CN115065585A

CN115065585A - Business abnormity monitoring method and device, electronic equipment and storage medium

Info

Publication number: CN115065585A
Application number: CN202210473363.1A
Authority: CN
Inventors: 刘林
Original assignee: Beijing Dajia Internet Information Technology Co Ltd
Current assignee: Beijing Dajia Internet Information Technology Co Ltd
Priority date: 2022-04-29
Filing date: 2022-04-29
Publication date: 2022-09-16

Abstract

The method comprises the steps of obtaining first occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension, wherein the first occurrence data are the occurrence times corresponding to a plurality of adjacent time periods in a current monitoring period; inputting the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing to obtain at least one preset event corresponding to at least one first monitoring dimension and corresponding first anomaly index data in a plurality of adjacent time periods; and determining a first abnormal monitoring result corresponding to the preset service based on the first abnormal index data, wherein the first abnormal monitoring result represents an abnormal event corresponding to the abnormal monitoring dimension in at least one first monitoring dimension. By the aid of the method and the device, universality of abnormal monitoring in different service scenes can be improved, abnormal factors can be quickly and accurately positioned, abnormal monitoring efficiency and accuracy are improved, and abnormal conditions of services are reduced.

Description

Business abnormity monitoring method and device, electronic equipment and storage medium

Technical Field

The present disclosure relates to the field of internet technologies, and in particular, to a method and an apparatus for monitoring a business anomaly, an electronic device, and a storage medium.

Background

With the development of internet technology, the scale of the service functions of various network services is continuously enlarged, and how to monitor the abnormal conditions of the services in time becomes the key point for maintaining the normal operation of the related services.

In the related art, an event causing a business exception is often analyzed and determined by performing exception plotting in a business code, collecting information of the exception plotting, and rendering the information of the exception plotting to an interface. However, in the related art, for example, login state verification services in some services have many types of events causing abnormal failure of login state verification, and different service scenes cannot be uniformly configured with monitoring schemes such as abnormal tracing points, so that abnormal factors cannot be accurately located, the monitoring efficiency and accuracy are low, and further, problems such as abnormal services are caused.

Disclosure of Invention

The disclosure provides a service abnormity monitoring method, a device, an electronic device and a storage medium, which are used for at least solving the problems that abnormal factors cannot be accurately positioned in the related technology, the monitoring efficiency and the accuracy are low, and further, service abnormity is caused and the like. The technical scheme of the disclosure is as follows:

according to a first aspect of the embodiments of the present disclosure, a method for monitoring a service anomaly is provided, including:

acquiring first occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension, wherein the first occurrence data are occurrence times corresponding to a plurality of adjacent time periods in a current monitoring period;

inputting the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing to obtain at least one preset event corresponding to the at least one first monitoring dimension and corresponding first anomaly index data in the plurality of adjacent time periods;

determining a first abnormal monitoring result corresponding to the preset service based on the first abnormal index data, wherein the first abnormal monitoring result represents an abnormal event corresponding to an abnormal monitoring dimension in the at least one first monitoring dimension.

In an optional embodiment, the method further comprises:

filtering the first occurrence data based on a first time threshold value to obtain first target occurrence data;

inputting the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing to obtain at least one preset event corresponding to the at least one first monitoring dimension, wherein the corresponding first anomaly index data in the plurality of adjacent time periods comprises:

and inputting the first target occurrence data into the first anomaly monitoring model for anomaly monitoring processing to obtain the first anomaly index data.

In an optional embodiment, the determining, based on the first anomaly index data, a first anomaly monitoring result corresponding to the preset service includes:

in the case that the corresponding first abnormal index data in the adjacent time periods are greater than or equal to a first preset threshold value in the preset event corresponding to any first monitoring dimension, taking the corresponding first abnormal index data in the adjacent time periods greater than or equal to the first preset threshold value as the corresponding abnormal event of the abnormal monitoring dimension;

and generating the first anomaly monitoring result based on the anomaly event corresponding to the anomaly monitoring dimension.

In an optional embodiment, the method further comprises:

acquiring second occurrence data of the abnormal event corresponding to the preset service in at least one second monitoring dimension, wherein the second occurrence data is the occurrence frequency corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension obtained after an additional monitoring dimension is added to the abnormal monitoring dimension;

inputting second occurrence data into a second anomaly identification model for anomaly monitoring processing to obtain the anomaly event corresponding to the at least one second monitoring dimension and second anomaly index data corresponding to the current monitoring period;

and determining a second abnormal monitoring result corresponding to the preset service based on the second abnormal index data, wherein the second abnormal monitoring result represents a target abnormal event corresponding to a target abnormal monitoring dimension in the at least one second monitoring dimension.

In an optional embodiment, the determining, based on the second abnormal indicator data, a second abnormal monitoring result corresponding to the preset service includes:

in the case that second abnormal index data corresponding to any second monitoring dimension is greater than or equal to a second preset threshold value in the preset event corresponding to any second monitoring dimension, taking the abnormal event corresponding to the second monitoring dimension, in which the second abnormal index data corresponding to the current monitoring period is greater than or equal to the second preset threshold value, as a target abnormal event corresponding to the target abnormal monitoring dimension;

and generating the second anomaly monitoring result according to the target anomaly event corresponding to the target anomaly monitoring dimension.

In an optional embodiment, the preset service is a login state verification service, the at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, and the second anomaly monitoring result represents a target anomaly event in an anomaly area corresponding to the anomaly service, where the method further includes:

taking a region, corresponding to the second abnormal index data of the at least one region, which is greater than or equal to the second preset threshold value, as the abnormal region;

determining a first area quantity corresponding to the abnormal area and a second area quantity corresponding to a target area, wherein the target area is an area participating in abnormal monitoring processing in the at least one area;

the generating the second anomaly monitoring result according to the target anomaly event corresponding to the target anomaly monitoring dimension includes:

and under the condition that the number of the first areas is greater than a first area threshold value and the number of the second areas is greater than a second area threshold value, generating a second abnormity monitoring result according to a target abnormity event corresponding to the target abnormity monitoring dimension.

In an optional embodiment, the method further comprises:

filtering the second occurrence data based on a second time threshold value to obtain second target occurrence data;

the inputting the second occurrence data into a second anomaly identification model for anomaly monitoring processing to obtain second anomaly index data of the anomaly event corresponding to the at least one second monitoring dimension includes:

and inputting the second target occurrence data into the second anomaly identification model for anomaly monitoring processing to obtain second anomaly index data.

In an optional embodiment, the method further comprises:

acquiring first sample occurrence data of at least one preset event corresponding to the preset service in the at least one first monitoring dimension and preset abnormal index data corresponding to the first sample occurrence data, wherein the first sample occurrence data are occurrence times corresponding to multiple adjacent historical time periods in multiple historical monitoring periods;

inputting the first sample occurrence data into a preset machine learning model for anomaly monitoring processing to obtain at least one preset event corresponding to the at least one first monitoring dimension and corresponding sample anomaly index data in the plurality of adjacent historical time periods;

determining target loss information according to the preset abnormal index data and the sample abnormal index data;

and training the preset machine learning model based on the target loss information to obtain the first anomaly monitoring model.

According to a second aspect of the embodiments of the present disclosure, there is provided a service anomaly monitoring device, including:

the system comprises a first occurrence data acquisition module, a second occurrence data acquisition module and a monitoring module, wherein the first occurrence data acquisition module is configured to execute acquisition of first occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension, and the first occurrence data is the occurrence frequency corresponding to each of a plurality of adjacent time periods in a current monitoring period;

a first anomaly monitoring processing module configured to perform input of the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing to obtain at least one preset event corresponding to the at least one first monitoring dimension, and corresponding first anomaly index data in the multiple adjacent time periods;

a first anomaly monitoring result determining module configured to determine a first anomaly monitoring result corresponding to the preset service based on the first anomaly index data, where the first anomaly monitoring result represents an anomaly event corresponding to an anomaly monitoring dimension in the at least one first monitoring dimension.

In an optional embodiment, the apparatus further comprises:

the first data filtering module is configured to filter the first occurrence data based on a first time threshold value to obtain first target occurrence data;

the first anomaly monitoring processing module is further configured to input the first target occurrence data into the first anomaly monitoring model for anomaly monitoring processing, so as to obtain the first anomaly index data.

In an optional embodiment, the first anomaly monitoring result determining module includes:

the first anomaly determination unit is configured to execute a preset event corresponding to any first monitoring dimension, and when the first anomaly index data corresponding to the multiple adjacent time periods are all larger than or equal to a first preset threshold value, the preset event corresponding to the first monitoring dimension, of which the first anomaly index data corresponding to the multiple adjacent time periods are all larger than or equal to the first preset threshold value, is taken as the anomaly event corresponding to the anomaly monitoring dimension;

a first anomaly monitoring result generating unit configured to execute an anomaly event corresponding to the anomaly monitoring dimension to generate the first anomaly monitoring result.

In an optional embodiment, the apparatus further comprises:

a second occurrence data obtaining module, configured to perform obtaining of second occurrence data of the abnormal event corresponding to the preset service in at least one second monitoring dimension, where the second occurrence data is the number of occurrences corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension to which an additional monitoring dimension is added in the abnormal monitoring dimension;

the second anomaly monitoring processing module is configured to input second occurrence data into a second anomaly identification model for anomaly monitoring processing to obtain the anomaly event corresponding to the at least one second monitoring dimension and second anomaly index data corresponding to the current monitoring period;

a second anomaly monitoring result determining module configured to determine a second anomaly monitoring result corresponding to the preset service based on the second anomaly index data, where the second anomaly monitoring result represents a target anomaly event corresponding to a target anomaly monitoring dimension in the at least one second monitoring dimension.

In an optional embodiment, the second anomaly monitoring result determining module includes:

the second anomaly determination unit is configured to execute a preset event corresponding to any second monitoring dimension, and when second anomaly index data corresponding to the current monitoring period is greater than or equal to a second preset threshold value, the second anomaly determination unit takes the anomaly event corresponding to the second monitoring dimension, of which the second anomaly index data corresponding to the current monitoring period is greater than or equal to the second preset threshold value, as a target anomaly event corresponding to the target anomaly monitoring dimension;

and the second abnormity monitoring result generation unit is configured to execute a target abnormity event corresponding to the target abnormity monitoring dimension and generate a second abnormity monitoring result.

In an optional embodiment, the preset service is a login state verification service, the at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, and the second anomaly monitoring result represents a target anomaly event in an anomaly area corresponding to the anomaly service, where the apparatus further includes:

an abnormal region determination module configured to execute a region in which corresponding second abnormal index data in the at least one region is greater than or equal to the second preset threshold as the abnormal region;

a second area number determination module configured to perform determining a first area number corresponding to the abnormal area and a second area number corresponding to a target area, where the target area is an area participating in the abnormal monitoring processing in the at least one area;

the second anomaly monitoring result generating unit is further configured to execute, when the first number of regions is greater than a first region threshold and the second number of regions is greater than a second region threshold, generating the second anomaly monitoring result according to a target anomaly event corresponding to the target anomaly monitoring dimension.

In an optional embodiment, the apparatus further comprises:

the second data filtering module is configured to filter the second occurrence data based on a second time threshold to obtain second target occurrence data;

the second anomaly monitoring processing module is further configured to input the second target occurrence data into the second anomaly identification model for anomaly monitoring processing, so as to obtain second anomaly index data.

In an optional embodiment, the apparatus further comprises:

a training data module configured to perform obtaining of first sample occurrence data of at least one preset event corresponding to the preset service in the at least one first monitoring dimension and preset abnormal index data corresponding to the first sample occurrence data, where the first sample occurrence data is occurrence times corresponding to each of multiple adjacent historical time periods in multiple historical monitoring cycles;

a third anomaly monitoring processing module configured to perform anomaly monitoring processing by inputting the first sample occurrence data into a preset machine learning model, so as to obtain at least one preset event corresponding to the at least one first monitoring dimension, and corresponding sample anomaly index data in the plurality of adjacent historical time periods;

a target loss information determination module configured to perform determining target loss information according to the preset abnormal index data and the sample abnormal index data;

and the model training module is configured to train the preset machine learning model based on the target loss information to obtain the first anomaly monitoring model.

According to a third aspect of the embodiments of the present disclosure, there is provided an electronic apparatus including: a processor; a memory for storing the processor-executable instructions; wherein the processor is configured to execute the instructions to implement the method of any of the first aspects above.

According to a fourth aspect of embodiments of the present disclosure, there is provided a computer-readable storage medium, wherein instructions, when executed by a processor of an electronic device, enable the electronic device to perform the method of any one of the first aspects of the embodiments of the present disclosure.

According to a fifth aspect of the embodiments of the present disclosure, there is provided a computer program product containing instructions which, when run on a computer, cause the computer to perform the method of any one of the first aspects of the embodiments of the present disclosure.

The technical scheme provided by the embodiment of the disclosure at least brings the following beneficial effects:

taking the first occurrence data of at least one preset event corresponding to the preset service under at least one first monitoring dimension as the input of a first abnormity monitoring model to carry out abnormity monitoring processing, can realize the monitoring of the abnormal service according to the monitoring dimension, improves the universality of abnormal monitoring under different service scenes, and the first occurrence data is the occurrence times corresponding to a plurality of adjacent time periods in the current monitoring period, the abnormal fluctuation trend of the service can be effectively reflected, the characterization accuracy of the obtained first abnormal index data on the abnormal probability of the preset service in each adjacent time period due to any preset event under the first monitoring dimension is effectively ensured, and then based on the first abnormal index data, abnormal factors can be quickly and accurately positioned, and the abnormal service monitoring efficiency and accuracy are greatly improved, so that the effective alarm rate is improved, and abnormal service conditions are reduced.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the disclosure and are not to be construed as limiting the disclosure.

FIG. 1 is a schematic diagram illustrating an application environment in accordance with an illustrative embodiment;

FIG. 2 is a flow diagram illustrating a method of traffic anomaly monitoring in accordance with an exemplary embodiment;

FIG. 3 is a flow diagram illustrating a pre-trained first anomaly monitoring model according to an exemplary embodiment;

FIG. 4 is a flow diagram illustrating another method of traffic anomaly monitoring according to an exemplary embodiment;

FIG. 5 is a flow diagram illustrating another method of traffic anomaly monitoring according to an exemplary embodiment;

FIG. 6 is a block diagram illustrating a traffic anomaly monitoring device, according to an exemplary embodiment;

FIG. 7 is a block diagram illustrating an electronic device for traffic anomaly monitoring in accordance with an exemplary embodiment;

FIG. 8 is a block diagram illustrating an electronic device for traffic anomaly monitoring in accordance with an exemplary embodiment.

Detailed Description

In order to make the technical solutions of the present disclosure better understood by those of ordinary skill in the art, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings.

It should be noted that the terms "first," "second," and the like in the description and claims of the present disclosure and in the above-described drawings are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the disclosure described herein are capable of operation in sequences other than those illustrated or otherwise described herein. The implementations described in the exemplary embodiments below are not intended to represent all implementations consistent with the present disclosure. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure, as detailed in the appended claims.

It should be noted that, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for presentation, analyzed data, etc.) referred to in the present disclosure are information and data authorized by the user or sufficiently authorized by each party.

Referring to fig. 1, fig. 1 is a schematic diagram illustrating an application environment according to an exemplary embodiment, and as shown in fig. 1, the application environment may include a terminal 100 and a server 200.

In an alternative embodiment, the terminal 100 may be configured to provide a predetermined service. Specifically, the terminal 100 may include, but is not limited to, a smart phone, a desktop computer, a tablet computer, a notebook computer, a smart speaker, a digital assistant, an Augmented Reality (AR)/Virtual Reality (VR) device, a smart wearable device, and other types of electronic devices, and may also be software running on the electronic devices, such as an application program. Optionally, the operating system running on the electronic device may include, but is not limited to, an android system, an IOS system, linux, windows, and the like.

In an alternative embodiment, the server 200 may provide a background service for the terminal 100 and perform the service anomaly monitoring processing. Alternatively, the server 200 may previously train an anomaly monitoring model. Correspondingly, the service abnormity monitoring processing can be carried out by combining the abnormity monitoring model. Specifically, the server 200 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing basic cloud computing services such as a cloud service, a cloud database, cloud computing, a cloud function, cloud storage, a Network service, cloud communication, a middleware service, a domain name service, a security service, a Content Delivery Network (CDN), a big data and an artificial intelligence platform.

In addition, it should be noted that fig. 1 shows only one application environment provided by the present disclosure, and in practical applications, other application environments may also be included, for example, the service anomaly monitoring processing may also be implemented in the terminal.

In the embodiment of the present specification, the terminal 100 and the server 200 may be directly or indirectly connected through wired or wireless communication, and the disclosure is not limited herein.

Fig. 2 is a flowchart illustrating a method for monitoring a traffic anomaly, according to an exemplary embodiment, where as shown in fig. 2, the method for monitoring a traffic anomaly is used in an electronic device, such as a terminal or a server, and includes the following steps.

In step S201, first occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension is obtained.

In a specific embodiment, the preset service may correspond to different services according to actual application requirements, for example, the preset service may be a login state verification service, an information push service, a short message delivery service, and the like. Optionally, the at least one first monitoring dimension may be a dimension for monitoring service anomaly, and specifically, the dimension is different in combination with different monitoring requirements under actual services. The at least one preset event may be an event related to an abnormal occurrence of a preset service, and specifically, may be different in combination with different preset services.

In a specific embodiment, the service anomaly monitoring may be performed periodically in combination with actual requirements, and correspondingly, the first occurrence data may be occurrence times corresponding to each of a plurality of adjacent time periods in a current monitoring period; optionally, assuming that the service anomaly monitoring period is 3 minutes, the 3 minutes may be divided into 3 adjacent time periods, and correspondingly, each adjacent time period may be 1 minute, and optionally, the occurrence frequency (first occurrence data) of at least one preset event corresponding to a preset service in at least one first monitoring dimension may be obtained every minute.

In a specific embodiment, for example, the preset service is a login state verification service, and the monitoring requirement is that exception monitoring needs to be performed on the login state verification service in at least one service, correspondingly, the at least one first monitoring dimension may be at least one service, and specifically, the at least one service may be at least one service that needs to be subjected to login state verification. Optionally, the at least one preset event may include a Token error event, a Token decryption error event, a UserId (user identity) and Token mismatch event in the parameter, a Token failed event, and the like.

In a specific embodiment, taking the preset service as a short message delivery service as an example, and the monitoring requirement is that abnormal monitoring needs to be performed on the short message delivery service of at least one region, correspondingly, the at least one first monitoring dimension may be at least one short message delivery region, and optionally, the at least one preset event may include an information service provision fault event, a short message type error event, a short message application scenario error event, a short message signature error event, and the like.

In a specific embodiment, a preset service is taken as an example of an information push service, and a monitoring requirement is that abnormality monitoring of the information push service needs to be performed on a model of at least one information push device, and correspondingly, the at least one first monitoring dimension may be at least one model of the information push device, and optionally, the at least one preset event may include a push channel fault event, a network error event, and the like.

In step S203, inputting the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing, so as to obtain at least one preset event corresponding to at least one first monitoring dimension, and corresponding first anomaly index data in a plurality of adjacent time periods;

in a specific embodiment, the first abnormal indicator data corresponding to the at least one first monitoring dimension may represent a probability that the preset service is abnormal in each adjacent time period due to any preset event in any first monitoring dimension, in the at least one preset event corresponding to the at least one first monitoring dimension. Specifically, for example, in the scenario where the anomaly monitoring needs to be performed on the login state verification service in at least one service, the first anomaly index data may represent the probability that the login state verification service of any service is abnormal due to any preset event in each adjacent time period.

In a specific embodiment, the first anomaly monitoring model may be a model obtained by performing anomaly monitoring processing training on a preset machine learning model in advance based on first training data, specifically, the first training data may include first sample occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension and preset anomaly index data corresponding to the first sample occurrence data, where the first sample occurrence data is occurrence times corresponding to multiple adjacent historical time periods in multiple historical monitoring cycles. In particular, any historical monitoring cycle may include a plurality of adjacent historical time periods. The preset abnormal index data corresponding to the first sample occurrence data of a certain preset event corresponding to the preset service in a certain first monitoring dimension can represent the preset real probability that the preset service in each adjacent historical time period is abnormal due to the preset event in the first monitoring dimension.

In an optional embodiment, the method may further include: the step of training the first anomaly monitoring model in advance, specifically, as shown in fig. 3, may include the following steps:

in step S301, first sample occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension and preset abnormal index data corresponding to the first sample occurrence data are obtained;

in step S303, inputting the first sample occurrence data into a preset machine learning model for anomaly monitoring processing to obtain at least one preset event corresponding to at least one first monitoring dimension, and corresponding sample anomaly index data in a plurality of adjacent historical time periods;

in a specific embodiment, the sample abnormal index data corresponding to a certain preset event corresponding to the preset service in a certain first monitoring dimension in a plurality of adjacent historical time periods may represent probabilities that the preset service in the first monitoring dimension predicted by the preset machine learning model is abnormal in the plurality of adjacent historical time periods due to the preset event.

In step S305, determining target loss information according to preset abnormal index data and sample abnormal index data;

in a specific embodiment, the target loss information may be determined by combining a preset loss function, and specifically, the target loss information may represent a difference degree between the preset abnormal index data and the sample abnormal index data.

In step S307, a preset machine learning model is trained based on the target loss information, so as to obtain a first anomaly monitoring model.

In a specific embodiment, the training a preset machine learning model based on the target loss information to obtain the first anomaly monitoring model may include: updating model parameters of a preset machine learning model based on the target loss information; repeating the step S303 to a training iterative operation of updating model parameters of the preset machine learning model based on the updated preset machine learning model based on the target loss information until a training convergence condition is reached; and taking the preset machine learning model obtained under the condition of reaching the training convergence condition as a first anomaly monitoring model.

In a specific embodiment, the reaching of the training convergence condition may be that the number of training iteration operations reaches a preset number of training times. Optionally, the preset convergence condition is reached, and the target loss information may also be smaller than a specified threshold. In the embodiment of the present specification, the preset training times and the specified threshold may be preset in combination with the training speed of the model and the accuracy of the anomaly monitoring processing in practical application.

In the above embodiment, the first sample occurrence data of the at least one preset event corresponding to the preset service in the at least one first monitoring dimension and the preset abnormal index data corresponding to the first sample occurrence data are combined to train the preset machine learning model, so that the first abnormal monitoring model capable of predicting the abnormal index data of the at least one preset event corresponding to the preset service in the at least one first monitoring dimension can be trained, and the efficiency of subsequent service abnormal monitoring processing is further improved.

In an alternative embodiment, as shown in fig. 4, the method may further include:

in step S207, filtering the first occurrence data based on the first time threshold to obtain first target occurrence data;

correspondingly, the inputting of the first occurrence data into the first anomaly monitoring model for anomaly monitoring processing obtains at least one preset event corresponding to at least one first monitoring dimension, and the corresponding first anomaly index data in a plurality of adjacent time periods includes: and inputting the first target occurrence data into a first abnormity monitoring model for abnormity monitoring processing to obtain first abnormity index data.

In a specific embodiment, the first time threshold may be set in conjunction with the actual application.

In practical application, some preset events associated with the preset service exception may occur in the preset service processing process, but within a controllable range, the service exception is not caused. Correspondingly, the occurrence times of the first occurrence data which are less than or equal to the first time threshold value can be filtered, and the first target occurrence data can be obtained.

In the above embodiment, the first occurrence data with the lower occurrence frequency is filtered based on the first time threshold, and the data associated with the preset service exception can be effectively screened out, so that the data volume of exception monitoring processing can be reduced on the basis of improving the validity of exception monitoring processing, and the exception monitoring processing efficiency can be improved.

In step S205, a first anomaly monitoring result corresponding to the preset service is determined based on the first anomaly index data.

In a specific embodiment, the first anomaly monitoring result may characterize an anomaly event corresponding to an anomaly monitoring dimension in the at least one first monitoring dimension. Taking the login state check service as an example, assuming that at least one first monitoring dimension can be at least one service, correspondingly, the first anomaly monitoring result can represent an anomaly event corresponding to an anomaly service in the at least one service, that is, the service with the anomaly can be determined according to the first anomaly monitoring result, and the service with the anomaly is an anomaly caused by the preset event (corresponding anomaly event).

In an optional embodiment, the determining, based on the first anomaly index data, a first anomaly monitoring result corresponding to the preset service may include:

in the case that the corresponding first abnormal index data in a plurality of adjacent time periods are greater than or equal to a first preset threshold value in the preset event corresponding to any first monitoring dimension, taking the corresponding preset event of the first monitoring dimension, in which the corresponding first abnormal index data in the plurality of adjacent time periods are greater than or equal to the first preset threshold value, as the abnormal event corresponding to the abnormal monitoring dimension;

and generating a first anomaly monitoring result based on the anomaly event corresponding to the anomaly monitoring dimension.

In a specific embodiment, the first preset threshold may be set in conjunction with the actual application. Specifically, the abnormal event corresponding to the abnormal monitoring dimension may be used as the first abnormal monitoring result, and optionally, the abnormal event corresponding to the abnormal monitoring dimension may be converted into a preset data form (for example, a list, etc.) and then used as the first abnormal monitoring result.

In the above embodiment, by combining the first abnormal index data corresponding to the multiple adjacent time periods, the fluctuation trend of the occurrence condition of the preset event corresponding to at least one first monitoring dimension can be effectively reflected, so that the abnormal event corresponding to the abnormal monitoring dimension can be rapidly and accurately determined, and the efficiency and accuracy of monitoring the abnormal service are greatly improved.

In an alternative embodiment, as shown in fig. 5, the method may further include:

in step S209, second occurrence data of an abnormal event corresponding to a preset service in at least one second monitoring dimension is obtained;

in a specific embodiment, the second occurrence data may be the number of occurrences corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension obtained by adding an additional monitoring dimension to the abnormal monitoring dimension. Specifically, the additional monitoring dimension may be a dimension for monitoring a service anomaly added on the basis of the anomaly monitoring dimension determined by combining the first anomaly index data.

In an optional embodiment, it is assumed that the preset service is a login state verification service, and the monitoring requirement is that an abnormal condition of the login state verification service in the abnormal service in at least one area needs to be monitored, and correspondingly, the additional monitoring dimension may be at least one area; the at least one second monitoring dimension may be at least one area corresponding to the at least one abnormal service, that is, the area dimension may be introduced to obtain the abnormal event corresponding to the at least one abnormal service based on the abnormal event corresponding to the at least one abnormal service represented by the first abnormal monitoring result in combination with the first abnormal monitoring result, and the number of times (second occurrence data) that occurs when the login state verification is performed in the at least one area is performed, so as to perform monitoring of the abnormal condition of the login state verification service in the abnormal service in the at least one area. In a specific embodiment, it is assumed that a certain service corresponds to 5 preset events, wherein the first abnormal index data of the 3 preset events corresponding to the service are all greater than a first preset threshold, and correspondingly, when the additional monitoring dimension is at least one area, the occurrence frequency of the 3 preset events of the service in the at least one area may be obtained, and the selected occurrence frequency is the occurrence frequency of the current monitoring period.

In another optional embodiment, it is assumed that the preset service is an information push service, and the monitoring requirement is that abnormality monitoring needs to be performed on the information push service of at least one push application version corresponding to at least one abnormal model, and correspondingly, the additional monitoring dimension may be an application version (push application version) corresponding to at least one information push application, and the at least one second monitoring dimension may be at least one push application version corresponding to at least one abnormal model, that is, the push application version dimension is introduced based on an abnormal event corresponding to at least one abnormal model represented by the first abnormal monitoring result, and the number of times (second occurrence data) that the abnormal event corresponding to at least one abnormal model occurs in the information push service of at least one push application version is obtained by combining the first abnormal monitoring result, so as to perform abnormality monitoring on the information push service of at least one push application version corresponding to at least one abnormal model .

In step S211, inputting the second occurrence data into a second anomaly identification model for anomaly monitoring processing, so as to obtain at least one anomaly event corresponding to a second monitoring dimension, and second anomaly index data corresponding to the current monitoring period;

in a specific embodiment, the second abnormal index data corresponding to the current monitoring period of the abnormal event corresponding to the at least one second monitoring dimension may represent a probability that the preset service is abnormal in the current monitoring period due to the abnormal event in any second monitoring dimension. Specifically, for example, in the scenario where the abnormal condition of the login state verification service in the abnormal service in at least one area needs to be monitored, the second abnormal index data may represent the probability that the login state verification service of the abnormal service is abnormal due to the corresponding abnormal event in the current monitoring period.

In a specific embodiment, the second anomaly monitoring model may be a model obtained by performing anomaly monitoring processing training on a preset machine learning model in advance based on second training data, specifically, the second training data may include second sample occurrence data of an anomaly event corresponding to a preset service in at least one second monitoring dimension and preset anomaly index data corresponding to the second sample occurrence data, where the second sample occurrence data may be occurrence times corresponding to each of a plurality of historical monitoring periods.

In a specific embodiment, the specific refinement of the second anomaly monitoring model trained in advance may be referred to as the specific refinement of the first anomaly monitoring model trained in advance, and is not described herein again.

In a specific embodiment, the method may further include:

filtering the second occurrence data based on the second secondary number threshold to obtain second target occurrence data;

correspondingly, the inputting the second occurrence data into the second anomaly identification model for anomaly monitoring processing to obtain second anomaly index data of the corresponding anomaly event in at least one second monitoring dimension includes:

and inputting the second target occurrence data into a second anomaly identification model for anomaly monitoring processing to obtain second anomaly index data.

In a specific embodiment, the second threshold may be set in conjunction with the actual application. Optionally, the number of occurrences in the second occurrence data that is less than or equal to the second number threshold may be filtered out, so as to obtain the second target occurrence data.

In the above embodiment, the second occurrence data with the lower occurrence frequency is filtered based on the second frequency threshold, and the data associated with the preset service exception in at least one second monitoring dimension can be better screened out, so that the data volume of exception monitoring processing can be reduced on the basis of improving the validity of exception monitoring processing, and the exception monitoring processing efficiency can be improved.

In step S213, a second anomaly monitoring result corresponding to the preset service is determined based on the second anomaly index data.

In a specific embodiment, the second anomaly monitoring result may characterize a target anomaly event corresponding to a target anomaly monitoring dimension in at least one second monitoring dimension. In an optional embodiment, the determining, based on the second anomaly index data, a second anomaly monitoring result corresponding to the preset service may include:

in the preset event corresponding to any second monitoring dimension, under the condition that second abnormal index data corresponding to the current monitoring period is greater than or equal to a second preset threshold, taking the abnormal event corresponding to the second monitoring dimension, of which the second abnormal index data corresponding to the current monitoring period is greater than or equal to the second preset threshold, as a target abnormal event corresponding to the target abnormal monitoring dimension;

and generating a second abnormal monitoring result according to the target abnormal event corresponding to the target abnormal monitoring dimension.

In a specific embodiment, the second preset threshold may be set in connection with the actual application. Specifically, the target abnormal event corresponding to the target abnormal monitoring dimension may be used as the second abnormal monitoring result, and optionally, the target abnormal event corresponding to the target abnormal monitoring dimension may also be converted into a preset data form (for example, a list, etc.) and then used as the second abnormal monitoring result.

In the above embodiment, in combination with the second abnormal index data corresponding to the current monitoring period, the abnormal event corresponding to the second monitoring dimension, where the second abnormal index data corresponding to the current monitoring period is greater than or equal to the second preset threshold, is used as the target abnormal event corresponding to the target abnormal monitoring dimension, so that the abnormal monitoring result in at least one second monitoring dimension can be determined quickly and accurately, and the efficiency and accuracy of monitoring the abnormal service are greatly improved. On the basis of carrying out service abnormity monitoring according to at least one first monitoring dimension, the monitoring dimension is increased by combining a first abnormity monitoring result, abnormity monitoring of different monitoring dimensions can be realized, different monitoring requirements are met, the abnormity monitoring accuracy and the effective alarm rate can be improved better, and the abnormity false alarm probability is reduced.

In an optional embodiment, when the preset service is a login-state verification service, the at least one first monitoring dimension is at least one service, and the additional monitoring dimension is at least one area (for example, at least one city, at least one province, and the like), the second anomaly monitoring result may represent a target anomaly event in an anomaly area corresponding to the anomalous service, and optionally, the method may further include:

taking the area, corresponding to the second abnormal index data, of the at least one area, wherein the second abnormal index data is larger than or equal to a second preset threshold value as an abnormal area;

determining the number of first areas corresponding to the abnormal areas and the number of second areas corresponding to the target areas;

correspondingly, the generating a second anomaly monitoring result according to the target anomaly event corresponding to the target anomaly monitoring dimension includes:

and under the condition that the first area quantity is greater than the first area threshold value and the second area quantity is greater than the second area threshold value, generating a second abnormity monitoring result according to a target abnormity event corresponding to the target abnormity monitoring dimension.

In a specific embodiment, the first region threshold and the second region threshold may be set in combination with an actual application, wherein the first region threshold is smaller than the second region threshold. Specifically, the target area is an area participating in the anomaly monitoring process in at least one area.

In practical application, under the condition that the number of first areas of abnormal areas of which the second abnormal index data is greater than or equal to the second preset threshold is greater than the first area threshold and the number of second areas of target areas participating in the abnormal monitoring processing is greater than the second area threshold, the validity of the target abnormal event corresponding to the target abnormal monitoring dimension determined by combining the second abnormal index data can be represented, and then a second abnormal monitoring result can be generated according to the target abnormal event corresponding to the target abnormal monitoring dimension.

In the above embodiment, in the abnormal monitoring processing process of the login state verification service, by combining the first area number of the abnormal areas with the second abnormal index data being greater than or equal to the second preset threshold and the second area number of the target area participating in the abnormal monitoring processing, the effectiveness of identifying the target abnormal event corresponding to the target abnormal monitoring dimension can be better improved, and then the area information corresponding to the service invaded by the blackout product can be accurately determined, so that the accuracy and the effectiveness of the abnormal monitoring of the service are better improved.

In a specific embodiment, under the condition of obtaining the anomaly monitoring result, the relevant personnel can timely perform corresponding repair processing on the anomaly factor (an anomaly event corresponding to a certain anomaly service), so that normal processing of the service can be ensured.

As can be seen from the technical solutions provided by the embodiments of the present specification, the present specification uses the first occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension as the input of the first anomaly monitoring model to perform anomaly monitoring processing, so as to implement anomaly monitoring according to the monitoring dimension, improve the generality of anomaly monitoring in different service scenes, and the first occurrence data is the occurrence frequency corresponding to each of multiple adjacent time periods in the current monitoring period, so as to effectively reflect the abnormal fluctuation trend of the service, effectively ensure the accuracy of the obtained first anomaly index data in representing the abnormal probability of the preset service in each adjacent time period in the first monitoring dimension due to any preset event, and further based on the first anomaly index data, the abnormal factors can be quickly and accurately positioned, thereby greatly improving the efficiency and accuracy of service anomaly monitoring, therefore, the effective alarm rate is improved, and abnormal conditions of the service are reduced.

Fig. 6 is a block diagram illustrating a traffic anomaly monitoring device according to an exemplary embodiment. Referring to fig. 6, the apparatus includes:

a first occurrence data obtaining module 610, configured to perform obtaining first occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension, where the first occurrence data is occurrence times corresponding to each of multiple adjacent time periods in a current monitoring period;

a first anomaly monitoring processing module 620, configured to perform input of the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing, so as to obtain at least one preset event corresponding to at least one first monitoring dimension, and corresponding first anomaly index data in multiple adjacent time periods;

the first anomaly monitoring result determining module 630 is configured to determine a first anomaly monitoring result corresponding to the preset service based on the first anomaly index data, where the first anomaly monitoring result represents an anomaly event corresponding to an anomaly monitoring dimension in at least one first monitoring dimension.

In an optional embodiment, the apparatus further comprises:

the first anomaly monitoring processing module 620 is further configured to perform anomaly monitoring processing by inputting the first target occurrence data into the first anomaly monitoring model, so as to obtain first anomaly index data.

In an optional embodiment, the first anomaly monitoring result determining module 630 includes:

the first anomaly determination unit is configured to execute a preset event corresponding to any first monitoring dimension, and when the corresponding first anomaly index data in a plurality of adjacent time periods are greater than or equal to a first preset threshold value, the preset event corresponding to the first monitoring dimension with the corresponding first anomaly index data in the plurality of adjacent time periods greater than or equal to the first preset threshold value is taken as an anomaly event corresponding to the anomaly monitoring dimension;

and the first anomaly monitoring result generation unit is configured to execute an anomaly event corresponding to the anomaly monitoring dimension and generate a first anomaly monitoring result.

In an optional embodiment, the apparatus further comprises:

the second occurrence data acquisition module is configured to execute acquisition of second occurrence data of an abnormal event corresponding to a preset service in at least one second monitoring dimension, the second occurrence data is the occurrence frequency corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension obtained by adding an additional monitoring dimension to the abnormal monitoring dimension;

the second anomaly monitoring processing module is configured to input the second occurrence data into a second anomaly identification model for anomaly monitoring processing to obtain at least one anomaly event corresponding to a second monitoring dimension and second anomaly index data corresponding to the current monitoring period;

and the second anomaly monitoring result determining module is configured to determine a second anomaly monitoring result corresponding to the preset service based on the second anomaly index data, and the second anomaly monitoring result represents a target anomaly event corresponding to a target anomaly monitoring dimension in at least one second monitoring dimension.

and the second abnormity monitoring result generation unit is configured to execute the target abnormity event corresponding to the target abnormity monitoring dimension and generate a second abnormity monitoring result.

In an optional embodiment, the preset service is a login state verification service, the at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, and the second abnormal monitoring result represents a target abnormal event in an abnormal area corresponding to an abnormal service, where the apparatus further includes:

the abnormal area determining module is configured to execute the area, corresponding to the second abnormal index data in the at least one area, of which the second abnormal index data is larger than or equal to a second preset threshold value as an abnormal area;

the second area number determining module is configured to determine a first area number corresponding to the abnormal area and a second area number corresponding to a target area, wherein the target area is an area participating in the abnormal monitoring processing in at least one area;

the second anomaly monitoring result generation unit is further configured to execute generation of a second anomaly monitoring result according to a target anomaly event corresponding to the target anomaly monitoring dimension when the first area number is larger than the first area threshold and the second area number is larger than the second area threshold.

In an optional embodiment, the apparatus further comprises:

the second data filtering module is configured to filter the second occurrence data based on the second secondary number threshold to obtain second target occurrence data;

the second abnormity monitoring and processing module is also configured to input the second target occurrence data into the second abnormity identification model for abnormity monitoring and processing to obtain second abnormity index data.

In an optional embodiment, the apparatus further comprises:

the system comprises a training data module, a data processing module and a data processing module, wherein the training data module is configured to execute acquisition of first sample occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension and preset abnormal index data corresponding to the first sample occurrence data, and the first sample occurrence data are occurrence times corresponding to a plurality of adjacent historical time periods in a plurality of historical monitoring periods;

the third anomaly monitoring processing module is configured to input the first sample occurrence data into a preset machine learning model for anomaly monitoring processing to obtain at least one preset event corresponding to at least one first monitoring dimension and corresponding sample anomaly index data in a plurality of adjacent historical time periods;

a target loss information determination module configured to perform determining target loss information according to preset abnormal index data and sample abnormal index data;

and the model training module is configured to train a preset machine learning model based on the target loss information to obtain a first anomaly monitoring model.

With regard to the apparatus in the above-described embodiment, the specific manner in which each module performs the operation has been described in detail in the embodiment related to the method, and will not be elaborated here.

Fig. 7 is a block diagram of an electronic device for monitoring traffic anomaly, which may be a terminal according to an exemplary embodiment, and the internal structure diagram of the electronic device may be as shown in fig. 7. The electronic device comprises a processor, a memory, a network interface, a display screen and an input device which are connected through a system bus. Wherein the processor of the electronic device is configured to provide computing and control capabilities. The memory of the electronic equipment comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the electronic device is used for connecting and communicating with an external terminal through a network. The computer program is executed by a processor to implement a traffic anomaly monitoring method. The display screen of the electronic equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the electronic equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the electronic equipment, an external keyboard, a touch pad or a mouse and the like.

Fig. 8 is a block diagram of an electronic device for monitoring traffic anomalies, which may be a server, according to an exemplary embodiment, and the internal structure thereof may be as shown in fig. 8. The electronic device includes a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the electronic device is configured to provide computing and control capabilities. The memory of the electronic equipment comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the electronic device is used for connecting and communicating with an external terminal through a network. The computer program is executed by a processor to implement a traffic anomaly monitoring method.

It will be understood by those skilled in the art that the configurations shown in fig. 7 or fig. 8 are only block diagrams of some configurations relevant to the present disclosure, and do not constitute a limitation on the electronic device to which the present disclosure is applied, and a particular electronic device may include more or less components than those shown in the drawings, or combine some components, or have a different arrangement of components.

In an exemplary embodiment, there is also provided an electronic device including: a processor; a memory for storing the processor-executable instructions; wherein the processor is configured to execute the instructions to implement the traffic anomaly monitoring method as in the embodiments of the present disclosure.

In an exemplary embodiment, a computer readable storage medium is also provided, and when instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the traffic anomaly monitoring method in the embodiment of the present disclosure.

In an exemplary embodiment, a computer program product containing instructions is also provided, which when run on a computer, causes the computer to perform the traffic anomaly monitoring method in the embodiments of the present disclosure.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the disclosure following, in general, the principles of the disclosure and including such departures from the present disclosure as come within known or customary practice within the art to which the disclosure pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the disclosure being indicated by the following claims.

It will be understood that the present disclosure is not limited to the precise arrangements that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for monitoring service abnormity is characterized by comprising the following steps:

2. The traffic anomaly monitoring method according to claim 1, characterized in that said method further comprises:

3. The method for monitoring business anomaly according to claim 1, wherein the determining a first anomaly monitoring result corresponding to the preset business based on the first anomaly index data includes:

4. The method for monitoring traffic anomaly according to any one of claims 1 to 3, wherein said method further comprises:

acquiring second occurrence data of the abnormal event corresponding to the preset service under at least one second monitoring dimension, wherein the second occurrence data is the occurrence frequency corresponding to the current monitoring period, and the at least one second monitoring dimension is a monitoring dimension obtained after an additional monitoring dimension is added to the abnormal monitoring dimension;

5. The method for monitoring business anomaly according to claim 4, wherein the determining a second anomaly monitoring result corresponding to the preset business based on the second anomaly index data includes:

6. The method according to claim 5, wherein the preset service is a login state check service, the at least one first monitoring dimension is at least one service, the additional monitoring dimension is at least one area, and the second anomaly monitoring result represents a target anomaly event in an anomaly area corresponding to the anomaly service, the method further comprising:

7. A traffic anomaly monitoring device, comprising:

the system comprises a first occurrence data acquisition module, a second occurrence data acquisition module and a monitoring module, wherein the first occurrence data acquisition module is configured to execute acquisition of first occurrence data of at least one preset event corresponding to a preset service in at least one first monitoring dimension, and the first occurrence data is the occurrence times corresponding to a plurality of adjacent time periods in a current monitoring period;

a first anomaly monitoring processing module configured to perform input of the first occurrence data into a first anomaly monitoring model for anomaly monitoring processing to obtain at least one preset event corresponding to the at least one first monitoring dimension, and first anomaly index data corresponding to the at least one first monitoring dimension in the plurality of adjacent time periods;

8. An electronic device, comprising:

a processor;

a memory for storing the processor-executable instructions;

wherein the processor is configured to execute the instructions to implement the traffic anomaly monitoring method of any one of claims 1 to 6.

9. A computer readable storage medium, wherein instructions in the storage medium, when executed by a processor of an electronic device, enable the electronic device to perform the traffic anomaly monitoring method of any one of claims 1-6.

10. A computer program product comprising computer instructions, wherein the computer instructions, when executed by a processor, implement the traffic anomaly monitoring method of any one of claims 1 to 6.