CN117132372A - Business anomaly analysis method, device, equipment and storage medium - Google Patents
Business anomaly analysis method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN117132372A CN117132372A CN202311090719.4A CN202311090719A CN117132372A CN 117132372 A CN117132372 A CN 117132372A CN 202311090719 A CN202311090719 A CN 202311090719A CN 117132372 A CN117132372 A CN 117132372A
- Authority
- CN
- China
- Prior art keywords
- node
- link
- abnormal
- nodes
- current
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000004458 analytical method Methods 0.000 title claims abstract description 94
- 230000002159 abnormal effect Effects 0.000 claims abstract description 101
- 238000011144 upstream manufacturing Methods 0.000 claims abstract description 78
- 238000000034 method Methods 0.000 claims abstract description 29
- 230000002776 aggregation Effects 0.000 claims description 9
- 238000004220 aggregation Methods 0.000 claims description 9
- 238000004590 computer program Methods 0.000 claims description 4
- 230000005856 abnormality Effects 0.000 description 6
- 238000010586 diagram Methods 0.000 description 6
- 238000004891 communication Methods 0.000 description 4
- 230000002547 anomalous effect Effects 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000009825 accumulation Methods 0.000 description 1
- 230000032683 aging Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000001934 delay Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 230000001747 exhibiting effect Effects 0.000 description 1
- 229920001690 polydopamine Polymers 0.000 description 1
- 238000009877 rendering Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/0703—Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of redundancy in operation, in hardware, or in data representation
- G06F11/079—Root cause analysis, i.e. error or fault diagnosis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3034—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system component is a storage system, e.g. DASD based or network based
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2474—Sequence data queries, e.g. querying versioned data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/25—Integrating or interfacing systems involving database management systems
- G06F16/252—Integrating or interfacing systems involving database management systems between a Database Management System and a front-end application
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Databases & Information Systems (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Quality & Reliability (AREA)
- Data Mining & Analysis (AREA)
- Business, Economics & Management (AREA)
- Finance (AREA)
- General Business, Economics & Management (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Marketing (AREA)
- Economics (AREA)
- Development Economics (AREA)
- Technology Law (AREA)
- Accounting & Taxation (AREA)
- Strategic Management (AREA)
- Fuzzy Systems (AREA)
- Probability & Statistics with Applications (AREA)
- Software Systems (AREA)
- Computational Linguistics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The application discloses a business anomaly analysis method, a device, equipment and a storage medium, which relate to the technical field of business anomaly analysis, wherein the method comprises the following steps: generating a node set to be analyzed according to all first direct upstream nodes of a target operation node of the abnormal service, circularly updating the node set to be analyzed to determine a plurality of current latest nodes serving as known link nodes according to all second direct upstream nodes connected with the current latest node in the node set to be analyzed and other nodes except the current latest node in the node set to be analyzed, obtaining the target link node set until the current latest node is the most upstream node corresponding to the abnormal operation, and carrying out abnormal analysis on all known link nodes in the target link node set to obtain an abnormal analysis result of the abnormal service. The application solves the technical problem of low accuracy of the existing business anomaly analysis method for carrying out business anomaly analysis based on the single latest operation link, and improves the accuracy of business anomaly analysis.
Description
Technical Field
The present application relates to the field of business anomaly analysis technologies, and in particular, to a business anomaly analysis method, device, apparatus, and storage medium.
Background
In the financial field, huge service data are stored by using data lakes, and in the process of realizing business service, data processing operations corresponding to a plurality of data tables are required to be executed. Thus, an abnormality occurs in the business service due to a delay in execution of some data processing jobs.
In the related technology, when the business service is abnormal, the latest operation link of the business service is obtained based on the operation directed graph of the data lake, and the business abnormality analysis is performed by analyzing the execution conditions of all operation nodes on the latest operation link. However, a single latest job link may fail to cover execution anomalies of multiple jobs, resulting in lower accuracy of analysis of the traffic anomalies.
Disclosure of Invention
The main purpose of the application is that: the application provides a business anomaly analysis method, a business anomaly analysis device, business anomaly analysis equipment and a storage medium, and aims to solve the technical problem that the existing business anomaly analysis method for business anomaly analysis based on a single latest operation link is low in accuracy.
In order to achieve the above purpose, the application adopts the following technical scheme:
in a first aspect, the present application provides a method for analyzing business anomalies, including:
obtaining a node set to be analyzed according to all first direct upstream nodes connected with a target operation node of abnormal operation in the operation directed graph;
determining the current latest node from the node set to be analyzed, and adding the current latest node as a known link node to the known link node set;
updating the node set to be analyzed according to all second direct upstream nodes connected with the current latest node and other nodes except the current latest node in the node set to be analyzed;
returning to execute the step of determining the current latest node from the node set to be analyzed as the known link node to be added into the known link node set until the current latest node is the most upstream node corresponding to the abnormal service, so as to obtain a target link node set;
and carrying out anomaly analysis on all known link nodes in the target link node set to obtain an anomaly analysis result of the anomaly service.
Optionally, the step of determining the current latest node from the node set to be analyzed and adding the current latest node as the known link node to the known link node set is performed back until the current latest node is the most upstream node corresponding to the abnormal service, so as to obtain the target link node set, including:
returning to execute the step of determining the current latest node from the node set to be analyzed as the known link node to be added to the known link node set until the known link node set comprises a preset number of link bifurcation nodes to obtain a target link node set;
performing anomaly analysis on all known link nodes in the target link node set to obtain an anomaly analysis result of the anomaly service, wherein the anomaly analysis result comprises the following steps:
determining a preset number of abnormal links from the operation directed graph according to the target link node set;
and obtaining an abnormal analysis result of the abnormal service according to at least one abnormal node on all the abnormal links.
Optionally, determining a preset number of abnormal links from the job directed graph according to the known link node set includes:
determining a preset number of initial abnormal links from the operation directed graph according to the link bifurcation node and other known link nodes which are on the same link with the link bifurcation node in the target link node set;
and obtaining the abnormal link according to the initial abnormal link and the latest link corresponding to the link bifurcation node.
Optionally, before obtaining the abnormal link according to the initial abnormal link and the latest link corresponding to the link bifurcation node, the method further includes:
taking the link bifurcation node as a current link node;
determining a current latest direct upstream node from a current direct upstream node set of current link nodes as a next link node to obtain a current latest link;
and if the last link node of the current latest link is not the most upstream node, taking the last link node as the current link node, and returning to execute the step of determining the current latest direct upstream node from the current direct upstream node set of the current link node as the next link node to obtain the current latest link until the last link node is the most upstream node to obtain the latest link.
Optionally, obtaining an anomaly analysis result of the anomaly service according to at least one anomaly node on all the anomaly links, including:
determining at least one abnormal node from all the link nodes according to the current waiting time and the historical average waiting time of each link node on the abnormal link and the current execution time and the historical average execution time of the link node;
and obtaining an anomaly analysis result according to at least one anomaly node.
Optionally, the step of determining the current latest node from the node set to be analyzed as the known link node to be added to the known link node set is performed back until the known link node set includes a preset number of link bifurcation nodes to obtain the target link node set, and before the method further includes:
and obtaining the preset number corresponding to the abnormal links according to the delay time threshold of the abnormal service.
Optionally, the target job node is the last job node of the abnormal traffic.
In a second aspect, the present application further provides a business anomaly analysis device, where the device includes:
the first aggregation module is used for obtaining a node aggregation to be analyzed according to all first direct upstream nodes connected with a target operation node of abnormal business in the operation directed graph;
the second set module is used for determining the current latest node from the node set to be analyzed, and adding the current latest node to the known link node set as the known link node;
the first updating module is used for updating the node set to be analyzed according to all second direct upstream nodes connected with the current latest node and other nodes except the current latest node in the node set to be analyzed;
the second updating module is used for returning to execute the step of determining the current latest node from the node set to be analyzed and adding the current latest node to the known link node set as the known link node until the current latest node is the most upstream node corresponding to the abnormal service, so as to obtain a target link node set;
the anomaly analysis module is used for carrying out anomaly analysis on all known link nodes in the target link node set to obtain an anomaly analysis result of the anomaly service.
In a third aspect, the present application also provides a business anomaly analysis device, including: the system comprises a memory, a processor and a business anomaly analysis program stored on the memory and capable of running on the processor, wherein the business anomaly analysis program is configured to realize the steps of any business anomaly analysis method.
In a fourth aspect, the present application also provides a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the business anomaly analysis method as described in any one of the above.
The application provides a business anomaly analysis method, a business anomaly analysis device, business anomaly analysis equipment and a business anomaly analysis storage medium.
In this way, aiming at abnormal business, all the direct upstream nodes of the target operation node generate a node set to be analyzed, and the node set to be analyzed is updated according to the rest nodes except the current latest node in the node set to be analyzed and all the direct upstream nodes of the current latest node in the node set to be analyzed in a circulating way, so that a plurality of known link nodes are determined from the node set to be analyzed in a circulating way to perform abnormal business analysis.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, and it is obvious that the drawings in the following description are only some embodiments of the present application, and other drawings may be obtained according to the structures shown in these drawings without inventive effort for a person skilled in the art.
FIG. 1 is a schematic diagram of a business anomaly analysis device according to the present application;
FIG. 2 is a flowchart of a first embodiment of a business anomaly analysis method according to the present application;
FIG. 3 is a flowchart illustrating a business anomaly analysis method according to a second embodiment of the present application
FIG. 4 is a schematic diagram of an exemplary abnormal link acquisition process;
fig. 5 is a schematic block diagram of a first embodiment of a business anomaly analysis device according to the present application.
The achievement of the objects, functional features and advantages of the present application will be further described with reference to the accompanying drawings, in conjunction with the embodiments.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the present application more apparent, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application, and it is apparent that the described embodiments are only some embodiments of the present application, not all embodiments of the present application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.
It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the scope of the application.
In the present disclosure, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a device or system that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such device or system. Without further limitation, an element defined by the phrase "comprising … …" does not exclude that an additional identical element is present in a device or system comprising the element.
If there is a description of "first", "second", etc. in an embodiment of the present application, the description of "first", "second", etc. is for descriptive purposes only and is not to be construed as indicating or implying a relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first" or "a second" may explicitly or implicitly include at least one such feature.
With the advancement of time and the accumulation of data, data lakes in the financial field are becoming increasingly larger. The basic storage unit of data in a data lake is a data table in which data flows as the data processing program is executed, and the data processing program is configured and managed in the form of a job. Since there is an association relationship between the upstream and downstream data tables, the jobs are dependent on the upstream and downstream accordingly, and thus if the upstream job is executed abnormally, the output delay of the downstream job may be affected. The network dependence of the operation in the actual data lake is complicated, and when the downstream operation monitored by a certain key point has aging delay, it is often difficult to analyze which operation or operations in the upstream link have problems.
An analysis method of job count delay is to find all jobs upstream of a target job, and find a job point suspected of abnormality by comparing the current waiting time and the historical waiting time or the current execution time and the historical execution time of each job, but this method is time-consuming and labor-consuming.
Another method for analyzing the delay of the job number is to start from the target job, find the job with the latest completion time in the direct upstream job set, and then start from the job, find the job with the latest completion time in the direct upstream set in the same way. And circulating in this way until the source end operation without upstream operation is found. The job set searched in sequence has a chain-like dependency relationship. The operation link is found according to the latest completion time of the operation, so that the operation link is called a latest operation link. The latest job link is a key link that affects the timeliness of job output. By comparing the current waiting time and the historical waiting time or the current execution time and the historical execution time of each job in the latest job link, the searching range of the abnormal job is greatly reduced, and the analysis efficiency of the delay root cause is improved.
However, in a business execution process, a plurality of abnormal execution conditions may occur, so that a single latest job link may occur and cannot cover the abnormal execution conditions of the plurality of jobs, which results in lower business abnormality analysis accuracy.
In view of the technical problem that the existing business anomaly analysis method for carrying out business anomaly analysis based on a single latest operation link is low in accuracy, the application provides a business anomaly analysis method, and the overall thought is as follows:
the method comprises the following steps: obtaining a node set to be analyzed according to all first direct upstream nodes connected with a target operation node of abnormal operation in the operation directed graph; determining the current latest node from the node set to be analyzed, and adding the current latest node as a known link node to the known link node set; updating the node set to be analyzed according to all second direct upstream nodes connected with the current latest node and other nodes except the current latest node in the node set to be analyzed; returning to execute the step of determining the current latest node from the node set to be analyzed as the known link node to be added into the known link node set until the current latest node is the most upstream node corresponding to the abnormal service, so as to obtain a target link node set; and carrying out anomaly analysis on all known link nodes in the target link node set to obtain an anomaly analysis result of the anomaly service.
The application improves a business anomaly analysis method, and aims at the anomaly business, all the direct upstream nodes of the target operation node generate a node set to be analyzed, and the node set to be analyzed is circularly updated according to the rest nodes except the current latest node in the node set to be analyzed and all the direct upstream nodes of the current latest node, so that a plurality of known link nodes are determined from the circularly changed node set to be analyzed to conduct anomaly business analysis.
The following describes in detail a method, a device, equipment and a storage medium for analyzing business anomalies applied in the implementation of the technology of the present application:
referring to fig. 1, fig. 1 is a schematic structural diagram of a business anomaly analysis device of a hardware running environment according to an embodiment of the present application.
As shown in fig. 1, the apparatus may include: a processor 1001, such as a CPU, a user interface 1003, a memory 1005, and a communication bus 1002. Wherein the communication bus 1002 is used to enable connected communication between these components. The user interface 1003 may include smart phones, tablet devices, and handheld computers (PDAs, personal Digital Assistants) and other types of electronic devices, and the user interface 1003 may alternatively be a Display screen (Display), an input unit such as a Keyboard (Keyboard), and the like. The memory 1005 may be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also optionally be a storage device separate from the processor 1001 described above.
It is to be appreciated that the device can also include a network interface 1004, and that the network interface 1004 can optionally include a standard wired interface, a wireless interface (e.g., WI-FI interface). Optionally, the device may also include RF (Radio Frequency) circuitry, sensors, audio circuitry, wiFi modules, and the like.
It will be appreciated by those skilled in the art that the apparatus structure shown in fig. 1 is not limiting of the apparatus and may include more or fewer components than shown, or may combine certain components, or a different arrangement of components.
The method, the device, the equipment and the storage medium for analyzing the business anomalies are described in detail below with reference to the attached drawings and the detailed description.
Based on the above hardware structure, but not limited to the above hardware structure, fig. 2 is a flow chart of a first embodiment of the business anomaly analysis method according to the present application.
The embodiment provides a business anomaly analysis method, which may include:
step S100: and obtaining a node set to be analyzed according to all the first direct upstream nodes connected with the target operation node of the abnormal operation in the operation directed graph.
The target operation node is the last operation node of the abnormal service.
In this embodiment, the execution body may be a service abnormality analysis device as shown in fig. 1, and the service abnormality analysis device may be a physical server including an independent host, or may be a virtual server carried by a host cluster.
The job directed graph may be created from a data lake rendering of a financial services business. The job directed graph includes job nodes and node flow direction links for each service, where a service may include multiple job nodes and corresponding multiple node flow direction links. One service may be implemented by multiple node flow paths, and one job node may correspond to multiple direct upstream nodes. The initial set of nodes to be analyzed includes all first direct upstream nodes to which the target job node is connected. The anomalous traffic may be any traffic exhibiting a number of delays.
Step S200: and determining the current latest node from the node set to be analyzed, and adding the current latest node as a known link node to the known link node set.
Step S300: and updating the node set to be analyzed according to all second direct upstream nodes connected with the current latest node and other nodes except the current latest node in the node set to be analyzed.
Step S400: and returning to the step S200 until the current latest node is the most upstream node corresponding to the abnormal service, and obtaining a plurality of target link node sets.
In this embodiment, the current latest node may be the job node with the latest execution time in the node set to be analyzed. And circulating through all direct upstream nodes of the current latest node in the node set to be analyzed and other nodes except the current latest node in the node set to be analyzed, updating the node set to be analyzed, determining the current latest node from the node set to be analyzed as a known link node, adding the known link node to the known link node set, and obtaining a plurality of known link nodes. Wherein the set of target link nodes includes a target job node and a plurality of known link nodes.
It will be appreciated that different services may be performed starting from at least one most upstream node. So that there is at least one most upstream node in the traffic directed graph for the abnormal traffic. And if the current latest node is the most upstream node corresponding to the abnormal service, stopping updating the node set to be analyzed to obtain a plurality of known link nodes.
Step S500: and carrying out anomaly analysis on all known link nodes in the target link node set to obtain an anomaly analysis result of the anomaly service.
In this embodiment, an anomaly analysis result of the anomaly service is obtained by analyzing anomalies of all known link nodes in the target link node set.
The embodiment provides a business anomaly analysis method, aiming at an anomaly business, all direct upstream nodes of a target operation node generate a node set to be analyzed, and the node set to be analyzed is updated according to other nodes except the current latest node in the node set to be analyzed and all direct upstream nodes of the current latest node in a circulating manner, so that a plurality of known link nodes are determined from the circulating variation node set to be analyzed to conduct anomaly business analysis.
Further, referring to fig. 3 to fig. 4, fig. 3 is a flowchart illustrating a second embodiment of a traffic anomaly analysis method according to the present application, and fig. 4 is a schematic diagram illustrating an exemplary acquisition process of an anomaly link.
In distinguishing from the first embodiment, the present embodiment provides a method for analyzing a business anomaly, where step S400 may include:
step S410: step S200 is performed back until the known link node set includes a preset number of link forking nodes, resulting in a target link node set.
Step S500 may include:
step S510: determining a preset number of abnormal links from the operation directed graph according to the target link node set;
step S520: and obtaining an abnormal analysis result of the abnormal service according to at least one abnormal node on all the abnormal links.
In this embodiment, a preset number of abnormal links is set, when a target operation node in a known link node set is used as an initial link node and a current latest node is used as a link node, and a preset number of abnormal links can be determined from the operation directed graph, updating of the node set to be analyzed is stopped, and a target link node set is obtained. Therefore, the number of known link nodes in the target link node set is limited according to the preset number, the number of analyzed nodes can be reduced, and the business anomaly analysis efficiency is improved. It will be appreciated that the target job node and other known link nodes in the set of target link nodes may constitute a predetermined number of node links.
As an embodiment, before step S410, the method may further include: and obtaining the preset number corresponding to the abnormal links according to the delay time threshold of the abnormal service.
In this embodiment, different delay time thresholds can be tolerated for the number of times of different financial services. When the method is specifically used, the number of the abnormal links can be determined according to the delay time threshold value of the number of the outgoing times of different services. Preferably, the longer the delay time threshold, the greater the number of abnormal links may be.
As a specific embodiment, step S510 may include: determining a preset number of initial abnormal links from the operation directed graph according to the link bifurcation node and other known link nodes which are on the same link with the link bifurcation node in the known link node set; and obtaining the abnormal link according to the initial abnormal link and the latest link corresponding to the link bifurcation node.
In this embodiment, the anomalous link includes an initial anomalous link before the link forking node and a latest link before the link forking node. The initial abnormal link is formed by connecting a link forking node and other known link nodes which are on the same link with the link forking node in the target link node set. Specifically, the initial abnormal link uses the target operation node as an initial link node, uses other known link nodes on the same link as the target operation node and the link bifurcation point as link nodes, and uses the link bifurcation node as a final link node. In addition, the latest link is obtained from the operation directed graph by taking the link forking node as an initial link node.
As a specific embodiment, step S510 may further include: taking the link bifurcation node as a current link node; determining a current latest direct upstream node from a current direct upstream node set of current link nodes as a next link node to obtain a current latest link; and if the last link node of the current latest link is not the most upstream node, taking the last link node as the current link node, and returning to execute the step of determining the current latest direct upstream node from the current direct upstream node set of the current link node as the next link node to obtain the current latest link until the last link node is the most upstream node to obtain the latest link.
In this embodiment, when determining the latest link, the link forking node is used as an initial link node, and the latest direct upstream node of the current link node is used as a next link node in turn until the latest direct upstream node is the most upstream node of the abnormal service, so as to obtain the latest link corresponding to the link forking node.
As shown in fig. 4, in an exemplary abnormal link acquiring process, the number of abnormal links is set to 3, and node a is a target operation node of abnormal traffic.
Starting from the node a, taking the directly upstream node set Aup of the node a as a node set to be analyzed, setting the node set to be analyzed as aup= { B, C, D }, setting the current latest node of the directly upstream node set Aup as Aup-last, and knowing the completion time of the nodes B, C and D, wherein the node D completes latest, namely Aup-last= { D }. And taking the node D as a known link node, and simultaneously recording that the current initial abnormal link is 'A- > D'.
And taking the rest nodes except the current latest node in the direct upstream node set Aup of the node A as the rest upstream node set Aup-Aup-last, updating the node set to be analyzed by combining the direct upstream node set Dup of the node D to obtain the node set to be analyzed as (Aup-Aup-last) U Dup= { B, C, G, H }, and finding the latest finished current latest node H from the node set to be analyzed. For the current latest node H, the current initial abnormal link is recorded as 'A- > D- > H'.
At this time, the unselected remaining upstream node set of the node a is Aup-last= { B, C }, the unselected remaining upstream node set of the node D is Dup-last= { G }, the unselected remaining upstream node set of the node a and the unselected remaining upstream node set of the node D include the remaining nodes except the current latest node in the node set to be analyzed, the direct upstream node set of the node H is hup= { K, J }, so that the node to be analyzed is updated to be combined into (Aup-last) } (Dup-last) = { K, J, G, B, C }, and so on, the current latest node B is determined, and the current initial abnormal links are recorded to have "a- > D- > H" and "a- > B", thereby obtaining the first link bifurcation node H and the second link bifurcation node B.
And selecting a node F from (Aup-Aup-last) U-U (Dup-Dup-last) U-Bup= { G, H, K, J, E, F, C } and recording that the current initial abnormal link has 'A- > D- > H' and 'A- > B- > F'. And selecting a node G from (Aup-Aup-last) U.U.U.U (Dup-Dup-last) U.U.U.U.U.S.Fup= { G, H, K, J, E, C } to obtain a third link bifurcation node G, wherein 3 final initial abnormal links are obtained at the moment, namely 'A- > D- > H', 'A- > B- > F' and 'A-B- > G', respectively.
Thus, a target link node set including three link bifurcation nodes is obtained, and starting from the link bifurcation nodes H, F and G, three latest links of the three link bifurcation nodes are obtained in a manner of solving 1 latest link upstream, which are respectively "H- > J", "F- > L" and "G". And then connected with the initial abnormal links known at the downstream of the link bifurcation node H, F and G to obtain the final 3 abnormal links which are A- > D- > H- > J "," A- > B- > F- > L "and A-B- > G.
As a specific embodiment, step S520 may include: determining at least one abnormal node from all the link nodes according to the current waiting time and the historical average waiting time of each link node on the abnormal link, and the current execution time and the historical average execution time of the abnormal link node; and obtaining an anomaly analysis result according to at least one anomaly node.
In this embodiment, the current waiting time and the current executing time of each link node on the abnormal link may be compared with the historical average waiting time and the historical average executing time of the link nodes, to determine whether the link node is an abnormal node, so as to determine at least one abnormal node in all the link nodes, and obtain an abnormal analysis result.
The embodiment provides a business anomaly analysis method, aiming at anomaly business, determining a preset number of abnormal operation links to conduct anomaly business analysis, and compared with business anomaly analysis based on a single latest operation link, the preset number of abnormal operation links can better cover the condition that a plurality of operations are abnormal in execution, so that the accuracy of business anomaly analysis is improved.
Based on the same inventive concept, referring to fig. 5, fig. 5 is a schematic block diagram of a first embodiment of a business anomaly analysis device according to the present application. The embodiment provides a business anomaly analysis device, which may include:
the first aggregation module 10 is configured to obtain a node aggregation to be analyzed according to all first direct upstream nodes connected to a target operation node of an abnormal service in the operation directed graph;
the second aggregation module 20 is configured to determine, from the node aggregation to be analyzed, a current latest node, and add the current latest node to the known link node aggregation as a known link node;
a first updating module 30, configured to update the node set to be analyzed according to all the second directly upstream nodes connected to the current latest node and other nodes except the current latest node in the node set to be analyzed;
the second updating module 40 is configured to perform the step of determining, from the node set to be analyzed, the current latest node as the known link node and adding the current latest node to the known link node set until the current latest node is the most upstream node corresponding to the abnormal service, and obtain the target link node set;
the anomaly analysis module 50 is configured to perform anomaly analysis on all known link nodes in the target link node set, so as to obtain an anomaly analysis result of the anomaly service.
For more details in the specific implementation of the business anomaly analysis device, reference may be made to the description of the specific implementation of the business anomaly analysis method in the first or second embodiment, and for brevity of description, the description will not be repeated here.
In addition, the embodiment of the application also provides a computer storage medium, and a computer program is stored on the storage medium, and when the computer program is executed by a processor, the steps of the business anomaly analysis method are realized. Therefore, a detailed description will not be given here. In addition, the description of the beneficial effects of the same method is omitted. For technical details not disclosed in the embodiments of the computer-readable storage medium according to the present application, please refer to the description of the method embodiments of the present application. As an example, the program instructions may be deployed to be executed on one computing device or on multiple computing devices at one site or distributed across multiple sites and interconnected by a communication network.
The foregoing description is only of the preferred embodiments of the present application, and is not intended to limit the scope of the application, but rather is intended to cover any equivalents of the structures or equivalent processes disclosed herein or in the alternative, which may be employed directly or indirectly in other related arts.
Claims (10)
1. A business anomaly analysis method, the method comprising:
obtaining a node set to be analyzed according to all first direct upstream nodes connected with a target operation node of abnormal operation in the operation directed graph;
determining the current latest node from the node set to be analyzed, and adding the current latest node as a known link node to the known link node set;
updating the node set to be analyzed according to all second direct upstream nodes connected with the current latest node and other nodes except the current latest node in the node set to be analyzed;
the step of determining the current latest node from the node set to be analyzed and adding the current latest node to the known link node set as the known link node is carried out until the current latest node is the most upstream node corresponding to the abnormal service, so as to obtain a target link node set;
and carrying out anomaly analysis on all the known link nodes in the target link node set to obtain an anomaly analysis result of the anomaly service.
2. The method of claim 1, wherein the step of returning to perform the step of determining the current latest node from the node set to be analyzed as the known link node added to the known link node set until the current latest node is the most upstream node corresponding to the abnormal traffic, and obtaining the target link node set includes:
the step of determining the current latest node from the node set to be analyzed and adding the current latest node to the known link node set as the known link node until the known link node set comprises a preset number of link bifurcation nodes to obtain the target link node set;
performing anomaly analysis on all the known link nodes in the target link node set to obtain an anomaly analysis result of the anomaly service, including:
determining the preset number of abnormal links from the operation directed graph according to the target link node set;
and obtaining an abnormal analysis result of the abnormal service according to at least one abnormal node on all the abnormal links.
3. The method of claim 2, wherein said determining the predetermined number of abnormal links from the job directed graph based on the set of known link nodes comprises:
determining the preset number of initial abnormal links from the operation directed graph according to the link bifurcation node and other known link nodes which are on the same link with the link bifurcation node in the target link node set;
and obtaining the abnormal link according to the initial abnormal link and the latest link corresponding to the link bifurcation node.
4. The method of claim 3, wherein before the obtaining the abnormal link according to the initial abnormal link and the latest link corresponding to the link forking node, the method further comprises:
taking the link bifurcation node as a current link node;
determining a current latest direct upstream node from the current direct upstream node set of the current link node as a next link node to obtain a current latest link;
and if the last link node of the current latest link is not the most upstream node, returning the last link node as the current link node, and executing the step of determining the current latest direct upstream node from the current direct upstream node set of the current link node as the next link node to obtain the current latest link until the last link node is the most upstream node to obtain the latest link.
5. The method of claim 2, wherein the obtaining the exception analysis result of the exception service according to at least one exception node on all the exception links comprises:
determining at least one abnormal node from all the link nodes according to the current waiting time and the historical average waiting time of each link node on the abnormal link and the current execution time and the historical average execution time of the link node;
and obtaining the abnormal analysis result according to at least one abnormal node.
6. The method of claim 2, wherein the returning performs the step of determining a current latest node from the set of nodes to be analyzed as a known link node added to a set of known link nodes until the set of known link nodes includes a preset number of link forking nodes, the method further comprising, before obtaining the set of target link nodes:
and obtaining the preset number corresponding to the abnormal links according to the delay time threshold of the abnormal service.
7. A method according to any one of claims 1 to 6, wherein the target job node is the last job node of the exception traffic.
8. A business anomaly analysis device, the device comprising:
the first aggregation module is used for obtaining a node aggregation to be analyzed according to all first direct upstream nodes connected with a target operation node of abnormal business in the operation directed graph;
the second set module is used for determining the current latest node from the node set to be analyzed, and adding the current latest node to the known link node set as the known link node;
the first updating module is used for updating the node set to be analyzed according to all second direct upstream nodes connected with the current latest node and other nodes except the current latest node in the node set to be analyzed;
the second updating module is used for returning to execute the step of determining the current latest node from the node set to be analyzed and adding the current latest node to the known link node set as the known link node until the current latest node is the most upstream node corresponding to the abnormal service, so as to obtain a plurality of target link node sets;
and the anomaly analysis module is used for carrying out anomaly analysis on all the known link nodes in the target link node set to obtain an anomaly analysis result of the anomaly service.
9. A traffic anomaly analysis device, the device comprising: memory, processor and business anomaly analysis program stored on the memory and executable on the processor, by which the business anomaly analysis program is configured to implement the steps of the business anomaly analysis method of any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that the storage medium has stored thereon a computer program which, when executed by a processor, implements the steps of the business anomaly analysis method according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311090719.4A CN117132372A (en) | 2023-08-25 | 2023-08-25 | Business anomaly analysis method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311090719.4A CN117132372A (en) | 2023-08-25 | 2023-08-25 | Business anomaly analysis method, device, equipment and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117132372A true CN117132372A (en) | 2023-11-28 |
Family
ID=88850425
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311090719.4A Pending CN117132372A (en) | 2023-08-25 | 2023-08-25 | Business anomaly analysis method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117132372A (en) |
-
2023
- 2023-08-25 CN CN202311090719.4A patent/CN117132372A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110737658A (en) | Data fragment storage method, device, terminal and readable storage medium | |
| CN105302710A (en) | Method and apparatus for determining test case in need of regression testing | |
| US11645562B2 (en) | Search point determining method and search point determining apparatus | |
| CN110321284B (en) | Test data entry method, device, computer equipment and storage medium | |
| CN108388509B (en) | Software testing method, computer readable storage medium and terminal equipment | |
| CN111026647B (en) | Method and device for acquiring code coverage rate, computer equipment and storage medium | |
| CN111190551B (en) | Redis data migration system, migration method, migration device and terminal | |
| CN111107042B (en) | Message parsing method and device, computer equipment and storage medium | |
| US20200019299A1 (en) | Iterative Detection of Forms-Usage Patterns | |
| CN111881477A (en) | Indexing method and device of data content, computer equipment and storage medium | |
| US20070233532A1 (en) | Business process analysis apparatus | |
| CN108399125B (en) | Automatic testing method and device, computer equipment and storage medium | |
| US20220039001A1 (en) | Network search method and apparatus, device and storage medium | |
| CN111045848A (en) | Log analysis method, terminal device and computer-readable storage medium | |
| CN107463486B (en) | System performance analysis method and device and server | |
| CN111221742B (en) | Test case updating method and device, storage medium and server | |
| CN117132372A (en) | Business anomaly analysis method, device, equipment and storage medium | |
| CN112416648A (en) | Data verification method and device | |
| CN113158177A (en) | Dynamic measurement method, device, equipment and storage medium | |
| WO2018225314A1 (en) | Database management system and database management method | |
| CN111061875B (en) | Super parameter determination method, device, computer equipment and storage medium | |
| CN114780589A (en) | Multi-table connection query method, device, equipment and storage medium | |
| CN111177147B (en) | Metadata batch warehousing method, readable storage medium and computing device | |
| CN113704114A (en) | Automatic testing method, device, equipment and medium for functional interface | |
| CN113495841A (en) | Compatibility detection method, device, equipment, storage medium and program product |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |