CN115858291A

CN115858291A - System index detection method and device, electronic equipment and storage medium thereof

Info

Publication number: CN115858291A
Application number: CN202211569513.5A
Authority: CN
Inventors: 张大发; 李天昊; 段立娜
Original assignee: China Post Information Technology Beijing Co ltd
Current assignee: China Post Information Technology Beijing Co ltd
Priority date: 2022-12-08
Filing date: 2022-12-08
Publication date: 2023-03-28

Abstract

The invention discloses a method and a device for detecting system indexes, electronic equipment and a storage medium thereof. The method comprises the steps of carrying out prediction processing on an index item in a target system based on a prediction model to obtain a prediction result of the index item, wherein the prediction result comprises an index prediction value of the index item at each time point in a prediction time period; determining a dynamic threshold value of the index item at each time point based on the index predicted value of the index item at each time point in the prediction time period; and acquiring actual index data of the target system at each time point, and carrying out anomaly detection on the actual index data based on the dynamic threshold value of the corresponding time point. The threshold values of the system indexes of different systems are automatically set, and the threshold values can be dynamically changed along with time, so that a system operator is not required to set any threshold value and parameter, the system early warning is more accurate and convenient, and the accuracy and the adaptability of system monitoring are improved.

Description

System index detection method and device, electronic equipment and storage medium thereof

Technical Field

The present invention relates to the field of system detection technologies, and in particular, to a method and an apparatus for detecting system indicators, an electronic device, and a storage medium thereof.

Background

With the increasing perfection of informatization construction and the development of big data technology, higher requirements are also put forward on operation and maintenance monitoring of an information system, the monitoring system is required to check the past and current states of each index in the system, and trend analysis is also required to be carried out on each index in a future system.

The current monitoring system can monitor the real-time state of each index in the system and can check the change condition of each index in a certain time; and fixed thresholds can be set for each index, and when the indexes are higher (or lower) than the fixed thresholds, the system gives an alarm prompt.

Based on the above prior art scheme, the system can check past system indexes, set fixed threshold values and judge whether each index of the system is abnormal, but the method has certain limitation, the threshold values of all indexes of different systems are different, and only one fixed threshold value is used, so that the monitoring requirement of the current system cannot be met.

Disclosure of Invention

The invention provides a method and a device for detecting system indexes, electronic equipment and a storage medium thereof, which are used for solving the problem that accurate trend analysis cannot be carried out on the system indexes.

According to an aspect of the present invention, a method for detecting a system index is provided, including:

performing prediction processing on the index items in the target system based on the prediction model to obtain prediction results of the index items, wherein the prediction results comprise index prediction values of the index items at all time points in a prediction time period;

determining a dynamic threshold value of the index item at each time point based on the index predicted value of the index item at each time point in the prediction time period;

and acquiring actual index data of the target system at each time point, and carrying out anomaly detection on the actual index data based on the dynamic threshold value of the corresponding time point.

Optionally, the number of the index items is multiple; the method further comprises the following steps:

acquiring historical index data of each index item of a target system in a historical time period;

for any index item, a prediction model corresponding to the index item is created based on the historical index data of the index item.

Optionally, creating a prediction model corresponding to the index item based on the historical index data of the index item, including:

determining a model item included in the prediction model according to the time span of the historical index data, and forming an initial prediction model based on the determined model item, wherein the model item comprises a trend item, a season item, a holiday item and an error item;

and performing regression processing on the initial prediction model based on the historical index data of the index item to obtain a prediction model corresponding to the index item.

Optionally, the dynamic threshold includes an upper threshold and a lower threshold; determining a dynamic threshold value of the index item at each time point based on the index predicted value of the index item at each time point in the prediction time period, wherein the determining comprises the following steps:

drawing a prediction baseline based on the index prediction value of the index item at each time point in the prediction time period; forming an upper interval line based on the peak point in the prediction baseline, and determining an upper limit threshold of each time point based on the upper interval line; forming a lower interval line based on a valley point in the prediction baseline, and determining a lower threshold value of each time point based on the lower interval line;

or, for the index predicted value at any time point, determining a corresponding upper limit threshold value and a corresponding lower limit threshold value based on a preset positive error and a preset negative error.

Optionally, after performing prediction processing on the index item in the target system based on the prediction model to obtain a prediction result of the index item, the method further includes:

and carrying out one or more of the following abnormal detections on the index predicted value of each time point in the prediction time period: data missing, data abnormal fluctuation.

Optionally, the method for detecting a system index further includes:

and generating early warning information under the condition that any index is detected to be abnormal, and carrying out visual display on the early warning information.

and generating early warning information under the condition that any index is detected to be abnormal, and visually displaying the early warning information.

Optionally, the early warning information includes abnormal time information and abnormal indexes; and visually displaying the early warning information, comprising the following steps:

and for any index item, under the condition that the index item is determined to have abnormality at the current time point and abnormality at the previous time point, adjusting the time information in the displayed early warning information based on the current time point, wherein the adjusted time information is a continuous time period comprising an abnormality starting time point and the current time point.

According to another aspect of the present invention, there is provided a system index detection apparatus, including:

the prediction result determining module is used for performing prediction processing on the index items in the target system based on the prediction model to obtain the prediction results of the index items, and the prediction results comprise the index prediction values of the index items at all time points in the prediction time period;

the dynamic threshold determining module is used for determining the dynamic threshold of the index item at each time point based on the index predicted value of the index item at each time point in the prediction time period;

and the anomaly detection module is used for acquiring the actual index data of the target system at each time point and carrying out anomaly detection on the actual index data based on the dynamic threshold value of the corresponding time point.

According to another aspect of the present invention, there is provided an electronic apparatus including:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

the memory stores a computer program executable by the at least one processor, the computer program being executable by the at least one processor to enable the at least one processor to perform the method for detecting a system indicator of any embodiment of the invention.

According to another aspect of the present invention, there is provided a computer-readable storage medium storing computer instructions for causing a processor to implement the method for detecting a system index according to any one of the embodiments of the present invention when the computer instructions are executed.

According to the technical scheme of the embodiment of the invention, through a detection method of the system, detection and analysis of historical index data are combined to obtain index predicted values of different time periods, dynamic threshold values are determined according to the index predicted values, abnormal detection is carried out on future indexes of the system according to the dynamic threshold values, and the detected abnormal information is visually displayed through the system, so that the limitation of threshold value setting is avoided, namely the situation that the same fixed alarm threshold value is used by the same index, the problem that trend analysis and abnormal detection cannot be accurately carried out on the system indexes is solved, the system can carry out trend analysis on different system indexes, the alarm threshold values suitable for the current system indexes are further obtained, the early warning accuracy of the system is improved, and the alarm threshold values are more in line with the characteristics of the system indexes.

It should be understood that the statements in this section do not necessarily identify key or critical features of the embodiments of the present invention, nor do they necessarily limit the scope of the invention. Other features of the present invention will become apparent from the following description.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

Fig. 1 is a flowchart of a method for detecting a system index according to an embodiment of the present invention;

fig. 2 is a flowchart of a method for detecting a system index according to a second embodiment of the present invention;

fig. 3 is a schematic structural diagram of a system index detection apparatus according to a third embodiment of the present invention;

fig. 4 is a schematic structural diagram of an electronic device implementing the method for detecting a system index according to the embodiment of the present invention.

Detailed Description

In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be obtained by a person skilled in the art without making any creative effort based on the embodiments in the present invention, shall fall within the protection scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Moreover, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Example one

Fig. 1 is a flowchart of a method for detecting a system index according to an embodiment of the present invention, where the method is applicable to a situation of trend analysis and alarm prompt of an index, and the method may be executed by a device for detecting a system index, where the device for detecting a system index may be implemented in a form of hardware and/or software, and the device for detecting a system index is generally configured in a server. As shown in fig. 1, the method includes:

and S110, performing prediction processing on the index items in the target system based on the prediction model to obtain prediction results of the index items, wherein the prediction results comprise index prediction values of the index items at all time points in a prediction time period.

The prediction model is a model for inferring unknown data according to known data, and may be constructed using a neural network model, a function model, a time series model, or the like, where the construction manner is not limited, and correspondingly, the prediction model may be a neural network model, a function model, or the like. The target system is a detected system, which may include, but is not limited to, a computer system, a cluster system, and the like. The index item is one or more indexes for measuring the state of the target system, and may include, but is not limited to, a system processor utilization rate, an error rate, the number of concurrent users, the number of pages, idle time, and the like, and the types and the numbers of the index items corresponding to different systems may be different. The index item corresponding to the target system can be determined according to the type of the target system and the detection requirement. In some embodiments, a set of detectable indicator items may be determined according to a type of a target system, the set of indicator items may be displayed through a display interface, and an indicator item for prediction may be determined according to a selection operation for the displayed indicator item. In some embodiments, a set of detectable indicator items may be determined according to the type of the target system, and all indicator items in the set of indicator items may be determined as detected indicator items.

The prediction time period may be understood as a time period set by the prediction model to predict the trend change of the index item of the target system, and the starting time of the time period is the current time, the prediction time period may be set according to the time period of the historical data and the error requirement, and may be set to be 1 day, one week, and the like in the future after the current time, and the error rate is higher for the same historical data time period as the prediction time period is longer.

Specifically, each index item in the target system is subjected to prediction processing through a prediction model, index values of each system index item at each time point in a prediction time period are obtained, and a set of the index values corresponding to the time points is used as a prediction result of the index item. Generally, the granularity of each time point in the prediction time period is consistent with the granularity of the historical training data, and the more the historical training data is, the smaller the granularity is, the higher the accuracy of the prediction is.

Illustratively, the index item of the utilization rate of the system processor is predicted through a prediction model, the trend change of the index item in the future month is predicted, namely the prediction result of the prediction model is the utilization rate of the processor at each time point in the future month, and the prediction model is used for predicting the index value corresponding to each day in the future month to obtain the prediction result.

Optionally, the number of the index items is multiple, and correspondingly, the multiple index items can be respectively predicted to obtain the prediction data corresponding to each index item. Optionally, any one of the index items may respectively correspond to one prediction model, and according to the index item to be predicted, the corresponding prediction model may be respectively called, so as to perform prediction processing on the corresponding index item through the plurality of prediction models.

Further, the prediction model corresponding to each index item may be created in advance. The types of the prediction models corresponding to the index items may be the same or different. The creating process of the prediction model may be: acquiring historical index data of each index item of a target system in a historical time period; for any index item, a prediction model corresponding to the index item is created based on the historical index data of the index item.

The historical time period refers to a certain past time period, and may be understood as a time interval from a certain past time point to a current time point, which is a historical time period, and may be an hour, a day, a week, a month, a quarter, a year, and the like. Optionally, after the historical index data is collected, data cleaning may be performed on the collected historical index data, and accordingly, a prediction model is created based on the historical index data after the data cleaning. The historical index data is a data set formed by actual index values corresponding to each index item acquired by the system in a historical time period, and can be read from a database in the system through a data acquisition module, acquired from a system server or acquired from a big data system. When the historical index data is collected, attention needs to be paid to the periodicity of the collected historical index data, the granularity of the collected historical index data, the total period of the collected data, the storage of the collected data and the like, and the collected data is the index data with periodicity; the collected data should be periodic service data; the smaller the data granularity is, the longer the total data period is, and the more accurate the established prediction model and trend analysis are; because the amount of data stored is large, a large data system with good performance should also be used. Of course, the periodicity, granularity, and total period of data acquisition depends on the data source.

Specifically, historical index data corresponding to index items needing trend analysis and early warning are collected from the system at regular time through the data collection module, index data corresponding to each index item are obtained, the index data collected at regular time can be stored in a database or a server in advance, and a data basis is provided for prediction of a subsequent prediction model.

And respectively creating prediction models which accord with each index property according to the collected different index items and the corresponding historical index data. Wherein, the creating process of the prediction model can be determined according to the type of the prediction model. For any index item, a training set and a verification set can be formed according to historical index data of the index item, and the created initial prediction model is subjected to iterative training in a supervised training mode to obtain a trained prediction model. Illustratively, the prediction model may be a function model, an initial function model is created, the initial function model may include undetermined parameters, and the undetermined parameters in the initial function model are determined based on historical index data of any index item, so as to obtain a trained prediction model.

Optionally, creating a prediction model corresponding to the index item based on the historical index data of the index item, including: determining a model item included in the prediction model according to the time span of the historical index data, and forming an initial prediction model based on the determined model item, wherein the model item comprises a trend item, a season item, a holiday item and an error item; and performing regression processing on the initial prediction model based on the historical index data of the index item to obtain a prediction model corresponding to the index item.

The time span refers to a certain time length spanned or continued by collecting the historical index data, that is, the duration of the historical time period, and may include, but is not limited to, a year, a season, a month, a day, and the like. Can be defined by the difference of the known end time minus the start time. The model item is preset, the model item can be a plurality of model items, and different prediction models can be formed according to the screened model items. Here, the determination of the model item is determined according to the time span of the historical index data, for example, if the time span of the collected historical index data is a quarter, one of the model items used may be determined to be a season item. The model terms include, but are not limited to, a trend term, a seasonal term, a holiday term, and an error term. If the historical index data obtained in the time span has periodic variation, such as week season, year season and the like, the season item can be used as one item in the model item; if the non-periodic variation exists in the historical index data obtained in the time span and the non-periodic variation needs to be modeled to obtain the trend variation, the trend item can be used as one item in the model items; if there is a case of a holiday effect or an emergency that affects one or consecutive days in a time span, it is necessary to take the holiday term as one of the model terms, wherein the holiday term can be used for periodic prediction on holidays such as statutory holidays and set holidays such as saturday and the like, which are regulated by law. The holiday is set as a popular activity day or a date capable of influencing data change, different application scenes can correspond to different set holidays, and for example, the set holiday includes, but is not limited to, 11 months and 11 days (only illustrated here) by taking an e-commerce transaction scene as an example. If there is a specific change in the historical index data over a time span that cannot be identified by the predictive model, an error term is required as one of the model terms.

Specifically, whether periodic change, aperiodic change, holiday effect, specific change which cannot be identified by the model and the like exist or not is analyzed according to the time span of historical index data, any one or more of a trend term, a quarterly term, a holiday term and an error term can be combined according to the analyzed result to obtain a model term, all selected model terms are fitted through a fitting model, addition modeling is used, and the obtained model serves as an initial prediction model.

Exemplarily, since the historical index data is data collected at fixed time and conforms to elements formed by time series, an initial prediction model is constructed according to time dimension and corresponding index items, and can be realized by a prophet algorithm; the temporal sequence y (t) is divided into the following parts as in prophet algorithm:

y(t)＝g(t)+s(t)+h(t)+r(t)

wherein g (t) represents a trend item which represents the variation trend of the time series on the non-periodic surface; s (t) represents a seasonal term, and a seasonal model is used to fit the periodic variations, typically in units of weeks or years; h (t) represents a holiday term which represents whether holidays exist on the same day; r (t) represents an error term or residual term, i.e., a specific change that cannot be identified by the model. The above-mentioned model terms are distributed as function terms of time t, and correspondingly, the formed model is a function term of time t. Fitting the model items to obtain corresponding function models, performing additive fitting on each function model to obtain an initial prediction model, and performing regression processing on the initial prediction model to obtain a prediction model. The regression processing may be implemented by using a machine learning model or a regression algorithm. The trend term g (t) has two important functions, one is based on a logistic regression function (logistic function), and the other is based on a piecewise linear function (logistic function). In the prediction process of the prediction model, after the historical index data are segmented, iterative fitting of the data is carried out, and the obtained prediction index data are spliced to complete integral data curve description.

In this embodiment, the collected historical index data is used as a data basis, and techniques such as a model item determination method, a prophet algorithm, a time series, function model accumulation, a regression model and the like are introduced to obtain a prediction model. And taking the collected historical index data as learning data of a prediction model, and learning and training the corresponding historical index data by the prediction model. Since the historical index data are collected through the time dimension, the time point can be used as an independent variable, the prediction index data of the corresponding index can be obtained as a dependent variable, the dependent variable and the independent variable are connected through the prediction model, the index data of the prediction time period can be predicted, the time point in the prediction time period can be used as the independent variable to be input into the prediction model, and therefore the prediction result can be obtained. The prediction model established by the method effectively combines the historical index data, so that the established prediction model is more consistent with the characteristics of the index data, and the accuracy and the adaptability of the establishment of the prediction model are improved.

And S120, determining the dynamic threshold value of the index item at each time point based on the index predicted value of the index item at each time point in the prediction time period.

The dynamic threshold refers to a threshold that changes with time, and it can be understood that the dynamic threshold is an upper limit value and a lower limit value of an interval that can be reached by a system index, and the dynamic threshold can be obtained through a prediction model, a neural network model, a bimodal method, or the like.

Optionally, the dynamic threshold includes an upper threshold and a lower threshold.

In some embodiments, determining the dynamic threshold of the index item at each time point based on the index predicted value of the index item at each time point in the prediction time period includes: drawing a prediction base line based on the index prediction value of the index item at each time point in the prediction time period; forming an upper interval line based on the peak point in the prediction baseline, and determining an upper limit threshold of each time point based on the upper interval line; a lower interval line is formed based on a valley point in the prediction baseline, and a lower threshold value for each time point is determined based on the lower interval line.

The prediction baseline can be a baseline obtained by connecting the index prediction values according to a certain rule, the rule can be that all the index prediction values are directly connected according to a time sequence, and the obtained curve is the prediction baseline. The peak point refers to an upward protruding point of the prediction base line, and the peak point of the prediction base line is plural.

For example, a new time point which may cause trend change is set on the basis of the established prediction model, and the whole data index prediction sequence is obtained by splicing with the prediction sequence. In the system, data training is carried out through 3 months of historical index data, the data are used for predicting corresponding system indexes, the trend of the index items in the future 7 days is judged, the dynamic baseline is constructed and drawn according to trend analysis data, the trend dynamic baseline is generated through mimicry and comprises an index predicted value line, an upper interval line of the index predicted value and a lower interval line of the index predicted value, the dynamic baseline is continuously modified through the learning process, the baseline composition of the supervised learning type is realized, and the modes of monitoring the indexes and early warning through human intervention are reduced.

On the basis of the above embodiment, the determination manner of the upper and lower dividing lines may also be: and determining a change point in the index predicted value of the index item at each time point in the prediction time period, and determining an upper section line and a lower section line through the change point. The change point may be a data point where the data change amount satisfies a specific condition, for example, the specific condition may be that the growth rate satisfies a growth rate threshold. The upper section line may be formed by connecting the transition points having data values greater than a first specific value, and the lower section line may be formed by connecting the transition points having data values less than a second specific value.

In some embodiments, determining the dynamic threshold of the indicator at each time point based on the indicator predicted value of the indicator at each time point in the prediction time period comprises: and constructing a dynamic baseline of the index predicted value of the index item at each time point in the prediction time period to obtain a prediction baseline, an upper interval line and a lower interval line. Specifically, the index prediction value of the target item at each time point in the prediction time period may be input into the dynamic baseline fitting model, so as to obtain the prediction baseline, the upper interval line, and the lower interval line output by the dynamic baseline fitting model. The dynamic baseline fitting model can be a machine learning model and is obtained through training of a large amount of sample data. Further, the upper threshold value of each time point is determined based on the upper section line, and the lower threshold value of each time point is determined based on the lower section line.

Optionally, for the index predicted value at any time point, the corresponding upper threshold and lower threshold are determined based on a preset positive and negative error.

The positive and negative errors refer to the difference between the index predicted value and the actual value, and are preset by a system operator according to the actual condition of the system.

Specifically, if the positive and negative error values δ are preset by the prediction model, the corresponding upper threshold is the result obtained by adding δ to the predicted index value, and similarly, the corresponding lower threshold is the result obtained by subtracting δ from the predicted index value.

In this embodiment, a dynamic threshold is determined by a dynamic baseline method or a method of presetting positive and negative errors based on an index prediction value given by a prediction model as data. Because the dynamic baseline is drawn or the positive and negative errors are preset based on the index predicted value, the problem of dynamic setting of the threshold is solved, and a basis is provided for the early warning system to accurately perform early warning.

S130, acquiring actual index data of the target system at each time point, and performing anomaly detection on the actual index data based on the dynamic threshold value of the corresponding time point.

The abnormal detection refers to identifying data different from normal system index data and data with large difference from expected behaviors. Whether the system index is abnormal or not can be detected through the abnormality detection model.

In some embodiments, the manner of anomaly detection may be: and matching the actual index data and the dynamic threshold value at the same time point, wherein if the actual index data is contained in the dynamic threshold value, the system index data is normal, and conversely, if the actual index data is not contained in the dynamic threshold value, the system index data is abnormal.

In this embodiment, through comparison between the dynamic threshold and the actual index data, the result of whether the system index is abnormal or not can be automatically obtained. Due to the adoption of the comparison mode, the system can accurately judge whether the system index at the moment is normal or not, and a certain reference is provided for system early warning.

In some embodiments, the manner of anomaly detection may be: and performing annular comparison on the obtained actual index data and the dynamic threshold, and determining whether the abnormality exists according to an environment comparison result. Specifically, according to the time period, historical index data having time point matching with the actual index data in each historical time period is determined, and the actual index data is compared with the historical index data matched with each historical time period to determine an annular comparison result of the actual index data. And if the annular comparison result comprises the conditions of data steep increase, data steep decrease, data missing and the like, determining that the system index data is abnormal. The historical index data determining the time matching in the historical time period may be a historical time point determined to have the highest matching degree with the time point of the actual index data in the historical time period, and the historical index data corresponding to the historical time point is determined to have the time point matching with the actual index data.

Further, according to the time period, determining a historical dynamic threshold having a time point matching property with the dynamic threshold of the current time in each historical time period, comparing the dynamic thresholds having the time point matching property in the time period, and determining an annular comparison result of the dynamic thresholds. And determining that the corresponding system index data is abnormal under the condition that the annular comparison result of the actual index data and/or the annular comparison result of the dynamic threshold value is abnormal. Correspondingly, corresponding early warning information is generated to prompt relevant users.

Further, the method for detecting the system index further comprises the following steps: and generating early warning information under the condition that any index is detected to be abnormal, and carrying out visual display on the early warning information.

The abnormal condition of any index can be the condition that the actual system index data exceeds the range of the dynamic threshold value. The early warning information refers to a prompt message for the abnormal information, which can be preset by the system operator according to the historical abnormal information, or dynamically generated by the system according to the actual abnormal information.

Specifically, whether the actual index information is normal or not is obtained by comparing the actual index information with a dynamic threshold value through the early warning system, if the actual index information exceeds the range of the dynamic threshold value, corresponding early warning information is automatically generated and displayed through a visual screen of the system, and a system operator can check the corresponding system index state in time.

Optionally, the early warning information includes abnormal time information and abnormal indexes; carrying out visual display on the early warning information, comprising the following steps: and for any index item, under the condition that the index item is determined to have abnormality at the current time point and abnormality at the previous time point, adjusting the time information in the displayed early warning information based on the current time point, wherein the adjusted time information is a continuous time period comprising an abnormality starting time point and the current time point.

The abnormal time information may be a time point when the system index is abnormal. The abnormal time point can be obtained by a time stamp, or by capturing the time of the current system, etc. The previous time point refers to a certain time point in the prediction time, and if the second time point is set as the current time point, the first time point is the previous time point.

Specifically, if the system index is detected to be abnormal at the previous time point, the system can display a corresponding early warning message to display abnormal index information; if the system index is detected to be abnormal at the current time point, and the abnormal information is completely the same as the abnormal information at the previous time point, the system does not add a new abnormal information for displaying, but updates the time information of the early warning information appearing at the previous time point to be the continuous time period of the abnormal starting time point and the current time point.

Illustratively, if the utilization of the system processor is abnormal, the time is 23:00, the monitoring system displays the early warning information as' 23! "if the same exception occurs at the immediately next time 24, 00, the system no longer adds the warning information, but the generated warning information at the last time is updated to" 23-00-24, and the exception exists in the system processor |! ".

According to the technical scheme, the detected abnormity is converted into the early warning information to be displayed on the visual screen of the detection system, meanwhile, the adjusting function of the early warning information is added, so that a system operator can see the detailed abnormal information of the system rapidly and clearly in real time, the monitoring function of the detection system is improved, due to the adjusting function of the added early warning information, the problem that the abnormal information which continuously appears is displayed on the visual screen one by one to cause difficulty in reading the abnormal information is avoided, and the early warning function of the monitoring system is optimized.

Example two

Fig. 2 is a flowchart of a method for detecting a system index according to a second embodiment of the present invention, which is a supplement to the first embodiment and adds another processing method after obtaining a prediction result. Optionally, the index items in the target system are subjected to prediction processing based on the prediction model, so as to obtain a prediction result of the index items; the prediction result comprises an index prediction value of the index item at each time point in the prediction time period; and carrying out one or more of the following abnormal detections on the index predicted value of each time point in the prediction time period: data missing, data abnormal fluctuation; and generating early warning information under the condition that any index is detected to be abnormal, and carrying out visual display on the early warning information. As shown in fig. 2, the method includes:

s210, prediction processing is carried out on the index items in the target system based on the prediction model, and prediction results of the index items are obtained, wherein the prediction results comprise index prediction values of the index items at all time points in a prediction time period.

S220, carrying out one or more of the following abnormal detections on the index predicted value of each time point in the prediction time period: data missing, data anomalous fluctuations.

The abnormal data fluctuation refers to the fluctuation of an index affected by a short-term or sudden event, and the expression includes, but is not limited to, abnormal situations of data increase and data drop. The prediction may be performed by a prediction model, a neural network model, a dynamic baseline model, or the like.

Illustratively, a dynamic baseline is used as a monitoring index item, numerical values in an index area are evaluated, specific indexes at the same time in the past 21 days are annularly compared with numerical values in the dynamic baseline, when abnormal values (including numerical value increase, numerical value decrease, numerical value disappearance and the like) occur, the corresponding monitoring abnormal indexes in monitoring records are judged, performance area values of the index item in the past 21 days are judged, data construction and drawing are carried out according to trend analysis data, trend dynamic early warning is generated in a mimicry mode, and the recorded abnormal values and the possibility of occurrence in the mimicry mode are warned through a warning rule mechanism and pushed to an early warning platform for early warning.

And S230, generating early warning information under the condition that any index is detected to be abnormal, and carrying out visual display on the early warning information.

According to the technical scheme, the monitoring range of the early warning system is more comprehensive by monitoring the conditions of data loss and abnormal fluctuation, the monitoring capability of the early warning system is improved, and powerful help is provided for system operation and maintenance.

EXAMPLE III

Fig. 3 is a schematic structural diagram of a system index detection apparatus according to a third embodiment of the present invention. As shown in fig. 3, the apparatus includes:

the prediction result determining module 310 is configured to perform prediction processing on the index items in the target system based on the prediction model to obtain prediction results of the index items, where the prediction results include index prediction values of the index items at various time points in a prediction time period;

a dynamic threshold determining module 320, configured to determine a dynamic threshold of the indicator item at each time point in the prediction time period based on the indicator predicted value of the indicator item at each time point in the prediction time period;

the anomaly detection module 330 is configured to obtain actual index data of the target system at each time point, and perform anomaly detection on the actual index data based on a dynamic threshold of the corresponding time point.

Optionally, the prediction result determining module 310 further includes:

the historical index data acquisition unit is used for acquiring the historical index data of each index item of the target system in a historical time period;

and the prediction model construction unit is used for creating a prediction model corresponding to the index item based on the historical index data of the index item for any index item.

Optionally, the prediction model building unit is specifically configured to:

and determining model items included in the prediction model according to the time span of the historical index data, and forming an initial prediction model based on the determined model items, wherein the model items comprise a trend item, a seasonal item, a holiday item and an error item.

Optionally, the dynamic threshold determining module 320 is specifically configured to:

drawing a prediction baseline based on the index prediction value of the index item at each time point in the prediction time period; forming an upper interval line based on the peak point in the prediction baseline, and determining an upper limit threshold of each time point based on the upper interval line; a lower interval line is formed based on a valley point in the prediction baseline, and a lower threshold value for each time point is determined based on the lower interval line.

Further, the device still includes the visual module of early warning information, includes:

the early warning information display unit is used for generating early warning information and visually displaying the early warning information under the condition that any index is detected to be abnormal;

and the early warning information adjusting unit is used for adjusting the time information in the displayed early warning information based on the current time point under the condition that the index item is determined to have abnormity at the current time point and the abnormity at the previous time point, wherein the adjusted time information is a continuous time period comprising an abnormity starting time point and the current time point.

The system index detection device provided by the embodiment of the invention can execute the system index detection method provided by any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

Example four

Fig. 4 is a schematic structural diagram of an electronic device according to a fourth embodiment of the present invention. The electronic device 10 is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed herein.

As shown in fig. 4, the electronic device 10 includes at least one processor 11, and a memory communicatively connected to the at least one processor 11, such as a Read Only Memory (ROM) 12, a Random Access Memory (RAM) 13, and the like, wherein the memory stores a computer program executable by the at least one processor, and the processor 11 can perform various suitable actions and processes according to the computer program stored in the Read Only Memory (ROM) 12 or the computer program loaded from a storage unit 18 into the Random Access Memory (RAM) 13. In the RAM 13, various programs and data necessary for the operation of the electronic apparatus 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other via a bus 14. An input/output (I/O) interface 15 is also connected to bus 14.

A number of components in the electronic device 10 are connected to the I/O interface 15, including: an input unit 16 such as a keyboard, a mouse, or the like; an output unit 17 such as various types of displays, speakers, and the like; a storage unit 18 such as a magnetic disk, an optical disk, or the like; and a communication unit 19 such as a network card, modem, wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information/data with other devices via a computer network, such as the internet, and/or various telecommunication networks.

Processor 11 may be a variety of general and/or special purpose processing components having processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various specialized Artificial Intelligence (AI) computing chips, various processors running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, or the like. The processor 11 performs the various methods and processes described above, such as the detection of system indicators.

In some embodiments, the method of detecting a system indicator may be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and/or installed onto the electronic device 10 via the ROM 12 and/or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for detecting a system indicator described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method of detecting the system indicator by any other suitable means (e.g., by means of firmware).

Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), system on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, receiving data and instructions from, and transmitting data and instructions to, a storage system, at least one input device, and at least one output device.

The computer program for implementing the method for detecting a system indicator of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer programs, when executed by the processor, cause the functions/acts specified in the flowchart and/or block diagram block or blocks to be performed. A computer program can execute entirely on a machine, partly on a machine, as a stand-alone software package partly on a machine and partly on a remote machine or entirely on a remote machine or server.

EXAMPLE five

An embodiment of the present invention further provides a computer-readable storage medium, where a computer instruction is stored, where the computer instruction is used to enable a processor to execute a method for detecting a system index, where the method includes:

performing prediction processing on the index items in the target system based on the prediction model to obtain prediction results of the index items, wherein the prediction results comprise index prediction values of the index items at all time points in a prediction time period; determining a dynamic threshold value of the index item at each time point based on the index predicted value of the index item at each time point in the prediction time period; and acquiring actual index data of the target system at each time point, and carrying out anomaly detection on the actual index data based on the dynamic threshold value of the corresponding time point.

In the context of the present invention, a computer-readable storage medium may be a tangible medium that can contain, or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, the computer readable storage medium may be a machine readable signal medium. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which a user may provide input to the electronic device. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic, speech, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), blockchain networks, and the internet.

The computing system may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical host and VPS service are overcome.

It should be understood that various forms of the flows shown above may be used, with steps reordered, added, or deleted. For example, the steps described in the present invention may be executed in parallel, sequentially, or in different orders, and are not limited herein as long as the desired result of the technical solution of the present invention can be achieved.

In the above-described embodiments of the present invention, and are not to be construed as limiting the scope of the invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may be made in accordance with design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting system index is characterized by comprising the following steps:

performing prediction processing on an index item in a target system based on a prediction model to obtain a prediction result of the index item, wherein the prediction result comprises an index prediction value of the index item at each time point in a prediction time period;

determining a dynamic threshold value of the index item at each time point based on an index predicted value of the index item at each time point in a prediction time period;

and acquiring actual index data of the target system at each time point, and performing anomaly detection on the actual index data based on a dynamic threshold value of the corresponding time point.

2. The method according to claim 1, wherein the index item is plural in number;

the method further comprises the following steps:

acquiring historical index data of each index item of the target system in a historical time period;

for any index item, a prediction model corresponding to the index item is created based on historical index data of the index item.

3. The method of claim 2, wherein the creating a prediction model corresponding to the index item based on historical index data of the index item comprises:

4. The method of claim 1, wherein the dynamic threshold comprises an upper threshold and a lower threshold;

determining a dynamic threshold value of the index item at each time point based on the index predicted value of the index item at each time point in a prediction time period, wherein the determining comprises the following steps:

drawing a prediction base line based on the index prediction value of the index item at each time point in a prediction time period; forming an upper interval line based on the peak point in the prediction baseline, and determining an upper threshold value of each time point based on the upper interval line; forming a lower interval line based on a valley point in the prediction baseline, and determining a lower threshold value of each time point based on the lower interval line;

or,

and determining a corresponding upper limit threshold value and a corresponding lower limit threshold value for the index predicted value at any time point based on a preset positive and negative error.

5. The method of claim 1, after performing a prediction process on an index item in a target system based on a prediction model to obtain a prediction result of the index item, further comprising:

6. The method of claim 1 or 5, further comprising:

and generating early warning information under the condition that any one index item is detected to be abnormal, and carrying out visual display on the early warning information.

7. The method of claim 6, wherein the early warning information comprises abnormal time information and an abnormal index;

the visual display of the early warning information comprises:

for any index item, under the condition that the index item is determined to have abnormity at the current time point and the abnormity at the previous time point, adjusting the time information in the displayed early warning information based on the current time point, wherein the adjusted time information is a continuous time period comprising the abnormity starting time point and the current time point.

8. A system index detection device, comprising:

the prediction result determining module is used for performing prediction processing on the index items in the target system based on a prediction model to obtain the prediction results of the index items, and the prediction results comprise the index prediction values of the index items at all time points in a prediction time period;

the dynamic threshold value determining module is used for determining a dynamic threshold value of the index item at each time point in a prediction time period based on the index prediction value of the index item at each time point in the prediction time period;

9. An electronic device, characterized in that the electronic device comprises:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,

the memory stores a computer program executable by the at least one processor to enable the at least one processor to perform the method of detecting a system indicator of any one of claims 1-7.

10. A computer-readable storage medium having stored thereon computer instructions for causing a processor to execute a method for detecting a system index according to any one of claims 1-7.