CN116955071A - Fault classification methods, devices, equipment and storage media - Google Patents

Abstract

The application belongs to the technical field of data analysis, and discloses a fault classification method, device, equipment and storage medium. The application obtains the real-time performance index of the pod container and the host node in the real-time consumption system; performing anomaly detection on the average value of a plurality of single sites at the tail part of the real-time performance index to obtain an anomaly detection result; inputting the abnormal detection result into a fault recognition model to perform fault recognition to obtain a fault recognition result; inputting the fault identification result into a fault classification model for fault prediction to obtain a fault class at the current moment; generating fault information according to the fault category at the current moment, and performing anomaly detection on the average value of a plurality of single sites at the tail of the real-time performance to eliminate the influence of the burr point, and meanwhile, keeping high performance, and performing fault identification and fault classification according to the anomaly detection result to accelerate fault identification and fault classification.

Description

Fault classification methods, devices, equipment and storage media

Technical field

The present invention relates to the technical field of data analysis, and in particular to a fault classification method, device, equipment and storage medium.

Background technique

Fault identification and fault classification in operation and maintenance systems under traditional microservice architecture usually rely heavily on the effect of anomaly detection. Based on the results of anomaly detection, we analyze whether there is a fault in the component and locate the cause of the fault. Fault classification , it is necessary to classify the fault after identifying the specific fault, and identify which type of fault the fault belongs to, such as k8s container cpu load, k8s container read io load, node memory consumption, etc. The commonly used method in the existing technology is to a) select a period of historical data from the system, rely on the experience of artificial experts to filter out some core indicators closely related to the fault, and after filtering out the important indicators, mark the historical moment (usually in minutes) (unit) whether it is a fault, and then use the historical data of these indicators to train a comprehensive classification model to identify faults and fault categories, or b) from a single dimension such as golden business indicators, performance indicators, log data, call chain data, etc. Carry out anomaly detection, and combine the anomaly detection results of various dimensions to locate the fault moment. Based on the abnormal score of each component and the historical call relationship data between components, the root cause of the fault is determined. Generally, the anomaly of the root cause component is located. The indicator is used as the root cause, and the type of fault is determined based on the indicator category. However, the above method has problems such as serious imbalance of sample data, long labeling time, and abnormal detection scores based on indicators that cannot represent the severity of the fault, resulting in low credibility.

The above content is only used to assist in understanding the technical solution of the present invention, and does not represent an admission that the above content is prior art.

Contents of the invention

The main purpose of the present invention is to provide a fault classification method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology cannot simultaneously take into account rapid abnormality detection, fault identification and fault classification.

In order to achieve the above objectives, the present invention provides a fault classification method, which includes the following steps:

Obtain real-time performance indicators of pod containers and host nodes in the real-time consumption system;

Perform anomaly detection on the mean value of several unit points at the tail of the real-time performance indicator to obtain an anomaly detection result;

Input the abnormal detection results into the fault identification model for fault identification, and obtain the fault identification results;

Input the fault identification results into the fault classification model for fault prediction to obtain the fault category at the current moment;

Fault information is generated according to the fault category at the current moment.

Optionally, before inputting the anomaly detection result into the fault identification model for fault identification and obtaining the fault identification result, the method further includes:

Obtain historical performance indicators of pod containers and host nodes;

Group the historical performance indicators to obtain several groups of core indicators;

Traverse historical fault samples in chronological order to obtain a set of historical fault occurrence times;

Determine the historical performance indicator data corresponding to each historical fault node time according to the historical fault occurrence time set;

Perform anomaly detection on each of the historical performance indicator data to obtain anomaly detection results;

The anomaly detection results are input into the initial fault identification model for training to obtain a fault identification model.

Optionally, the step of inputting the anomaly detection results into an initial fault identification model for training, and obtaining the fault identification model, further includes:

Analyze the fault identification results to obtain the first set of abnormal indicators within the first preset time at the fault moment;

Obtain a second set of abnormal indicators that occurred within a second preset time before the fault moment;

Filter the first abnormal indicator set according to the second abnormal indicator set to obtain a new abnormal indicator set that appears after the fault moment;

The new anomaly indicator set is input to the initial fault classification model for training to obtain a fault classification model.

Optionally, inputting the anomaly detection results into an initial fault identification model for training to obtain a fault identification model includes:

Mark the abnormal indicators in the new abnormal indicator set to obtain sample labels. The new abnormal indicator set includes at least one indicator group, and each of the indicator groups includes at least one performance unit indicator;

Determine the abnormal status of the current indicator group according to the sample label;

When the current indicator group is in an abnormal state, count the number of performance unit indicators in the current indicator group that are in an abnormal state and the sample labels;

According to the number of performance unit indicators and the sample labels, a corresponding number of fault identification models are obtained through training, and there is at least one fault identification model.

Optionally, the new abnormal indicator set is input to the initial fault classification model for training to obtain a fault classification model, including:

Analyze the sample labels to determine the fault category;

Obtain the corresponding fault identification result according to the indicator group corresponding to the sample label;

A fault classification model is obtained by training a fault classification algorithm according to the fault category and the fault identification result.

Optionally, the step of inputting the anomaly detection results into a fault identification model for fault identification and obtaining the fault identification results includes:

Analyze the abnormality detection results and determine the grouping information of the real-time performance indicators;

Call the corresponding fault identification model according to the grouping information;

Input the abnormal detection results into the corresponding fault identification model, causing the corresponding fault detection model to analyze the abnormal detection results to obtain analysis results, where the analysis results include the status of the real-time performance indicators;

When there is an abnormality in the real-time performance index in the analysis result, a fault identification result of the real-time performance index is obtained.

Optionally, inputting the fault identification result into a fault classification model for fault prediction to obtain the fault category at the current moment includes:

Determine the sample serial number according to the fault identification result;

Generate a two-dimensional table according to the sample serial number and the corresponding indicator group;

Use the xgboost algorithm to perform fault prediction based on the two-dimensional table to obtain fault prediction results;

The fault category at the current moment is obtained according to the prediction result.

In addition, to achieve the above objectives, the present invention also proposes a fault classification device, which includes:

The indicator acquisition module is used to obtain real-time performance indicators of pod containers and host nodes in the real-time consumption system;

An anomaly detection module, used to perform anomaly detection on the average value of several unit points at the tail of the real-time performance indicator to obtain an anomaly detection result;

A fault identification module, used to input the abnormal detection results into the fault identification model for fault identification, and obtain the fault identification results;

A fault classification module, used to input the fault identification results into the fault classification model for fault prediction, and obtain the fault category at the current moment;

An information output module is used to generate fault information according to the fault category at the current moment.

In addition, to achieve the above object, the present invention also proposes a fault classification device. The fault classification device includes: a memory, a processor, and a fault classification program stored in the memory and capable of running on the processor. The fault classification program is configured to implement the steps of the fault classification method as described above.

In addition, to achieve the above object, the present invention also proposes a storage medium, a fault classification program is stored on the storage medium, and when the fault classification program is executed by a processor, the steps of the fault classification method as described above are implemented.

The present invention obtains the real-time performance indicators of the pod container and the host node in the real-time consumption system; performs abnormal detection on the average value of several unit points at the tail of the real-time performance indicator to obtain the abnormal detection results; and inputs the abnormal detection results into the fault The identification model performs fault identification to obtain fault identification results; the fault identification results are input into the fault classification model for fault prediction to obtain the fault category at the current moment; fault information is generated according to the fault category at the current moment, and the real-time performance tail is Using the average value of several unit points for anomaly detection can eliminate the influence of burr points while maintaining high performance. Fault identification and fault classification can be performed based on the anomaly detection results, which can speed up fault identification and fault classification.

Description of the drawings

Figure 1 is a schematic structural diagram of a fault classification device of a hardware operating environment involved in an embodiment of the present invention;

Figure 2 is a schematic flow chart of the first embodiment of the fault classification method of the present invention;

Figure 3 is a schematic flow chart of the second embodiment of the fault classification method of the present invention;

Figure 4 is a structural block diagram of the first embodiment of the fault classification device of the present invention.

The realization of the purpose, functional features and advantages of the present invention will be further described with reference to the embodiments and the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described here are only used to explain the present invention and are not intended to limit the present invention.

Referring to Figure 1, Figure 1 is a schematic structural diagram of a fault classification device of the hardware operating environment involved in the embodiment of the present invention.

As shown in Figure 1, the fault classification device may include: a processor 1001, such as a central processing unit (Central Processing Unit, CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize connection communication between these components. The user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard). The optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may optionally be a storage device independent of the aforementioned processor 1001.

Those skilled in the art can understand that the structure shown in Figure 1 does not constitute a limitation on the fault classification device, and may include more or fewer components than shown, or combine certain components, or arrange different components.

As shown in Figure 1, memory 1005, which is a storage medium, may include an operating system, a network communication module, a user interface module, and a fault classification program.

In the fault classification equipment shown in Figure 1, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the fault classification equipment of the present invention can Set in a fault classification device, the fault classification device calls the fault classification program stored in the memory 1005 through the processor 1001, and executes the fault classification method provided by the embodiment of the present invention.

An embodiment of the present invention provides a fault classification method. Refer to Figure 2. Figure 2 is a schematic flow chart of a first embodiment of a fault classification method of the present invention.

In this embodiment, the fault classification method includes the following steps:

Step S10: Obtain real-time performance indicators of pod containers and host nodes in the real-time consumption system.

It should be noted that the execution subject of this embodiment is a fault classification device, where the fault classification device has functions such as data processing, data communication, and program running. The fault classification device can be an integrated controller, a control computer, and other devices. Of course, it can also be other devices with similar functions, which is not limited in this embodiment.

It should be understood that the real-time consumption system can be a Kafka real-time consumption system. This type of implemented consumption system has the characteristics of high concurrency and can accommodate multiple users requesting access at one point in time. The pod container is the smallest in k8s. The resource management component is also the minimum resource object for running containerized applications. Real-time performance indicators can be the current memory indicators, CPU indicators, etc. of the pod container and host node under the current situation.

It can be understood that the fault classification device can monitor the real-time performance indicator data of various resource management components in the real-time consumption system, such as pod containers, host nodes, and other resource components, and can aggregate these implementation performance data in minutes. .

Step S20: Perform abnormality detection on the average value of several unit points at the tail of the real-time performance index to obtain an abnormality detection result.

It should be noted that when real-time performance indicators are collected, there is usually a large amount of data, and there are many burr points in these data. In order to eliminate the influence of burr points, the average value of the two unit points at the tail is used as the target point to be detected. The detection target value is to eliminate the influence of burr points while maintaining high performance.

In the specific implementation, when detecting anomalies by using the mean value of the two tail unit points in the real-time performance indicators, the aggregated implementation performance indicators are used to perform fault detection on the real-time performance indicator data through the tail2-3sigma algorithm. When performing fault detection, In order to ensure the accuracy of the data while ensuring high performance, the average of the last 2 unit points of the aggregated real-time performance index data is taken as the target point for detection, and the real-time performance index data of the target point is detected. Determine whether the implementation performance index data is abnormal, and determine whether the current real-time performance index data is abnormal based on the judgment results.

Step S30: Input the abnormality detection result into the fault identification model to perform fault identification, and obtain the fault identification result.

It should be noted that the fault identification model is trained through the initial fault identification model and can identify faults based on the detection results, where the fault identification model is determined based on the currently detected indicator group.

In the specific implementation, the corresponding fault identification two-classification model is selected according to the indicator group currently being identified and detected. The fault two-classification model can determine whether the corresponding performance indicator has a fault based on the input value to be detected. In particular, when all indicator groups If there are no abnormalities, it means that the detection time is normal. For example, the currently input indicator group is the CPU indicator group of the host node and the memory indicator group of the dynamic pod container on the host node. According to the current indicator group, select the corresponding host CPU fault two-classification model and the host dynamic pod memory fault two-classification model. , and respectively judge the CPU indicators and host dynamic pod memory indicators of the respective host nodes to determine the current fault identification results. When at least one abnormal result occurs, the corresponding abnormal result and the corresponding indicator group are recorded. , until the fault identification is completed and the output is unified. If there are no abnormal results after fault identification of each input indicator group, a fault-free identification result can be returned.

Step S40: Input the fault identification result into the fault classification model for fault prediction to obtain the fault category at the current moment.

It should be noted that the fault classification model is trained through the initial fault classification model. Several fault identification results are obtained in the fault identification model. The fault identification results are used as the input of the initial fault classification model for training to obtain the fault classification model.

In the specific implementation, the fault identification results are used as the input of the fault classification model. The fault classification model can classify the fault identification results and the performance indicators corresponding to the fault identification results. For a fault category, there are many reasons for the current fault. , so for a classification, there are often corresponding multiple performance indicators and recognition results. The fault classification model uses the xgboost algorithm. When classifying faults, it first labels the fault identification results, labels each fault identification result, assigns a unique ID, and performs feature extraction on each fault identification result, including variance. , mean, skewness and other features for feature extraction, or feature fitting to generate features such as an isolated forest for feature characterization, and generate a feature set based on the extracted features, perform fault classification according to the xgboost algorithm, and obtain fault classification results.

Step S50: Generate fault information according to the fault category at the current moment.

In a specific implementation, after the fault classification result is obtained, fault information is generated according to the fault classification result, where the fault information includes the fault classification result and the corresponding fault indicator group. After the fault information is generated, the fault information can be sent to the operation and maintenance system, so that the operation and maintenance personnel can understand the cause of the fault in time and achieve rapid repair.

This embodiment obtains the real-time performance indicators of the pod container and host node in the real-time consumption system; performs anomaly detection on the average value of several unit points at the end of the real-time performance indicator to obtain the anomaly detection results; inputs the anomaly detection results into The fault identification model performs fault identification to obtain fault identification results; the fault identification results are input into the fault classification model for fault prediction to obtain the fault category at the current moment; fault information is generated according to the fault category at the current moment, and the real-time performance Anomaly detection is performed on the mean value of several unit points at the tail, which can eliminate the influence of burr points while maintaining high performance. Fault identification and fault classification are performed based on the anomaly detection results, which can speed up fault identification and classification.

Referring to Figure 3, Figure 3 is a schematic flow chart of a second embodiment of a fault classification method of the present invention.

Based on the above-mentioned first embodiment, the fault classification method of this embodiment also includes before step S30:

Step S301: Obtain historical performance indicators of the pod container and host node;

Step S302: Traverse historical fault samples in chronological order to obtain a set of historical fault occurrence times;

Step S303: Determine the historical performance index data corresponding to each historical fault node time according to the historical fault occurrence time set;

Step S304: Perform abnormality detection on each historical performance indicator data to obtain anomaly detection results;

Step S305: Input the abnormality detection results into the initial fault identification model for training to obtain a fault identification model.

In the specific implementation, after obtaining the historical performance indicators of the pod container and the host node, the performance indicators can be grouped by category according to the resource type, and K groups of core indicators closely related to system faults can be obtained, such as:

The cpu indicator group of the system host node:

system.cpu.user,

system.load.1,

system.cpu.pct_usage,

system.load.5,

system.load.15

The memory indicator group of the dynamic pod container on the host node:

container_fs_writes./dev/vda

container_fs_inodes./dev/vda1,

container_fs_reads_MB./dev/vda,

container_file_descriptors,

container_fs_writes_MB./dev/vda

Among them, such as system.cpu.user, etc. are performance indicators. When training the fault identification model, the fault occurrence time of historical faults is traversed one by one in chronological order from the historically labeled fault samples, and the historical performance index data of the system 3 hours before the fault time point is queried according to each fault time point. And it is aggregated by minutes, where the historically labeled fault samples contain n*k faults, where n is the number of fault samples. During the training process, first determine the first failure time point. If the first failure time point is 18:12:23, query the historical performance indicator data of the previous 3 hours, that is, get a starting point from 15:12:23 -Historical performance indicators within the 18:12:23 time period, and aggregate the historical performance indicators within the time period in minutes, and repeat this process until the historically labeled fault samples traverse the complete table. In this way, n*k historical performance indicator panel data corresponding to n*k fault moments are finally obtained. For each historical performance indicator panel data, the tail2-3sigma anomaly detection algorithm is used to perform anomaly detection according to the indicator grouping. , get n*k abnormal detection results, in which each set of indicators contains a number of 1 to m specific individual performance unit indicators, and use the abnormal detection results as input and input them into the initial fault identification model for training to obtain the fault identification model.

Further, the step of inputting the anomaly detection results into an initial fault identification model for training and obtaining the fault identification model also includes:

Analyze the fault identification results to obtain the first set of abnormal indicators within the first preset time at the fault moment;

Obtain a second set of abnormal indicators that occurred within a second preset time before the fault moment;

Filter the first abnormal indicator set according to the second abnormal indicator set to obtain a new abnormal indicator set that appears after the fault moment;

The new abnormal index set is input to the initial fault classification model for training to obtain a fault classification model, wherein the new abnormal index set is input to the initial fault classification model for training. Obtaining the fault classification model also includes: labeling the sample Conduct analysis to determine the fault category;

Obtain the corresponding fault identification result according to the indicator group corresponding to the sample label;

A fault classification model is obtained by training a fault classification algorithm according to the fault category and the fault identification result. .

It should be noted that the first abnormal indicator set within the first preset time refers to the abnormal indicator set formed by the abnormal indicators within a period of time after the fault occurs, and the first abnormal indicator set that appears within the second preset time before the fault occurs. The second abnormal indicator set refers to the abnormal indicator set formed by abnormal indicators that appeared within a period of time before the fault occurred.

In the specific implementation, the abnormal indicators that appear within a period of time after the fault moment can be counted. This period can be 2 minutes, 3 minutes, etc., preferably 2 minutes. It can also be set separately according to the actual situation. The abnormal indicators within 2 minutes are recorded to obtain the first abnormal indicator set; the abnormal indicators that occurred some time before the fault time, for example, within 5 minutes before the fault time can also be recorded as abnormal indicators to obtain the second abnormal indicator set. Similarly, this period of time can also be set according to specific conditions, and this embodiment does not limit this. After obtaining the first abnormal indicator set and the second abnormal indicator set, in order to optimize the data set, the data in the first abnormal indicator set can be filtered, and the abnormal indicators appearing in the second abnormal indicator set can be filtered to obtain this The first fault is a new abnormal indicator, and the new abnormal indicator can be considered as a new fault that occurred after the fault occurred. After filtering the first abnormal indicator set, the remaining abnormal indicator set is used as the new abnormal indicator set, and The new anomaly indicator set is used as the input of the initial fault classification model for model training to obtain the fault classification model.

Further, the anomaly detection result is input into the initial fault identification model for training to obtain the fault identification model, including:

Mark the abnormal indicators in the new abnormal indicator set to obtain sample labels. The new abnormal indicator set includes at least one indicator group, and each of the indicator groups includes at least one performance unit indicator;

Determine the abnormal status of the current indicator group according to the sample label;

When the current indicator group is in an abnormal state, count the number of performance unit indicators in the current indicator group that are in an abnormal state and the sample labels;

According to the number of performance unit indicators and the sample labels, a corresponding number of fault identification models are obtained through training, and there is at least one fault identification model.

It should be noted that the sample labels can be used to distinguish different groups of abnormal performance indicators. The new abnormal indicator set obtained after filtering contains n*k abnormal detection results. The n*k points are analyzed through the logistic algorithm. We conduct training based on the anomaly detection results to obtain k two-classification models for fault identification. The form of the input data is as shown in Table 1:

During the training process, since the dependent variable in the regression model of the logistic algorithm has only two weights, 0 and 1, among the p independent independent variables xi, the probability that y is 1 is recorded as p=P(y=1/ X), the probability of taking 0 is 1-p. For logistic regression, there is the following formula, where h _θ (x) represents the probability of the result being 1:

According to the content shown in Table 1, the first column id represents the serial number of the sample, indicating that each indicator group has a total of n fault label samples. Since the number of fault label samples in each indicator group may be different, in order to facilitate training, each indicator group The number of fault sample label samples is uniformly set to n. The last column y indicates that the label of the sample indicates the category of the fault. For example, 1 indicates that the indicator group is currently faulty. The middle columns 2 to 7 indicate the specific indicator name of the indicator group and the corresponding The results of anomaly detection.

After training the initial fault identification model, K two-class fault identification models will be obtained. Among them, the model can be dynamically trained and updated according to the increase in historical fault label samples, so that the prediction effect of the model increases with the enrichment of fault label samples. And improve to further play the role of supervision and classification.

Further, inputting the fault identification result into a fault classification model for fault prediction to obtain the fault category at the current moment includes:

Determine the sample serial number according to the fault identification result;

Generate a two-dimensional table according to the sample serial number and the corresponding indicator group;

Use the xgboost algorithm to perform fault prediction based on the two-dimensional table to obtain fault prediction results;

The fault category at the current moment is obtained according to the prediction result.

It should be noted that the sample serial number refers to the result serial number in the fault identification result, and the two-dimensional table is used to reflect the fault information between each fault detection result.

In the specific implementation, the sample serial number and corresponding indicator group in the current fault identification result are first determined based on the fault identification result, and a two-dimensional table is constructed based on the sample serial number and indicator group to represent the specific fault in the current fault identification result. Performance indicators, as shown in Table 2:

The id in column 1 represents the serial number of the sample, indicating a total of n*7 fault label samples. Since the number of fault label samples for each indicator group may be different according to the actual situation, here for the sake of convenience, the fault label for each indicator group is set. The number of label samples is always n; the last column y represents the label failure category of the sample, for example, 1 represents a system CPU failure, 2 represents a pod container CPU failure, 3 represents a system memory failure, and 4 represents a pod container read IO failure. Columns 2 to 7 in the middle represent the category name of the indicator group and the recognition result of the corresponding fault identification model. 1 indicates fault and 0 indicates normal. The fault conditions corresponding to each indicator group are used to generate a decision tree based on the xgboost algorithm, and the current fault type is obtained from the optimal point in the decision tree, and the fault type at the current moment is obtained.

This embodiment uses the average of the last two books of the target time series data to be detected as the value of the target point to be detected to eliminate the error impact caused by burr points, and at the same time filters the data for a period of time before and after the fault moment, so that the data before the fault occurs can be filtered. The abnormal information is filtered to obtain the new fault type that occurred at the current fault moment, and the corresponding fault identification model is selected according to the new fault type for fault identification, and then the final fault type is determined through the xgboost algorithm based on the fault classification model, achieving a balanced and fast The purpose of anomaly detection and fault identification and fault classification.

In addition, embodiments of the present invention also provide a storage medium, a fault classification program is stored on the storage medium, and when the fault classification program is executed by a processor, the steps of the fault classification method described above are implemented.

Referring to Figure 4, Figure 4 is a structural block diagram of the first embodiment of the fault classification device of the present invention.

As shown in Figure 4, the fault classification device proposed by the embodiment of the present invention includes:

The indicator acquisition module 10 is used to obtain real-time performance indicators of pod containers and host nodes in the real-time consumption system;

The anomaly detection module 20 is used to perform anomaly detection on the average value of several unit points at the tail of the real-time performance indicator to obtain an anomaly detection result;

The fault identification module 30 is used to input the abnormal detection results into the fault identification model to perform fault identification and obtain the fault identification results;

The fault classification module 40 is used to input the fault identification results into the fault classification model to perform fault prediction and obtain the fault category at the current moment;

The information output module 50 is configured to generate fault information according to the fault category at the current moment.

This embodiment obtains the real-time performance indicators of the pod container and host node in the real-time consumption system; performs anomaly detection on the average value of several unit points at the end of the real-time performance indicator to obtain the anomaly detection results; inputs the anomaly detection results into The fault identification model performs fault identification to obtain fault identification results; the fault identification results are input into the fault classification model for fault prediction to obtain the fault category at the current moment; fault information is generated according to the fault category at the current moment, and the real-time performance Anomaly detection is performed on the mean value of several unit points at the tail, which can eliminate the influence of burr points while maintaining high performance. Fault identification and fault classification are performed based on the anomaly detection results, which can speed up fault identification and classification.

In one embodiment, the fault identification module 30 is also used to obtain historical performance indicators of pod containers and host nodes; group the historical performance indicators to obtain several groups of core indicators; traverse historical fault samples in chronological order to obtain A set of historical fault occurrence times; determine the historical performance indicator data corresponding to each historical fault node time according to the historical fault occurrence time set; perform anomaly detection on each of the historical performance indicator data to obtain anomaly detection results; The above anomaly detection results are input into the initial fault identification model for training, and the fault identification model is obtained.

In one embodiment, the fault identification module 30 is also used to analyze the fault identification result to obtain a first set of abnormal indicators within a first preset time of the fault moment; and to obtain a second set of abnormal indicators before the fault moment. Suppose a second set of abnormal indicators occurs within the time period; filter the first set of abnormal indicators according to the second set of abnormal indicators to obtain a new set of abnormal indicators that appear after the fault moment; according to the new set of abnormal indicators Input to the initial fault classification model for training to obtain the fault classification model.

In one embodiment, the fault identification module 30 is also used to mark abnormal indicators in the new abnormal indicator set to obtain sample labels. The new abnormal indicator set includes at least one indicator group, and each of the indicators The group includes at least one performance unit indicator; determine the abnormal state of the current indicator group according to the sample label; when the current indicator group is in the abnormal state, count the number of performance unit indicators in the current indicator group that are in the abnormal state and the Sample labels: training to obtain a corresponding number of fault identification models based on the number of performance unit indicators and the sample labels, and there is at least one fault identification model.

In one embodiment, the fault identification module 30 is also used to analyze the sample tags to determine the fault category; and obtain the corresponding fault identification results according to the indicator group corresponding to the sample tags;

A fault classification model is obtained by training a fault classification algorithm according to the fault category and the fault identification result.

In one embodiment, the fault identification module 30 is also used to analyze the anomaly detection results and determine the grouping information of the real-time performance indicators; call the corresponding fault identification model according to the grouping information; The abnormal detection results are input into the corresponding fault identification model, so that the corresponding fault detection model analyzes the abnormal detection results to obtain analysis results, and the analysis results include the status of the real-time performance indicators; in the analysis When the real-time performance index in the result is abnormal, the fault identification result of the real-time performance index is obtained.

In one embodiment, the fault classification module 40 is also used to determine a sample serial number based on the fault identification result; generate a two-dimensional table based on the sample serial number and the corresponding indicator group; and perform the xgboost algorithm based on the two-dimensional table. Carry out fault prediction and obtain fault prediction results; obtain the fault category at the current moment based on the prediction results.

It should be understood that the above are only examples and do not constitute any limitation on the technical solution of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any limitations on this.

It should be understood that although each step in the flow chart in the embodiment of the present application is displayed in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated in this article, the execution of these steps is not strictly limited in order, and they can be executed in other orders. Moreover, at least some of the steps in the figure may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but may be executed at different times, and their execution order is not necessarily sequential. may be performed in turn or alternately with other steps or sub-steps of other steps or at least part of stages.

It should be noted that the workflow described above is only illustrative and does not limit the scope of the present invention. In practical applications, those skilled in the art can select some or all of them for implementation according to actual needs. The purpose of this embodiment is not limited here.

Furthermore, it should be noted that, as used herein, the terms "include", "comprises" or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article or system that includes a list of elements includes not only those elements, but also other elements not expressly listed or elements inherent to the process, method, article or system. Without further limitation, an element defined by the statement "comprises a..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

The above serial numbers of the embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments.

Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is better. implementation. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product that is essentially or contributes to the existing technology. The computer software product is stored in a storage medium (such as a read-only memory). , ROM)/RAM, magnetic disk, optical disk), including several instructions to cause a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the method described in various embodiments of the present invention.

The above are only preferred embodiments of the present invention, and do not limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the description and drawings of the present invention may be directly or indirectly used in other related technical fields. , are all similarly included in the scope of patent protection of the present invention.

Claims (10)

1. A fault classification method, characterized in that the fault classification method includes: Obtain real-time performance indicators of pod containers and host nodes in the real-time consumption system; Perform anomaly detection on the mean value of several unit points at the tail of the real-time performance indicator to obtain an anomaly detection result; Input the abnormal detection results into the fault identification model for fault identification, and obtain the fault identification results; Input the fault identification results into the fault classification model for fault prediction to obtain the fault category at the current moment; Fault information is generated according to the fault category at the current moment. 2. The method according to claim 1, characterized in that, before inputting the anomaly detection result into a fault identification model for fault identification and obtaining the fault identification result, the method further includes: Obtain historical performance indicators of pod containers and host nodes; Group the historical performance indicators to obtain several groups of core indicators; Traverse historical fault samples in chronological order to obtain a set of historical fault occurrence times; Determine the historical performance indicator data corresponding to each historical fault node time according to the historical fault occurrence time set; Perform anomaly detection on each of the historical performance indicator data to obtain anomaly detection results; The anomaly detection results are input into the initial fault identification model for training to obtain a fault identification model. 3. The method according to claim 2, wherein the anomaly detection result is input into an initial fault identification model for training, and after the fault identification model is obtained, the method further includes: Analyze the fault identification results to obtain the first set of abnormal indicators within the first preset time at the fault moment; Obtain a second set of abnormal indicators that occurred within a second preset time before the fault moment; Filter the first abnormal indicator set according to the second abnormal indicator set to obtain a new abnormal indicator set that appears after the fault moment; The new anomaly indicator set is input to the initial fault classification model for training to obtain a fault classification model. 4. The method of claim 2, wherein said inputting the anomaly detection results into an initial fault identification model for training to obtain a fault identification model includes: Mark the abnormal indicators in the new abnormal indicator set to obtain sample labels. The new abnormal indicator set includes at least one indicator group, and each of the indicator groups includes at least one performance unit indicator; Determine the abnormal status of the current indicator group according to the sample label; When the current indicator group is in an abnormal state, count the number of performance unit indicators in the current indicator group that are in an abnormal state and the sample labels; According to the number of performance unit indicators and the sample labels, a corresponding number of fault identification models are obtained through training, and there is at least one fault identification model. 5. The method of claim 4, wherein the new abnormal indicator set is input to an initial fault classification model for training to obtain a fault classification model, including: Analyze the sample labels to determine the fault category; Obtain the corresponding fault identification result according to the indicator group corresponding to the sample label; A fault classification model is obtained by training a fault classification algorithm according to the fault category and the fault identification result. 6. The method of claim 1, wherein said inputting the anomaly detection result into a fault identification model for fault identification to obtain a fault identification result includes: Analyze the abnormality detection results and determine the grouping information of the real-time performance indicators; Call the corresponding fault identification model according to the grouping information; Input the abnormal detection results into the corresponding fault identification model, causing the corresponding fault detection model to analyze the abnormal detection results to obtain analysis results, where the analysis results include the status of the real-time performance indicators; When there is an abnormality in the real-time performance index in the analysis result, a fault identification result of the real-time performance index is obtained. 7. The method of claim 1, wherein said inputting the fault identification result into a fault classification model for fault prediction to obtain the fault category at the current moment includes: Determine the sample serial number according to the fault identification result; Generate a two-dimensional table according to the sample serial number and the corresponding indicator group; Use the xgboost algorithm to perform fault prediction based on the two-dimensional table to obtain fault prediction results; The fault category at the current moment is obtained according to the prediction result. 8. A fault classification device, characterized in that the fault classification device includes: The indicator acquisition module is used to obtain real-time performance indicators of pod containers and host nodes in the real-time consumption system; An anomaly detection module, used to perform anomaly detection on the average value of several unit points at the tail of the real-time performance indicator to obtain an anomaly detection result; A fault identification module, used to input the abnormal detection results into the fault identification model for fault identification, and obtain the fault identification results; A fault classification module, used to input the fault identification results into the fault classification model for fault prediction, and obtain the fault category at the current moment; An information output module is used to generate fault information according to the fault category at the current moment. 9. A fault classification device, characterized in that the device includes: a memory, a processor, and a fault classification program stored on the memory and operable on the processor, and the fault classification program is configured to implement The steps of the fault classification method according to any one of claims 1 to 7. 10. A storage medium, characterized in that a fault classification program is stored on the storage medium, and when the fault classification program is executed by a processor, the steps of the fault classification method according to any one of claims 1 to 7 are implemented. .