CN117076244A

CN117076244A - Method, device, equipment and storage medium for generating host running state information

Info

Publication number: CN117076244A
Application number: CN202311061658.9A
Authority: CN
Inventors: 闫美阳
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2023-08-22
Filing date: 2023-08-22
Publication date: 2023-11-17

Abstract

The present disclosure provides a method, an apparatus, a device, and a storage medium for generating host running state information, which can be applied to the technical field of computer operation and maintenance and the technical field of finance. The method for generating the running state information of the host comprises the following steps: acquiring an operation log of a target host in a current period, wherein the operation log comprises operation contents corresponding to a plurality of operation moments in the current period; encoding the operation content of the operation log to obtain the time sequence characteristics of the operation state; detecting the time sequence characteristics by using the classification model to obtain the running state information of the target host; and inputting the running state information into the association relation model to obtain the running state prediction information of the target host in the target period.

Description

Method, device, equipment and storage medium for generating host running state information

Technical Field

The present disclosure relates to the field of computer operation and maintenance technology and the field of finance technology, and more particularly, to a method, an apparatus, a device, and a storage medium for generating host operation state information.

Background

Compared with a distributed cluster, the large host system has more outstanding advantages such as high stability, high security and strong processing capacity, and is widely applied to various fields. However, because more subsystems are distributed under the host system, and the data volume and the data types of interaction between the host system and the subsystems are large, difficulty is brought to operation and maintenance monitoring of the running state of the host.

In carrying out the above inventive concept, the inventors found that: in the related art, operation and maintenance monitoring is generally performed on the operation state of the host system based on single-dimension data, so that the operation state of the host system is difficult to monitor in an omnibearing manner, and the accuracy of a monitoring result is low.

Disclosure of Invention

In view of the above, the present disclosure provides a method, apparatus, device, and storage medium for generating host operation status information.

According to a first aspect of the present disclosure, there is provided a method for generating host operation state information, including: acquiring an operation log of a target host in a current period, wherein the operation log comprises operation contents corresponding to a plurality of operation moments in the current period; encoding the operation content of the operation log to obtain the time sequence characteristics of the operation state; detecting the time sequence characteristics by using the classification model to obtain the running state information of the target host; and inputting the running state information into the association relation model to obtain the running state prediction information of the target host in the target period.

According to an embodiment of the present disclosure, detecting a time-series feature to obtain operation state information of a target host using a classification model includes: inputting the time sequence features into a classification model to obtain the matching probability of the time sequence features and the predetermined running state category; and obtaining the running state information based on the matching probability.

According to an embodiment of the present disclosure, obtaining operation state information based on a matching probability includes: determining a first operating state class from the predetermined operating state classes; according to the first running state category, inquiring a first abnormality index corresponding to the first running state category; and obtaining the first operation state abnormal characteristic according to the matching probability of the time sequence characteristic and the first operation state category and the first abnormality index.

According to an embodiment of the present disclosure, the operation state information includes a first operation state category and a first operation state abnormality feature; inputting the first operation state abnormal characteristics into an association relation model to obtain operation state prediction information of the target host in a target period, wherein the operation state prediction information comprises: determining a target operator for processing the abnormal characteristics of the first running state according to the first running state class; and processing the first running state abnormal characteristic based on the target operator to obtain running state prediction information.

According to an embodiment of the present disclosure, processing a first operation state exception feature based on a target operator to obtain operation state prediction information includes: based on a grey time sequence prediction algorithm, checking the first running state characteristics to obtain a checking result; and processing the first running state abnormal characteristics based on the target operator to obtain running state prediction information under the condition that the detection result is determined to pass; under the condition that the test result is determined to be not passing, adding the first running state abnormal characteristic and the random number to obtain a target running state abnormal characteristic, wherein the target running state abnormal characteristic represents the feature that the test result is passing; and processing the abnormal characteristics of the target running state based on the target operator to obtain running state prediction information.

According to an embodiment of the present disclosure, processing a first operation state exception feature based on a target operator to obtain operation state prediction information includes: processing the first operation state abnormal characteristics based on the target operator to obtain second operation state abnormal characteristics; and determining a second operation state category corresponding to the second operation state abnormal characteristic according to the second operation state abnormal characteristic and the abnormality index of the preset operation state.

According to an embodiment of the present disclosure, further comprising: displaying the running state information and the running state prediction information through a visual interface; and responsive to the second operational status anomaly characteristic being greater than the predetermined threshold, displaying alarm information via the visual interface.

According to an embodiment of the present disclosure, the training method of the classification model includes: acquiring a sample operation log of a target host in a history period; based on a clustering algorithm, clustering the sample operation logs to obtain a plurality of sample data sets and a plurality of operation state categories corresponding to the plurality of sample data sets; encoding the plurality of sample data sets to obtain sample characteristics; inputting sample characteristics and sample labels into a first initial model to obtain a running state prediction class corresponding to the sample characteristics, wherein the sample labels represent the running state class corresponding to the sample data set based on a first loss function, and loss values are obtained according to the running state prediction class and the sample labels; and adjusting model parameters of the first initial model based on the first loss value to obtain a classification model.

According to an embodiment of the present disclosure, a training method of an association relationship model includes: inputting the abnormal characteristics of the sample running state into a second initial model to obtain a predicted value of the abnormal characteristics of the sample running state; inquiring the prediction type of the sample running state according to the abnormal characteristic prediction value of the sample running state; based on the second loss function, obtaining a second loss value according to the prediction category and the sample running state category; and based on the second loss value, adjusting model parameters of the second initial model to obtain an association relation model.

A second aspect of the present disclosure provides a device for generating host operation state information, including: the system comprises an acquisition module, a storage module and a storage module, wherein the acquisition module is used for acquiring an operation log of a target host in a current period, wherein the operation log comprises operation contents corresponding to a plurality of operation moments in the current period; the coding module is used for coding the operation content of the operation log to obtain the time sequence characteristics of the operation state; the classification module is used for detecting the time sequence characteristics by using the classification model to obtain the running state information of the target host; and the prediction module is used for inputting the running state information into the association relation model to obtain the running state prediction information of the target host in the target period.

A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method described above.

A fourth aspect of the present disclosure also provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the above-described method.

A fifth aspect of the present disclosure also provides a computer program product comprising a computer program which, when executed by a processor, implements the above method.

According to the method, the device, the equipment and the storage medium for generating the host operation state information, the operation log in the current period of the target host is obtained, the operation log comprises operation contents corresponding to a plurality of operation moments in the current period, the log contents are encoded, the time sequence characteristics of the corresponding operation states are obtained according to the encoded log contents, the time sequence characteristics are input into the classification model, the operation state information of the current moment corresponding to the target host is simulated and detected, and multi-dimensional index data capable of representing the operation states of the host at the current moment can be obtained. According to the running state information of the current moment, running state prediction information of the target host in a future target period is simulated based on the association relation model, the current running state is simulated based on the running log of the target host in the current period, the current running state is monitored and tracked, the running state information of the future period is obtained, the prediction and monitoring of the host state of the future period are realized, the accuracy rate of the running state monitoring of the target host at the current moment is improved, the running state of the future period can be accurately predicted, and the tracking type monitoring of the running state of the target host is realized.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be more apparent from the following description of embodiments of the disclosure with reference to the accompanying drawings, in which:

FIG. 1 schematically illustrates an application scenario diagram of a method, an apparatus, a device, and a storage medium for generating host operation state information according to an embodiment of the present disclosure;

FIG. 2 schematically illustrates a flow chart of a method of generating host operating state information according to an embodiment of the disclosure;

FIG. 3 schematically illustrates a flow chart of operational state prediction information according to an embodiment of the present disclosure;

FIG. 4 schematically illustrates a flow chart of a training method of a classification model according to an embodiment of the disclosure;

FIG. 5 schematically illustrates a flow chart of a training method of an associative relationship model according to an embodiment of the present disclosure;

fig. 6 schematically illustrates a block diagram of a structure of a generating apparatus of host operation state information according to an embodiment of the present disclosure; and

fig. 7 schematically illustrates a block diagram of an electronic device adapted to implement a method of generating host operating state information according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is only exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques are omitted so as not to unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and/or the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein should be construed to have meanings consistent with the context of the present specification and should not be construed in an idealized or overly formal manner.

Where expressions like at least one of "A, B and C, etc. are used, the expressions should generally be interpreted in accordance with the meaning as commonly understood by those skilled in the art (e.g.," a system having at least one of A, B and C "shall include, but not be limited to, a system having a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

In the technical scheme of the invention, the related user information (including but not limited to user personal information, user image information, user equipment information, such as position information and the like) and data (including but not limited to data for analysis, stored data, displayed data and the like) are information and data authorized by a user or fully authorized by all parties, and the processing of the related data such as collection, storage, use, processing, transmission, provision, disclosure, application and the like are all conducted according to the related laws and regulations and standards of related countries and regions, necessary security measures are adopted, no prejudice to the public welfare is provided, and corresponding operation inlets are provided for the user to select authorization or rejection.

To ensure high availability, the host system designs an infrastructure based on multiple subsystems and multiple sets of software. However, this also presents some problems for operation and maintenance monitoring of the host system: for example:

1. because of the management standard of host resources, the system memory can only reserve the log within 7 days, and the log before 7 days needs to be recovered by a disk, so that the time cost is high.

2. Because of the high availability strategy of the host, a plurality of subsystems and a high availability framework of a plurality of sets of software are arranged, when a certain subsystem is abnormal, the software started on the subsystem is migrated to other subsystems, at the moment, the state of the software running on the subsystem is tracked by the cross subsystem, and the software state is required to be searched by manually logging in different systems, so that centralized processing and unified display interfaces are lacked, manual processing is seriously relied, and the flow is complicated.

3. When the subsystem or the software has abnormal trend, the user is unaware, the host computer does not provide the prejudgment capability in the scene to carry out operation and maintenance prompt, and the alarm is given only after the problem occurs, so that the system has certain hysteresis.

In view of this, an embodiment of the present disclosure provides a method for generating host operation state information, including: acquiring an operation log of a target host in a current period, wherein the operation log comprises operation contents corresponding to a plurality of operation moments in the current period; encoding the operation content of the operation log to obtain the time sequence characteristics of the operation state; detecting the time sequence characteristics by using the classification model to obtain the running state information of the target host; and inputting the running state information into the association relation model to obtain the running state prediction information of the target host in the target period. The method and the device realize the identification of the current running state of the target host and the prediction of the running state of the future period based on the real-time running log.

Fig. 1 schematically illustrates an application scenario diagram of a method for generating host operation state information according to an embodiment of the present disclosure.

As shown in fig. 1, an application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used as a medium to provide communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The user may interact with the server 105 through the network 104 using at least one of the first terminal device 101, the second terminal device 102, the third terminal device 103, to receive or send messages, etc. Various communication client applications, such as a shopping class application, a web browser application, a search class application, an instant messaging tool, a mailbox client, social platform software, etc. (by way of example only) may be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103.

For example, the user may send a service request to the server 105 equipped with the service system using a bank client installed in the first terminal device 101, the second terminal device 102, the third terminal device 103.

The first terminal device 101, the second terminal device 102, the third terminal device 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop and desktop computers, and the like.

The server 105 may be a server providing various services, such as a background management server (by way of example only) providing support for websites browsed by the user using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as the user request, and feed back the processing result (e.g., the web page, information, or data obtained or generated according to the user request) to the terminal device.

For example, server 105 may be a distributed server, a cloud server, and a centralized server. The server 105 may be installed with both the old version service system and the new version service server and test the storage method of the service data.

It should be noted that, the method for generating the host operation state information provided by the embodiments of the present disclosure may be generally performed by the server 105. Accordingly, the generation apparatus of the host operation state information provided by the embodiments of the present disclosure may be generally disposed in the server 105. The method for generating host operation state information provided by the embodiments of the present disclosure may also be performed by a server or a server cluster that is different from the server 105 and is capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and/or the server 105. Accordingly, the generation apparatus of the host operation state information provided by the embodiments of the present disclosure may also be provided in a server or a server cluster that is different from the server 105 and is capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and/or the server 105.

For example, in the server 105, relevant interfaces, stores, state tags, etc. may be configured to define critical pathways for the life cycle of the target state data stream, including: aiming at a target state acquisition interface configuration module, according to the characteristics of acquired data, collecting message contents including a host IP, a host port, a log acquisition command, a log receiving path of the device and a timeout time to form a configuration file; aiming at a target state storage configuration module, according to the storage characteristics of key value of the invention (time point: log content), a Mysql memory database storage module is adopted, the Mysql memory database storage module is deployed on the system, and a configuration file is formed by collecting database IP, ports, users, passwords and database names; aiming at a target state data centralized processing interface configuration module, regarding 'centralization', a KAFKA message queue processing module is used for uniformly collecting logs of all scattered subsystems of a host, the logs are deployed on the system, KAFKA producers, namely, IP, ports and topics of a data acquisition device are collected, and KAFKA consumers, namely, IP, ports and topics of a target state data processing device are collected; aiming at a target state unified display interface configuration module, a target state monitoring display system which is customized in a personalized way and can be traced, alarmed and pre-alarmed is provided for a user, the monitoring display system adopts GRAFANA+Mysql as a framework, GRAFANA is deployed on the system, mysql is configured in a GRAFANA data source according to the method, and GRAFANA related IP, port, user name and password information are collected and provided for the user as configuration files; aiming at the state label definition module, the multi-target state of the host subsystem is mainly tracked, the host target state is various in form, and in order to facilitate tracking, alarming and early warning of the target state, the target state is collected through expert experience knowledge and state abnormality indexes are respectively defined.

It should be understood that the number of terminal devices, networks and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

The method of generating the host operation state information of the disclosed embodiment will be described in detail below with reference to the scenario described in fig. 1 through fig. 2 to 5.

Fig. 2 schematically illustrates a flowchart of a method of generating host operating state information according to an embodiment of the present disclosure.

As shown in fig. 2, the method for generating host operation state information of this embodiment includes operations S210 to S240.

In operation S210, a running log of the target host in the current period is acquired.

According to the embodiment of the disclosure, the operation log comprises operation contents corresponding to a plurality of operation moments in the current period.

According to the embodiment of the disclosure, under the condition that the running log of the target host in the current period needs to be acquired, an acquisition processing device in the system forms a many-to-one port communication mode according to the configuration file of the target host, a request for acquiring the running log is sent to the target host, and after the target host receives the request for acquiring the running log, the target host renames the preliminary running log in the current period and sends the request to the acquisition processing device.

According to embodiments of the present disclosure, the configuration file of the target host may include ip of the target host, port of the target host, ip of the subsystem of the target host, port of the subsystem of the target host.

According to the embodiment of the disclosure, a plurality of subsystems and a plurality of software are arranged in a host, and an acquisition processing device forms a plurality of subsystems in the corresponding host of the acquisition processing device according to a target host and an ip and a port of the subsystem of the target host in a configuration file, wherein one subsystem corresponds to a port communication channel of the plurality of software, namely a port communication mode of many to one.

According to an embodiment of the present disclosure, the request for the acquisition processing device to send the acquisition running log to the target host may include a request instruction for acquiring the running log, an ip of the acquisition processing device, and a port of the acquisition processing device.

According to the embodiment of the disclosure, the request instruction for collecting the running log may be a set of request instruction groups for collecting the running log, and since each software corresponds to different collection instructions, the collection instructions of the plurality of software are summarized to form the request instruction groups for collecting the running log.

According to the embodiment of the disclosure, the acquisition processing device sends the request to a plurality of subsystems of the host according to the many-to-one port communication mode, and the plurality of subsystems of the host send the request to corresponding respective software.

According to embodiments of the present disclosure, the naming convention for renaming the preliminary log of operations in the current time period by the host may be "subsystem name_software name".

For example, the target host names the preliminary running log in the current period with "a subsystem_cde software" and then sends the preliminary running log to the acquisition processing device.

According to the embodiment of the disclosure, after receiving the preliminary running log sent by the target host, the acquisition processing device performs data formatting cleaning and log aggregation on the preliminary running log to obtain the running log.

According to embodiments of the present disclosure, data formatting cleansing may be characterized as removing nonsensical character information in a preliminary travel log using regular expressions in order to improve the data quality of the log.

For example, the log data contains agbdaYA 1' "and-! The following is carried out The following is carried out The! ? \\ \\ to (C), a. The invention relates to a method for producing a fibre-reinforced plastic composite. The following is carried out "; "250YSN,"' "in this data! The following is carried out The following is carried out The! ? \\ \\ to (C), a. The invention relates to a method for producing a fibre-reinforced plastic composite. The following is carried out "; "is nonsensical character information, cleaned with data formatting, and the" | -! The following is carried out The following is carried out The! ? \\ \\ to (C), a. The invention relates to a method for producing a fibre-reinforced plastic composite. The following is carried out "; "remove, get data agbdaYA1250YSN.

According to embodiments of the present disclosure, log aggregation may employ the following operations: judging whether the line log has a time field, if not, the line and the last line are the same log, and aggregating the line and the last line into a single log; if the line has a time field, judging whether the 39 th character of the line is a null character, and if the 39 th character is a null character, the line acts as a single log; if the line has a time field and the 39 th character is not a null character, the line is aggregated with the previous line into a single log.

For example, if the first row of logs is bfjakhf15afb@vfh504 and the second row of logs is hfalhbcaaf@24 & fhls, aggregating the first row of logs and the second row of logs to form a single log bfjakhf15afb@vfh504 hfalhbcaaf@24 & fhls; the first row of logs is bfjakhf15afb@VFH504, the second row of logs is hfalhebca2008.01.16af@ 24&fhls%1ahuTBK2ad, and the 39 th character of the second row of logs is a null character, so that a single log hfalhebca2008.01.16af@ 24&fhls%1ahuTBK2ad is formed; the first row of logs is bfjakhf15afb@VFH504, the second row of logs is hfalhebca2008.01.16 af@24 & fhls%1ahuTBK2ad, and the first row of logs and the second row of logs are aggregated to form a single log bfjakhf15afb@VFH504hfalhebca2008.01.16af @24 & fhls%1ahuTBK2ad.

In operation S220, the operation contents of the operation log are encoded to obtain the time sequence characteristics of the operation state.

According to the embodiment of the disclosure, before the running content is encoded, the time-stamped log content and the log content description information can be segmented by taking spaces as keywords according to the content characteristics of the running content, and the time-stamped portion and the log content description information in the log with time are reserved.

According to embodiments of the present disclosure, the run-time content may be binary encoded.

For example, the running content is 4524506751, and the binary code is 100001101101011100111111001111111.

According to the embodiment of the disclosure, the encoded operation content is analyzed to obtain the time sequence characteristics of the operation state. The time sequence characteristics of the running state can characterize the current period [ t ] ₁ ，t _n And (3) in the process, the code of the running content corresponding to each moment is a feature vector which is ordered according to the time sequence. For example: t is t ₁ The code of the running content of the moment is fa ₁ ，t ₂ The code of the running content of the moment is fa ₂ 、…、t _n The code of the running content of the moment is fa _n The timing characteristic may be (fa ₁ ，fa ₂ ，…，fa _n )。

In operation S230, the time-series characteristics are detected by using the classification model to obtain the running state information of the target host.

According to the embodiment of the disclosure, the classification model is utilized, the Catboost algorithm can be adopted to classify the time sequence features, and the running state information of the target host is determined according to the classification result.

According to embodiments of the present disclosure, the operational state information may be characterized as log operational state information.

For example, the running state information of the a log is stopped; the running state information of the log B is continuously increased; and the running state information of the log C is an alarm.

According to the embodiment of the disclosure, a table containing all running state information is arranged in the system, and the corresponding running state information is inquired from the table according to the classified result of the classification model. The table includes, but is not limited to, the following operating states:

for example, a temporary stop state, a continuous rising state, a continuous falling state, an all stop state, a sleep state, and a surge state.

In operation S240, the operation state information is input into the association model to obtain the operation state prediction information of the target host in the target period.

According to embodiments of the present disclosure, the association relation model may be used to predict the operation state information within the target period, that is, the operation state information within a certain period in the future, from the operation state information.

For example, the operation state information of 1s-10s is input into the association relation model to obtain the operation state information of the target host at 11s-20 s.

According to the embodiment of the disclosure, since the operation log of the target host in the current period is obtained, the operation log includes operation contents corresponding to a plurality of operation moments in the current period, the log contents are encoded, the time sequence characteristics of the corresponding operation states are obtained according to the encoded log contents, the time sequence characteristics are input into the classification model, the operation state information of the target host at the current moment is detected in a simulation mode, and multi-dimensional index data capable of representing the operation state of the host at the current moment can be obtained. According to the running state information of the current moment, running state prediction information of the target host in a future target period is simulated based on the association relation model, the current running state is simulated based on the running log of the target host in the current period, the current running state is monitored and tracked, the running state information of the future period is obtained, the prediction and monitoring of the host state of the future period are realized, the accuracy rate of the running state monitoring of the target host at the current moment is improved, the running state of the future period can be accurately predicted, and the tracking type monitoring of the running state of the target host is realized.

According to an embodiment of the present disclosure, detecting a time-series feature to obtain operation state information of a target host using a classification model includes:

according to the embodiment of the disclosure, the time sequence features are input into a classification model, and the matching probability of the time sequence features and the preset running state category is obtained.

According to the embodiment of the disclosure, all the operation state information is classified according to the state characteristics, and one piece of operation state information can be corresponding to one operation state category.

For example, according to the state characteristics of the operation state information, the whole operation state information is divided into a stop type, a sleep type, a warning type, a continuous rising operation type, a continuous falling operation type, and a fluctuation operation type, the stop type includes a termination state, the sleep type includes a sleep state, the warning type includes an alarm state, the continuous rising operation type includes a continuous rising state, the continuous falling operation type includes a continuous falling state, and the fluctuation operation type includes a fluctuation state.

According to the embodiment of the disclosure, when the time sequence characteristics of the operation states corresponding to the operation contents are obtained, the system can predict the operation state types of the operation contents according to the time sequence characteristics, so that all operation state types related to the operation contents are obtained.

For example, the operation state categories related to the a operation content include a continuous rising operation category, a continuous falling operation category, a fluctuating operation category, and a rising-then-falling operation category.

According to embodiments of the present disclosure, the predetermined operating state categories may be characterized as all operating state categories related to the operating content that are derived from the prediction of the operating content.

According to the embodiment of the disclosure, after the time sequence feature is input into the classification model, the system automatically simulates and calculates the matching probability between the time sequence feature and the preset running state class so that the system observes the matching degree between the running content and the preset running state class and makes the judgment of the subsequent operation according to the matching degree.

For example, the matching probability of the continuously rising run category related to the a run content is 56%, the matching probability of the continuously falling run category is 16%, the matching probability of the fluctuating run category is 79%, and the matching probability of the rising-then-falling run category is 3%.

According to an embodiment of the present disclosure, the operation state information is obtained based on the matching probability.

According to the embodiment of the disclosure, since one operation content corresponds to a plurality of operation state categories, according to the classification model, one matching probability corresponding to each operation state category is obtained, and information corresponding to the matching probability with the highest numerical value is determined from all the matching probabilities, namely the operation state information.

For example, if the matching probability of the continuously ascending operation category related to the operation content a is 56%, the matching probability of the continuously descending operation category is 16%, the matching probability of the fluctuating operation category is 79%, and the matching probability of the ascending-then-descending operation category is 3%, the fluctuating operation state information corresponding to the fluctuating operation category with the highest matching probability is obtained.

According to the embodiment of the disclosure, as the time sequence features are input into the classification model, the system calculates the matching probability with the predetermined running state category according to the classification model, and the running state information corresponding to the matching probability of the maximum value is selected as the running state information matched with the running content according to the values of the matching probabilities, so that the real-time monitoring of the running state of the running content in the current period is realized, and meanwhile, the time cost is reduced and the working efficiency of the system is improved by utilizing the computer technology and the mathematical model.

According to an embodiment of the present disclosure, obtaining operation state information based on a matching probability includes:

according to an embodiment of the present disclosure, a first operating state category is determined from among predetermined operating state categories.

According to embodiments of the present disclosure, the first run state category may be characterized as the run state category that has the greatest probability of matching run content.

For example, if the matching probability of the continuously ascending operation category related to the a operation content is 56%, the matching probability of the continuously descending operation category is 16%, the matching probability of the fluctuating operation category is 79%, and the matching probability of the ascending-then-descending operation category is 3%, the highest matching probability is that the fluctuating operation category is the first operation state category.

According to the embodiment of the disclosure, the operation state category with the highest matching probability with the operation information is found out from all the operation state categories according to the matching probability and is determined to be the first operation state category, so that the accurate judgment of the operation category of the operation content is realized.

According to the embodiment of the disclosure, according to the first operation state category, a first abnormality index corresponding to the first operation state category is queried.

According to an embodiment of the present disclosure, the first abnormality index may be characterized as an abnormality index corresponding to the first operating state category, which may be generated from an empirical value of a developer and stored in the system by the developer.

According to an embodiment of the present disclosure, each operating state class corresponds to an abnormality index.

For example, the abnormality index corresponding to the continuously ascending operation type is 0.8, the abnormality index corresponding to the continuously descending operation type is 0.16, the abnormality index corresponding to the fluctuating operation type is 0.91, and the abnormality index corresponding to the ascending-then-descending operation type is 0.42.

For example, if the matching probability of the continuously ascending operation category related to the operation content a is 56%, the matching probability of the continuously descending operation category is 16%, the matching probability of the fluctuating operation category is 79%, the matching probability of the ascending-then-descending operation category is 3%, and the fluctuating operation category is the first operation state category, the abnormality index corresponding to the fluctuating operation category is 0.91, that is, 0.91 is the first abnormality index.

According to the embodiment of the disclosure, the table of the system further comprises an operation state category and an abnormality index corresponding to the operation state category. And according to the first running state category, inquiring the first abnormality index in the table.

According to the embodiment of the disclosure, the first operation state abnormal feature is obtained according to the matching probability of the time sequence feature and the first operation state category and the first abnormal index.

According to embodiments of the present disclosure, the first operating state anomaly characteristic may be characterized as an anomaly index for an operating state corresponding to the operating content.

According to the embodiment of the disclosure, a result obtained by multiplying the matching probability by the first abnormality index is the first operation state abnormality feature.

For example, if the matching probability of the a operation content and the predetermined operation state category is 0.93 and the first abnormality index is 0.88, the first operation state abnormality is 0.8184.

According to the embodiment of the disclosure, since the first operation state category is determined from the predetermined operation state categories, the first abnormality index corresponding to the first operation state category is queried in the table of the system according to the first operation state category, and the result, namely the first operation state abnormality characteristic, is obtained by adopting a mathematical operation mode with the matching probability and the first abnormality index, and the accuracy of the judgment of the operation state is further improved by combining the classification result of the state category and the experience value of the research personnel.

According to an embodiment of the present disclosure, the operation state information includes a first operation state category and a first operation state abnormality feature; inputting the first operation state abnormal characteristics into an association relation model to obtain operation state prediction information of the target host in a target period, wherein the operation state prediction information comprises:

according to an embodiment of the present disclosure, the operation state information of the target host is composed of a first operation state category and a first operation state abnormality feature.

For example, the operational status information of the a-target host includes a continuously rising operational category and a first operational status anomaly characteristic of 0.89.

According to an embodiment of the present disclosure, a target operator for handling a first operating state anomaly characteristic is determined from a first operating state class.

According to embodiments of the present disclosure, a target operator may be characterized as a computing operation for computing operational state information of a target host over a period of time.

According to embodiments of the present disclosure, various computing operations may be performed within a system, which may include, but are not limited to, addition, subtraction, multiplication, division, exponentiation, evolution, weighting, averaging, and the like.

For example, based on the fluctuating operating class, it is determined to process the first operating state feature using an exponentiating operation.

According to the embodiment of the disclosure, the first operation state abnormal characteristic is processed based on the target operator, so that operation state prediction information is obtained.

According to embodiments of the present disclosure, the operating state prediction information may be characterized as prediction information of an operating state over a period of time in the future.

According to the embodiment of the disclosure, based on the target operator, the first operation state abnormal feature of the operation content at the current moment is operated to obtain the operation state prediction information at a certain moment in the future so as to predict the future state information according to the current state information.

For example, the operation contents of the current 1 st to 10 th s are calculated by adopting an average calculation mode, so that the predicted operation state information of the 11 th to 20 th s is obtained.

According to the embodiment of the disclosure, since the target operator for processing the first operation state abnormal feature is determined according to the first operation state category, the calculation processing is performed on the first operation state abnormal feature at the current moment by using the target operator to obtain the operation state prediction information, so that the prediction of the state information of a certain period in the future and the monitoring processing of the state information of a certain period in the future are realized, the time cost is saved, and the processing efficiency of the system is improved.

Fig. 3 schematically illustrates a flow chart of operational state prediction information according to an embodiment of the present disclosure.

As shown in fig. 3, the method of generating host operation state information of this embodiment includes operations S301 to S305.

According to an embodiment of the present disclosure, processing a first operation state exception feature based on a target operator to obtain operation state prediction information includes:

in operation S301, the first operation state feature is checked based on the gray time series prediction algorithm, and a check result is obtained.

According to an embodiment of the present disclosure, the gray time series prediction algorithm may employ a GM (1, 1) (Gray Forecast Model) algorithm to verify the first operating state characteristic.

According to the embodiment of the disclosure, the first operation state feature can be tested and verified by adopting a level ratio test, so that a test result is obtained.

In operation S302, it is determined whether the test result is pass. If the result of the test is pass, operation S303 is executed, and if the result of the test is not pass, operation S304 is executed.

In operation S303, if it is determined that the inspection result is passed, the first operation state abnormality feature is processed based on the target operator, and operation state prediction information is obtained.

According to the embodiment of the disclosure, in the case that the level ratio test is passed, the operation state prediction information for a certain period is obtained according to the target operator.

In operation S304, if it is determined that the test result is not passed, the first operation state abnormality feature is added to the random number to obtain the target operation state abnormality feature.

According to an embodiment of the present disclosure, the target operating state anomaly characteristic characterization test result is a pass characteristic.

According to the embodiment of the disclosure, in the case that the level ratio test is not passed, the random number is adopted to add the first operation state abnormal feature, the level ratio test is performed again on the first operation state abnormal feature after the addition of the random number, if the level ratio test result is passed, the first operation state abnormal feature after the addition of the random number is determined to be the target operation state abnormal feature, and if the level ratio test result is not passed, the random number is adopted again to add the first operation state abnormal feature at this time until the level ratio test result is passed, and the abnormal feature passing the level ratio test is determined to be the target operation state abnormal feature.

For example, if the level ratio test requires 0.96 or more to pass, the first operation state abnormality characteristic of the first time is 0.82, and the result of the test is not passed, so that the random number 0.05 and the first operation state abnormality characteristic of the first time are added to each other to obtain the first operation state abnormality characteristic of the second time of 0.87, the level ratio test is again performed to verify that the result of the test is not passed, and if the result of the test is not passed, the random number 0.12 and the first operation state abnormality characteristic of the second time of 0.87 are added to each other to obtain the first operation state abnormality characteristic of the third time of 0.99, and the result of the test is again performed to verify that the result of the test is passed, and the first operation state abnormality characteristic of the third time of 0.99 which passes the level ratio test is determined to be the target operation state abnormality characteristic.

In operation S305, the target operation state abnormality feature is processed based on the target operator, and the operation state prediction information is obtained.

According to the embodiment of the disclosure, since the first running state feature is checked based on the gray time sequence prediction algorithm, if the verification result is passed, the first running state feature is processed according to the target operator to obtain the running state prediction information, and if the verification result is not passed, the first running state feature and the random number are added to obtain the target running state abnormal feature of the passing verification result, so that the accuracy of the obtained running state prediction information is further improved, and meanwhile, since the running state feature is checked by adopting the computer algorithm, the time cost is saved, and the efficiency of obtaining the running state prediction information is improved.

according to the embodiment of the disclosure, the first operation state abnormal feature is processed based on the target operator, and the second operation state abnormal feature is obtained.

According to an embodiment of the present disclosure, the second operation state anomaly characteristic may be characterized as a value obtained by processing the first operation state anomaly characteristic based on the target operator.

For example, the first operating state anomaly characteristic is 0.836 and the second operating state anomaly characteristic after object operator processing is 0.98.

According to an embodiment of the present disclosure, a second operating state category corresponding to the second operating state abnormality feature is determined according to the second operating state abnormality feature and an abnormality index of a predetermined operating state.

According to an embodiment of the present disclosure, the predetermined operation state may include the above-described temporary stop state, continuous rising state, continuous falling state, all stop state, sleep state, and surge state. The abnormality index for the predetermined operating state is configured based on expert experience or other a priori experience.

According to embodiments of the present disclosure, the second operational status category may be characterized as an operational status category of operational content for a certain period of time.

For example: the first running state may be T, the abnormality index corresponding to the class of the T running state may be 0.8, and the obtained matching probability of the time sequence feature of the target host in the current period and the first running state is 0.9 through the classification model, and the abnormality feature of the first running state is 0.72.

And processing the first operation state abnormal characteristic based on the association relation model, wherein the obtained second operation state abnormal characteristic can be 0.7. In the map of the predetermined operation state type and the abnormality index, the abnormality index closest to the abnormality characteristic of the second operation state is 0.65, it can be determined that the matching probability of the time sequence characteristic of the operation state of the target host in the target period and the operation state class corresponding to the abnormality index of 0.65 is closer to 1, and therefore, it can be determined that the second operation state class is the operation state class P corresponding to the abnormality index of 0.65.

According to the embodiment of the disclosure, the abnormal characteristics of the second operation state of the association period can be accurately predicted by performing mathematical operation on the abnormal characteristics of the first operation state through the data association relation of the abnormal indexes of the operation states in the association period, so that the class of the operation state of the target period associated with the current period is determined, the operation state prediction process is simplified, and the timeliness of the operation state prediction of the target host is improved.

According to the embodiment of the disclosure, the running state information and the running state prediction information are displayed through a visual interface.

According to the embodiment of the disclosure, the visual interface can be used for providing a developer with the current running state of the target host and the running state of a certain period in the future for observing, so that the developer can monitor the state information conveniently.

According to an embodiment of the present disclosure, in response to the second operating state anomaly characteristic being greater than a predetermined threshold, alert information is presented via a visual interface.

According to embodiments of the present disclosure, the predetermined threshold may be characterized as a value set in the system by a developer, which may be used to determine whether the second operating condition anomaly characteristic is in a critical alert condition.

According to embodiments of the present disclosure, an alarm button, a query button, a backtracking button, a screenshot button, a export button may be provided on the visual interface.

According to the embodiment of the disclosure, under the condition that the abnormal characteristic of the second operation state is larger than the preset threshold value, the system sends an alarm prompt to a developer, and the developer checks the specific alarm operation state information on the visual interface according to the alarm prompt.

For example, the abnormal characteristic of the second running state of the running content a is 0.99, the preset threshold set by the developer in the system is 0.90, at this time, the abnormal characteristic of the second running state is greater than the preset threshold, the system gives an alarm prompt to the running state prediction information corresponding to the abnormal characteristic of the second running state, and the developer can see the alarm information on the visual interface, including the abnormal characteristic of the second running state, the running state prediction information, the prediction period, the second running state category and the preset running state.

According to the embodiment of the disclosure, a developer may click a backtracking button on the visual interface, trigger a backtracking function, call and view state information in a period predicted in the past, click a export button for state information of a period needing important attention, trigger an export function, export all state information of the period needing important attention to a target file, so as to perform other operations.

For example, the sender may also click a backtracking button on the visual interface to view xx: yy:20-xx: yy: 30. xx: yy:31-xx: yy: 40. xx: yy:41-xx: yy: state information in more than 3 time periods of 50, deriving the xx according to requirements: yy:31-xx: yy: all status information within the 40 slots is in D disk xxx files.

According to embodiments of the present disclosure, a developer may perform various operations on a visual interface.

For example, personalized monitoring alarm is configured on a visual interface, the visual interface supports a developer to configure alarm in a self-defined manner, threshold alarm is respectively set according to a target state, a target state abnormality degree and a predicted state stored in a database, and meanwhile, multi-dimensional monitoring can be realized by multi-dimensional layer by layer, and target state information is checked layer by layer according to a system, software, time, state abnormality degree and state prediction trend; the visual interface also supports research staff to complete various charts such as tabulation, line graph, column graph, radar graph and the like aiming at information content, for example, the software is monitored in a certain system in a whole way, and the radar graph can be used for monitoring; using a line graph to monitor a certain software state for a long time; comparing the same software state under different systems by using a bar graph; the visual interface also supports grey forward decision support, the predicted state obtained through a grey time sequence GM (1, 1) prediction algorithm can be displayed in real time to be compared with the target state obtained through the association relation model, and research and development personnel can customize the predicted state as a formal classification state to give an alarm.

According to the embodiment of the disclosure, as the visual interface is provided, the running state information and the running state prediction information can be displayed on the visual interface, and the alarm information can be displayed on the visual interface under the condition that the abnormal characteristic of the second running state is greater than the preset threshold value, so that the abnormal running state of a target period can be monitored and tracked in time by research personnel.

It should be noted that the embodiments of the present disclosure may be used in the following scenarios, for example, online tracking of a target state, including: for the time series target data collection module, from the multi-target log data at a frequency of 10 seconds, on the "topic: the form of data is intensively downloaded to an asynchronous transmission queue until the data is washed, aggregated, extracted in characteristics, clustered in state characteristics, classified in state and predicted in state trend, and the fields to be collected comprise time, theme, state abnormality degree and predicted state of the current state abnormality degree; for the time sequence target data integration module, the invention refers to a form of storing results into a database, and the result data needs to be stored in a multi-target time sequence mode for subsequent reuse and result display, so that each record in the Mysql database is recorded in a "{ time: theme (subsystem name_software name): status: degree of state abnormality: the result storage is completed in the form of a prediction state of the current state abnormality degree }; aiming at the time sequence target data state display module, the state, state abnormality degree and next state prediction trend display are needed to be carried out in a time sequence mode in a target division mode, relevant information is marked and prompted in the display, the method specifically depends on a Grafana frame, and Mysql data sources are configured in the Grafana to complete personalized panel customization of data stored in the time sequence target data integration module.

Fig. 4 schematically illustrates a flow chart of a training method of a classification model according to an embodiment of the disclosure.

As shown in fig. 4, the method for generating host operation state information of this embodiment includes operations S410 to S460.

According to an embodiment of the present disclosure, a training method of a classification model includes:

in operation S410, a sample log of the target host is acquired over a history period.

In operation S420, the sample operation logs are clustered based on a clustering algorithm, resulting in a plurality of sample data sets and a plurality of operation state categories corresponding to the plurality of sample data sets.

According to an embodiment of the present disclosure, one sample data set includes a plurality of sample data.

According to the embodiment of the disclosure, the system can automatically obtain the corresponding operation state category of each sample data set while obtaining a plurality of sample data sets.

For example, the A sample dataset corresponds to a continuously rising run category and the B sample dataset corresponds to a fluctuating run category.

For example, a DBSCAN clustering algorithm is used for carrying out cluster analysis on a sample operation log, a cluster super parameter is determined according to a clustering effect, training of a cluster model is completed, and a DBSCAN method of sklearn. DBSCAN (eps, min_samples), field (X), wherein parameters eps and min_samples are super parameters, eps refers to radius in set density clustering, min_samples refers to the minimum sample number used for setting density clustering radius, the two parameters need to be simultaneously adjusted, namely a plurality of candidate values are usually designated, a reasonable threshold value is selected from the candidate values, the adjustment Lande index result of a DBSCAN clustering algorithm is evaluated through parameter optimization to be 0.952, wherein in the evaluation of the aggregation model, the closer the value is to 1, the closer to the real condition, the determined super parameters eps are 0.3, the min_samples are 10, namely the cluster result that the Euclidean distance of the cluster radius is 0.3 is determined from the minimum 10 samples, and the cluster model ELDB is obtained.

In operation S430, a plurality of sample data sets are encoded, resulting in sample features.

According to the embodiment of the disclosure, binary coding operation is performed on each sample data set, and sample characteristics are obtained according to the coded sample data sets.

In operation S440, the sample feature and the sample label are input into the first initial model, resulting in an operation state prediction category corresponding to the sample feature.

According to an embodiment of the present disclosure, wherein the sample tag characterizes a run state category corresponding to the sample dataset.

According to embodiments of the present disclosure, while the system is obtaining sample data sets, the system may generate corresponding operational status categories from each sample data set.

In operation S450, a loss value is obtained from the operation state prediction category and the sample tag based on the first loss function.

According to embodiments of the present disclosure, the first loss function may employ a cross entropy loss function, a cosine similarity loss function, or the like.

In operation S460, model parameters of the first initial model are adjusted based on the first loss value, resulting in a classification model.

According to the embodiment of the disclosure, in the system, a predetermined convergence value is set, and the predetermined convergence value can be used for judging whether the first loss value meets the requirement of the numerical value, if so, determining that the first initial model corresponding to the first loss value is a classification model, and if not, adjusting model parameters of the first initial model to obtain the classification model.

According to embodiments of the present disclosure, the predetermined convergence value may be set by a developer according to the experience of the developer.

According to the embodiment of the disclosure, under the condition that the first loss value is smaller than the preset convergence value, the first convergence value is judged to be satisfactory, otherwise, the first convergence value is not satisfactory, and after the model parameters are adjusted, training of the model is continued.

For example: and under the condition that the model parameters of the first initial model do not meet the requirements, carrying out first parameter adjustment on the model parameters of the first initial model, repeating the operation S440, the operation S450 and the operation S460 again according to the adjusted model of the first initial model, judging whether the loss value meets the requirements or not, if not, adjusting the model parameters of the first initial model again, and repeating the operation S440, the operation S450 and the operation S460 again according to the adjusted model of the first initial model again until the model meets the requirements, and determining the model corresponding to the first loss value meeting the requirements as a classification model.

For example, using the high-efficiency Catoost algorithm for classification, using the CatoostClassifier method of CatBoost in python, the model for training feature clustering results and their state labels data is as follows: to prevent model overfitting, the auc index of the Catboost class classification algorithm is evaluated to be 0.93 through parameter tuning, wherein the higher the classification accuracy is, the closer the auc index is to 1 in the evaluation class model, the determined super-parameter iteration number item is 100, the comparison depth is 2, the learning rate learning_rate is 0.5, and the loss function loss_function is selected to be a log-loss value metric based on probability form by logless, so as to obtain the class model CA.

According to the embodiment of the disclosure, since the sample operation logs of the target host in the historical period are obtained, the sample operation logs are clustered to obtain a plurality of sample data sets and corresponding operation state categories thereof, the sample data sets are encoded to obtain sample characteristics, the sample characteristics and the sample labels are input into the first initial model to obtain operation state prediction categories, whether the first loss value meets the requirements is judged according to the preset convergence threshold in the system, model parameters are adjusted to obtain the classification model, a training method of the classification model is realized, the time cost is saved, and the classification efficiency is further improved.

Fig. 5 schematically illustrates a flowchart of a training method of an associative relationship model according to an embodiment of the present disclosure.

As shown in fig. 5, the method for generating host operation state information of this embodiment includes operations S510 to S540.

According to an embodiment of the present disclosure, a training method of an association relationship model includes:

in operation S510, the sample operation state abnormality feature is input to the second initial model to obtain a sample operation state abnormality feature prediction value.

In operation S520, a prediction category of the sample operation state is queried according to the sample operation state abnormality characteristic prediction value.

According to an embodiment of the disclosure, in a table of the system, prediction categories of sample operation states are included, each category corresponding to a sample operation state anomaly characteristic prediction value.

In operation S530, a second loss value is obtained from the prediction category and the sample operation state category based on the second loss function.

According to embodiments of the present disclosure, the second loss function may employ a cross entropy loss function, a cosine similarity loss function, or the like.

In operation S540, model parameters of the second initial model are adjusted based on the second loss value, and an association relation model is obtained.

According to the embodiment of the disclosure, in the system, a second predetermined convergence value is set, and the second predetermined convergence value can be used for judging whether the second loss value meets the requirement of the numerical value, if so, determining that a second initial model corresponding to the second loss value is an association relation model, and if not, adjusting model parameters of the second initial model to obtain the association relation model.

According to an embodiment of the present disclosure, the second predetermined convergence value may be set by a developer according to experience of the developer.

According to an embodiment of the disclosure, if the second loss value is smaller than the second predetermined convergence value, it is determined that the second convergence value is satisfactory, otherwise, the second convergence value is not satisfactory.

According to the embodiment of the disclosure, under the condition that the model parameters of the second initial model do not meet the requirements, performing first parameter adjustment, repeating operation S510, operation S520, operation S530 and operation S540 again according to the adjusted model of the second initial model, judging whether the loss value at the moment meets the requirements, if the loss value does not meet the requirements, adjusting the model parameters of the second initial model for the second time, and repeating operation S510, operation S520, operation S530 and operation S540 again according to the adjusted model of the second initial model for the second time until the loss value meets the requirements, and determining the model corresponding to the second loss value meeting the requirements as the association relation model.

According to the embodiment of the disclosure, according to the association relation model, a target operator corresponding to the operation state category is obtained, and the target operator corresponding to the operation state category can be obtained by adopting the following operations: and according to the absolute value of the value obtained by subtracting the abnormal index of the preset operation state from the abnormal characteristic of the second operation state corresponding to the operation state type, checking the similarity of the abnormal characteristic of the second operation state and the abnormal index of the preset operation state through residual error checking, wherein the smaller the absolute value is, the higher the similarity is, the higher the operator accuracy for processing the abnormal characteristic of the operation state is, the larger the absolute value is, the lower the similarity is, and the operator accuracy for processing the abnormal characteristic of the operation state is lower. According to the obtained absolute values, determining a corresponding operator with the smallest absolute value from the absolute values as a target operator, correlating the target operator with the running state class, and obtaining each corresponding operator for all the running classes according to the correlation model, so that the operator can be conveniently called according to the running state class next time.

According to the embodiment of the disclosure, the abnormal characteristic of the sample running state is input into the second initial model to obtain the predicted value of the abnormal characteristic of the sample running state, the predicted class and the class of the sample running state are inquired from the system according to the predicted value, the predicted class and the class of the sample running state are input into the second loss function to obtain the second loss value, whether the second loss value meets the preset requirement or not is judged, and the association relation model is obtained under the condition that the second loss value meets the requirement, so that the training method of the association relation model is realized, the time cost is saved, and the accuracy and the working efficiency of the predicted state information are further improved.

Based on the method for generating the running state information of the host, the invention also provides a device for generating the running state information of the host. The device will be described in detail below in connection with fig. 6.

Fig. 6 schematically shows a block diagram of a structure of a device for generating host operation state information according to an embodiment of the present disclosure.

As shown in fig. 6, the generating apparatus 600 of the host operation state information of this embodiment includes an obtaining module 610, an encoding module 620, a classifying module 630, and a predicting module 640.

And the obtaining module 610 is configured to obtain a running log of the target host in the current period, where the running log includes running contents corresponding to a plurality of running moments in the current period. In an embodiment, the obtaining module 610 may be configured to perform the operation S210 described above, which is not described herein.

The encoding module 620 is configured to encode the operation content of the operation log to obtain a time sequence characteristic of the operation state. In an embodiment, the encoding module 620 may be configured to perform the operation S220 described above, which is not described herein.

The classification module 630 is configured to detect the time sequence feature by using the classification model to obtain the running state information of the target host. In an embodiment, the classification module 630 may be configured to perform the operation S230 described above, which is not described herein.

And the prediction module 640 is used for inputting the running state information into the association relation model to obtain the running state prediction information of the target host in the target period. In an embodiment, the prediction module 640 may be configured to perform the operation S240 described above, which is not described herein.

Any of the acquisition module 610, the encoding module 620, the classification module 630, and the prediction module 640 may be combined in one module to be implemented, or any of the modules may be split into multiple modules, according to embodiments of the present disclosure. Alternatively, at least some of the functionality of one or more of the modules may be combined with at least some of the functionality of other modules and implemented in one module. According to embodiments of the present disclosure, at least one of the acquisition module 610, the encoding module 620, the classification module 630, and the prediction module 640 may be implemented at least in part as hardware circuitry, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system on a chip, a system on a substrate, a system on a package, an Application Specific Integrated Circuit (ASIC), or may be implemented in hardware or firmware in any other reasonable manner of integrating or packaging the circuitry, or in any one of or a suitable combination of any of the three implementations of software, hardware, and firmware. Alternatively, at least one of the acquisition module 610, the encoding module 620, the classification module 630, and the prediction module 640 may be at least partially implemented as a computer program module that, when executed, performs the corresponding functions.

As shown in fig. 7, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 702 or a program loaded from a storage section 708 into a Random Access Memory (RAM) 703. The processor 701 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or an associated chipset and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), or the like. The processor 701 may also include on-board memory for caching purposes. The processor 701 may comprise a single processing unit or a plurality of processing units for performing different actions of the method flows according to embodiments of the disclosure.

In the RAM 703, various programs and data necessary for the operation of the electronic apparatus 700 are stored. The processor 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. The processor 701 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM 702 and/or the RAM 703. Note that the program may be stored in one or more memories other than the ROM 702 and the RAM 703. The processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in the one or more memories.

According to an embodiment of the present disclosure, the electronic device 700 may further include an input/output (I/O) interface 705, the input/output (I/O) interface 705 also being connected to the bus 704. The electronic device 700 may also include one or more of the following components connected to the I/O interface 705: an input section 706 including a keyboard, a mouse, and the like; an output portion 707 including a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, a speaker, and the like; a storage section 708 including a hard disk or the like; and a communication section 709 including a network interface card such as a LAN card, a modem, or the like. The communication section 709 performs communication processing via a network such as the internet. The drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 710 as necessary, so that a computer program read therefrom is mounted into the storage section 708 as necessary.

The present disclosure also provides a computer-readable storage medium that may be embodied in the apparatus/device/system described in the above embodiments; or may exist alone without being assembled into the apparatus/device/system. The computer-readable storage medium carries one or more programs which, when executed, implement methods in accordance with embodiments of the present disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example, but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, the computer-readable storage medium may include ROM 702 and/or RAM 703 and/or one or more memories other than ROM 702 and RAM 703 described above.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowcharts. The program code, when executed in a computer system, causes the computer system to implement the item recommendation method provided by embodiments of the present disclosure.

The above-described functions defined in the system/apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 701. The systems, apparatus, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the disclosure.

In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted, distributed over a network medium in the form of signals, downloaded and installed via the communication section 709, and/or installed from the removable medium 711. The computer program may include program code that may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

In such an embodiment, the computer program may be downloaded and installed from a network via the communication portion 709, and/or installed from the removable medium 711. The above-described functions defined in the system of the embodiments of the present disclosure are performed when the computer program is executed by the processor 701. The systems, devices, apparatus, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the disclosure.

According to embodiments of the present disclosure, program code for performing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, such computer programs may be implemented in high-level procedural and/or object-oriented programming languages, and/or assembly/machine languages. Programming languages include, but are not limited to, such as Java, c++, python, "C" or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that the features recited in the various embodiments of the disclosure and/or in the claims may be provided in a variety of combinations and/or combinations, even if such combinations or combinations are not explicitly recited in the disclosure. In particular, the features recited in the various embodiments of the present disclosure and/or the claims may be variously combined and/or combined without departing from the spirit and teachings of the present disclosure. All such combinations and/or combinations fall within the scope of the present disclosure.

The embodiments of the present disclosure are described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the embodiments cannot be used advantageously in combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be made by those skilled in the art without departing from the scope of the disclosure, and such alternatives and modifications are intended to fall within the scope of the disclosure.

Claims

1. A method for generating host operation state information includes:

acquiring an operation log of a target host in a current period, wherein the operation log comprises operation contents corresponding to a plurality of operation moments in the current period;

Encoding the operation content of the operation log to obtain the time sequence characteristics of the operation state;

detecting the time sequence characteristics by using a classification model to obtain the running state information of the target host; and

and inputting the running state information into an association relation model to obtain the running state prediction information of the target host in a target period.

2. The method of claim 1, wherein the detecting the timing characteristic using a classification model yields operational status information of the target host, comprising:

inputting the time sequence features into the classification model to obtain the matching probability of the time sequence features and a preset running state class; and

and obtaining the running state information based on the matching probability.

3. The method of claim 2, wherein the deriving the operating state information based on the matching probabilities comprises:

determining a first operating state class from the predetermined operating state classes;

inquiring a first abnormality index corresponding to the first running state category according to the first running state category; and

and obtaining the first running state abnormal characteristic according to the matching probability of the time sequence characteristic and the first running state class and the first abnormality index.

4. The method of claim 1, wherein the operating state information includes a first operating state category and a first operating state anomaly characteristic; inputting the first operation state abnormal characteristics into an association relation model to obtain operation state prediction information of the target host in a target period, wherein the operation state prediction information comprises:

determining a target operator for processing the first operation state abnormal characteristics according to the first operation state category; and

and processing the first running state abnormal characteristic based on the target operator to obtain the running state prediction information.

5. The method of claim 4, wherein the processing the first operating state anomaly characteristic based on the target operator to obtain the operating state prediction information comprises:

based on a grey time sequence prediction algorithm, the first running state characteristic is checked to obtain a checking result; and

processing the first running state abnormal characteristic based on the target operator under the condition that the test result is determined to pass, so as to obtain running state prediction information;

under the condition that the checking result is determined to be not passing, adding the first running state abnormal characteristic and a random number to obtain a target running state abnormal characteristic, wherein the target running state abnormal characteristic represents the characteristic that the checking result is passing; and

And processing the abnormal characteristics of the target running state based on the target operator to obtain the running state prediction information.

6. The method of claim 4, wherein the processing the first operating state anomaly characteristic based on the target operator to obtain the operating state prediction information comprises:

processing the first operation state abnormal characteristic based on the target operator to obtain a second operation state abnormal characteristic;

and determining a second operation state category corresponding to the second operation state abnormal feature according to the second operation state abnormal feature and the abnormality index of the preset operation state.

7. The method of claim 5, further comprising:

displaying the running state information and the running state prediction information through a visual interface; and

and responding to the abnormal characteristic of the second running state to be larger than a preset threshold value, and displaying alarm information through the visual interface.

8. The method of claim 1, wherein the training method of the classification model comprises:

acquiring a sample operation log of a target host in a history period;

based on a clustering algorithm, clustering the sample operation logs to obtain a plurality of sample data sets and a plurality of operation state categories corresponding to the plurality of sample data sets;

Encoding the plurality of sample data sets to obtain sample characteristics;

inputting sample characteristics and sample labels into a first initial model to obtain a running state prediction category corresponding to the sample characteristics, wherein the sample labels represent the running state category corresponding to the sample data set

Based on a first loss function, obtaining a loss value according to the running state prediction category and the sample label; and

and adjusting model parameters of the first initial model based on the first loss value to obtain the classification model.

9. The method of claim 8, wherein the training method of the association model comprises:

inputting the abnormal characteristics of the sample running state into a second initial model to obtain a predicted value of the abnormal characteristics of the sample running state;

inquiring the prediction type of the sample running state according to the abnormal characteristic prediction value of the sample running state;

based on a second loss function, obtaining a second loss value according to the prediction category and the sample running state category;

and adjusting model parameters of the second initial model based on the second loss value to obtain the association relation model.

10. A device for generating host operation state information, comprising:

The system comprises an acquisition module, a storage module and a storage module, wherein the acquisition module is used for acquiring a running log of a target host in a current period, and the running log comprises running contents corresponding to a plurality of running moments in the current period;

the coding module is used for coding the operation content of the operation log to obtain the time sequence characteristics of the operation state;

the classification module is used for detecting the time sequence characteristics by utilizing a classification model to obtain the running state information of the target host; and

and the prediction module is used for inputting the running state information into the association relation model to obtain the running state prediction information of the target host in the target period.

11. An electronic device, comprising:

one or more processors;

storage means for storing one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-9.

12. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to perform the method according to any of claims 1 to 9.

13. A computer program product comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 9.