to the transaction log of the service transaction system; acquiring time characteristics corresponding to the monitoring time period, and inputting the time characteristics into a preset threshold prediction model to obtain a success rate threshold corresponding to the monitoring time period; the threshold prediction model is obtained by training by adopting a transaction sample; the transaction sample comprises the historical transaction success rate of the service transaction system in the historical monitoring time period and the historical time characteristic corresponding to the historical monitoring time period; and determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold.
In one embodiment of the application, the processor when executing the computer program further performs the steps of:
acquiring historical time characteristics corresponding to historical monitoring time periods; determining a sample threshold corresponding to a historical monitoring time period according to the historical transaction success rate; and training the initial threshold prediction model according to a preset loss function to obtain the threshold prediction model.
In one embodiment of the application, the processor when executing the computer program further performs the steps of:
determining whether the service transaction system is judged to be abnormal in operation state at the historical monitoring moment according to the historical abnormal monitoring result; and if not, inputting the historical transaction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
In one embodiment of the application, the processor when executing the computer program further performs the steps of:
if the service transaction system is judged to be abnormal in operation state at the historical monitoring time, correcting the transaction sample to obtain the correction success rate of the historical monitoring time period; and inputting the correction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
In one embodiment of the present application, the success rate threshold includes a success rate threshold upper limit and a success rate threshold lower limit;
the processor, when executing the computer program, further performs the steps of:
acquiring a success rate threshold upper limit and a success rate threshold lower limit adopted by a monitoring system when abnormal monitoring is carried out in a historical monitoring time period; determining a correction success rate according to the success rate threshold upper limit and the success rate threshold lower limit; the correction success rate is a value between the upper limit of the success rate threshold and the lower limit of the success rate threshold.
In one embodiment of the present application, the temporal characteristics include at least one of a periodicity characteristic, a holiday characteristic, a date-specific characteristic.
In one embodiment of the application, the processor when executing the computer program further performs the steps of:
and if the running states of the business transaction system in the continuous preset number of monitoring time periods are all abnormal, sending a system abnormal alarm.
The implementation principle and technical effect of the computer device provided by the embodiment of the present application are similar to those of the method embodiment described above, and are not described herein again.
In an embodiment of the application, a computer-readable storage medium is provided, on which a computer program is stored, which computer program, when being executed by a processor, carries out the steps of:
acquiring the transaction success rate of the service transaction system in a monitoring time period according to the transaction log of the service transaction system; acquiring time characteristics corresponding to the monitoring time period, and inputting the time characteristics into a preset threshold prediction model to obtain a success rate threshold corresponding to the monitoring time period; the threshold prediction model is obtained by training by adopting a transaction sample; the transaction sample comprises the historical transaction success rate of the service transaction system in the historical monitoring time period and the historical time characteristic corresponding to the historical monitoring time period; and determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold.
In one embodiment of the application, the computer program when executed by the processor further performs the steps of:
acquiring historical time characteristics corresponding to historical monitoring time periods; determining a sample threshold corresponding to a historical monitoring time period according to the historical transaction success rate; and training the initial threshold prediction model according to a preset loss function to obtain the threshold prediction model.
In one embodiment of the application, the computer program when executed by the processor further performs the steps of:
determining whether the service transaction system is judged to be abnormal in operation state at the historical monitoring moment according to the historical abnormal monitoring result; and if not, inputting the historical transaction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
In one embodiment of the application, the computer program when executed by the processor further performs the steps of:
if the service transaction system is judged to be abnormal in operation state at the historical monitoring time, correcting the transaction sample to obtain the correction success rate of the historical monitoring time period; and inputting the correction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
In one embodiment of the present application, the success rate threshold includes a success rate threshold upper limit and a success rate threshold lower limit;
the computer program when executed by the processor further realizes the steps of:
acquiring a success rate threshold upper limit and a success rate threshold lower limit adopted by a monitoring system when abnormal monitoring is carried out in a historical monitoring time period; determining a correction success rate according to the success rate threshold upper limit and the success rate threshold lower limit; the correction success rate is a value between the upper limit of the success rate threshold and the lower limit of the success rate threshold.
In one embodiment of the present application, the temporal characteristics include at least one of a periodicity characteristic, a holiday characteristic, a date-specific characteristic.
In one embodiment of the application, the computer program when executed by the processor further performs the steps of:
and if the running states of the business transaction system in the continuous preset number of monitoring time periods are all abnormal, sending a system abnormal alarm.
The implementation principle and technical effect of the computer-readable storage medium provided by this embodiment are similar to those of the above-described method embodiment, and are not described herein again.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above examples only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the claims. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (10)
1. An anomaly monitoring method, comprising:
acquiring the transaction success rate of a service transaction system in a monitoring time period according to a transaction log of the service transaction system;
acquiring time characteristics corresponding to the monitoring time period, and inputting the time characteristics into a preset threshold prediction model to acquire a success rate threshold corresponding to the monitoring time period; the threshold prediction model is obtained by training by adopting a transaction sample; the transaction sample comprises the historical transaction success rate of the business transaction system in a historical monitoring time period and the historical time characteristic corresponding to the historical monitoring time period;
and determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold.
2. The method of claim 1, further comprising:
acquiring historical time characteristics corresponding to the historical monitoring time period;
determining a sample threshold corresponding to the historical monitoring time period according to the historical transaction success rate;
and taking the historical time characteristics as the reference input of an initial threshold prediction model, taking the sample threshold as the reference output of the initial threshold prediction model, and training the initial threshold prediction model according to a preset loss function to obtain the threshold prediction model.
3. The method of claim 2, wherein determining the sample threshold corresponding to the historical monitoring time period according to the historical transaction success rate comprises:
determining whether the service transaction system is judged to be abnormal in operation state at the historical monitoring moment according to a historical abnormal monitoring result;
and if not, inputting the historical transaction success rate into a preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
4. The method of claim 3, further comprising:
if the service transaction system is judged to be abnormal in operation state at the historical monitoring time, correcting the transaction sample to obtain the correction success rate of the historical monitoring time period;
and inputting the correction success rate into the preset algorithm to obtain a sample threshold corresponding to the historical monitoring time period.
5. The method of claim 4, wherein the success rate threshold comprises an upper success rate threshold and a lower success rate threshold, and wherein the correcting the transaction sample to obtain the corrected success rate of the historical monitoring time period comprises:
acquiring the upper limit and the lower limit of a success rate threshold value adopted by a monitoring system when abnormal monitoring is carried out in the historical monitoring time period;
determining the correction success rate according to the success rate threshold upper limit and the success rate threshold lower limit; the correction success rate is a value between the success rate threshold upper limit and the success rate threshold lower limit.
6. The method according to any one of claims 1-5, wherein the time characteristic comprises at least one of a periodicity characteristic, a holiday characteristic, a date-specific characteristic.
7. The method according to any one of claims 1-5, further comprising:
and if the running states of the business transaction system in the continuous preset number of monitoring time periods are all abnormal, sending a system abnormal alarm.
8. An anomaly monitoring device, said device comprising:
the first acquisition module is used for acquiring the transaction success rate of the business transaction system in a monitoring time period according to the transaction log of the business transaction system;
the first calculation module is used for acquiring time characteristics corresponding to the monitoring time period, inputting the time characteristics into a preset threshold prediction model and acquiring a success rate threshold corresponding to the monitoring time period; the threshold prediction model is obtained by training by adopting a transaction sample; the transaction sample comprises the historical transaction success rate of the business transaction system in a historical monitoring time period and the historical time characteristic corresponding to the historical monitoring time period;
and the first determining module is used for determining the running state of the service transaction system in the monitoring time period according to the comparison result of the transaction success rate and the success rate threshold.
9. A computer arrangement comprising a memory and a processor, the memory storing a computer program which, when executed by the processor, carries out the steps of the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that a computer program is stored thereon, which computer program, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110907896.1A CN113723956A (en) | 2021-08-09 | 2021-08-09 | Abnormity monitoring method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110907896.1A CN113723956A (en) | 2021-08-09 | 2021-08-09 | Abnormity monitoring method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113723956A true CN113723956A (en) | 2021-11-30 |
Family
ID=78675149
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110907896.1A Pending CN113723956A (en) | 2021-08-09 | 2021-08-09 | Abnormity monitoring method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113723956A (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115442214A (en) * | 2022-09-02 | 2022-12-06 | 中国工商银行股份有限公司 | Method, device, equipment, storage medium and program product for troubleshooting business abnormity |
| CN115802199A (en) * | 2022-10-26 | 2023-03-14 | 北京力控元通科技有限公司 | Method and device for determining alarm threshold, electronic equipment and readable storage medium |
| CN117037388A (en) * | 2023-10-09 | 2023-11-10 | 杭银消费金融股份有限公司 | Financial self-service terminal control method and financial self-service terminal |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107204894A (en) * | 2017-05-18 | 2017-09-26 | 华为技术有限公司 | The monitoring method and device of network servicequality |
| CN108537544A (en) * | 2018-04-04 | 2018-09-14 | 中南大学 | A kind of transaction system method for real-time monitoring and its monitoring system |
| CN110008049A (en) * | 2019-03-29 | 2019-07-12 | 广州接点智能科技有限公司 | A kind of data correcting method based on internet platform, terminal device and medium |
| CN110634081A (en) * | 2019-08-02 | 2019-12-31 | 国网四川省电力公司映秀湾水力发电总厂 | Method and device for processing abnormal data of hydropower station |
| CN110727533A (en) * | 2019-09-26 | 2020-01-24 | 华青融天(北京)软件股份有限公司 | Alarm method, device, equipment and medium |
| CN110807024A (en) * | 2019-10-12 | 2020-02-18 | 广州市申迪计算机系统有限公司 | Dynamic threshold anomaly detection method and system, storage medium and intelligent device |
| CN112835769A (en) * | 2021-02-24 | 2021-05-25 | 北京顶象技术有限公司 | Service data abnormity diagnosis method, device, equipment and storage medium |
-
2021
- 2021-08-09 CN CN202110907896.1A patent/CN113723956A/en active Pending
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107204894A (en) * | 2017-05-18 | 2017-09-26 | 华为技术有限公司 | The monitoring method and device of network servicequality |
| CN108537544A (en) * | 2018-04-04 | 2018-09-14 | 中南大学 | A kind of transaction system method for real-time monitoring and its monitoring system |
| CN110008049A (en) * | 2019-03-29 | 2019-07-12 | 广州接点智能科技有限公司 | A kind of data correcting method based on internet platform, terminal device and medium |
| CN110634081A (en) * | 2019-08-02 | 2019-12-31 | 国网四川省电力公司映秀湾水力发电总厂 | Method and device for processing abnormal data of hydropower station |
| CN110727533A (en) * | 2019-09-26 | 2020-01-24 | 华青融天(北京)软件股份有限公司 | Alarm method, device, equipment and medium |
| CN110807024A (en) * | 2019-10-12 | 2020-02-18 | 广州市申迪计算机系统有限公司 | Dynamic threshold anomaly detection method and system, storage medium and intelligent device |
| CN112835769A (en) * | 2021-02-24 | 2021-05-25 | 北京顶象技术有限公司 | Service data abnormity diagnosis method, device, equipment and storage medium |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115442214A (en) * | 2022-09-02 | 2022-12-06 | 中国工商银行股份有限公司 | Method, device, equipment, storage medium and program product for troubleshooting business abnormity |
| CN115802199A (en) * | 2022-10-26 | 2023-03-14 | 北京力控元通科技有限公司 | Method and device for determining alarm threshold, electronic equipment and readable storage medium |
| CN115802199B (en) * | 2022-10-26 | 2023-09-22 | 北京力控元通科技有限公司 | Alarm threshold determining method and device, electronic equipment and readable storage medium |
| CN117037388A (en) * | 2023-10-09 | 2023-11-10 | 杭银消费金融股份有限公司 | Financial self-service terminal control method and financial self-service terminal |
| CN117037388B (en) * | 2023-10-09 | 2024-01-12 | 杭银消费金融股份有限公司 | Financial self-service terminal control method and financial self-service terminal |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113723956A (en) | Abnormity monitoring method, device, equipment and storage medium | |
| CN108876133B (en) | Risk assessment processing method, device, server and medium based on business information | |
| CN109583758B (en) | Early warning rule correction method and device of monitoring system and computer equipment | |
| CN109992473B (en) | Application system monitoring method, device, equipment and storage medium | |
| CN110868241A (en) | Underground cable fault early warning method and device based on multiple models | |
| CN115174231B (en) | Network fraud analysis method and server based on AI Knowledge Base | |
| CN110837956A (en) | Underground cable inspection task distribution method and device | |
| CN108845869B (en) | Concurrent request control method, device, computer equipment and storage medium | |
| CN110674149B (en) | Service data processing method and device, computer equipment and storage medium | |
| CN110866634A (en) | Underground cable fault early warning method and device based on model selection | |
| CN111382944A (en) | Job behavior risk identification method and device, computer equipment and storage medium | |
| CN111885181B (en) | Monitoring data reporting method and device, computer equipment and storage medium | |
| CN113419950A (en) | Method and device for generating UI automation script, computer equipment and storage medium | |
| CN111679953B (en) | Fault node identification method, device, equipment and medium based on artificial intelligence | |
| CN110838940B (en) | Underground cable inspection task configuration method and device | |
| CN108763002A (en) | The method and system of cpu fault are predicted based on machine learning | |
| CN111898035A (en) | Data processing strategy configuration method and device based on Internet of things and computer equipment | |
| CN113123955A (en) | Plunger pump abnormality detection method and device, storage medium and electronic device | |
| CN114242196B (en) | Automatic generation method and device for clinical medical record | |
| CN114722025A (en) | Data prediction method, device and equipment based on prediction model and storage medium | |
| CN114944942A (en) | Data reporting method and device based on effective buried points, computer equipment and medium | |
| CN112860527A (en) | Fault monitoring method and device of application server | |
| CN113407422B (en) | Data abnormity alarm processing method and device, computer equipment and storage medium | |
| CN110969430A (en) | Method and device for identifying suspicious user, computer equipment and storage medium | |
| CN110889357A (en) | Underground cable fault detection method and device based on marked area |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |