CN117213508A - Method, device, storage medium and program product for business processing - Google Patents
Method, device, storage medium and program product for business processing Download PDFInfo
- Publication number
- CN117213508A CN117213508A CN202310129467.5A CN202310129467A CN117213508A CN 117213508 A CN117213508 A CN 117213508A CN 202310129467 A CN202310129467 A CN 202310129467A CN 117213508 A CN117213508 A CN 117213508A
- Authority
- CN
- China
- Prior art keywords
- risk
- service data
- service
- prediction model
- training
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000012545 processing Methods 0.000 title claims abstract description 161
- 238000000034 method Methods 0.000 title claims abstract description 99
- 238000001514 detection method Methods 0.000 claims abstract description 261
- 238000013058 risk prediction model Methods 0.000 claims abstract description 168
- 238000012549 training Methods 0.000 claims description 283
- 238000005070 sampling Methods 0.000 claims description 24
- 238000010801 machine learning Methods 0.000 claims description 21
- 230000001932 seasonal effect Effects 0.000 claims description 17
- 238000002372 labelling Methods 0.000 claims description 16
- 238000004590 computer program Methods 0.000 claims description 11
- 238000000605 extraction Methods 0.000 claims description 10
- 238000013507 mapping Methods 0.000 claims description 10
- 238000012952 Resampling Methods 0.000 claims description 9
- 238000004364 calculation method Methods 0.000 claims description 8
- 238000004458 analytical method Methods 0.000 claims description 6
- 238000000354 decomposition reaction Methods 0.000 claims description 5
- 238000005516 engineering process Methods 0.000 abstract description 16
- 238000013473 artificial intelligence Methods 0.000 abstract description 12
- 230000008569 process Effects 0.000 description 33
- 230000006870 function Effects 0.000 description 24
- 238000004891 communication Methods 0.000 description 18
- 238000004422 calculation algorithm Methods 0.000 description 10
- 238000010586 diagram Methods 0.000 description 10
- 238000013528 artificial neural network Methods 0.000 description 9
- 238000012423 maintenance Methods 0.000 description 6
- 238000003672 processing method Methods 0.000 description 5
- 230000003068 static effect Effects 0.000 description 5
- 239000013598 vector Substances 0.000 description 5
- 230000002159 abnormal effect Effects 0.000 description 4
- 230000003044 adaptive effect Effects 0.000 description 4
- 238000013135 deep learning Methods 0.000 description 4
- 238000010606 normalization Methods 0.000 description 4
- 238000013459 approach Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 125000004122 cyclic group Chemical group 0.000 description 3
- 238000010295 mobile communication Methods 0.000 description 3
- 230000008901 benefit Effects 0.000 description 2
- 238000013461 design Methods 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000003064 k means clustering Methods 0.000 description 2
- 230000007774 longterm Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000000737 periodic effect Effects 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 230000004913 activation Effects 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000033228 biological regulation Effects 0.000 description 1
- 238000004140 cleaning Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 230000006698 induction Effects 0.000 description 1
- 230000010354 integration Effects 0.000 description 1
- 238000011835 investigation Methods 0.000 description 1
- 239000011159 matrix material Substances 0.000 description 1
- 238000013508 migration Methods 0.000 description 1
- 230000005012 migration Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000003058 natural language processing Methods 0.000 description 1
- 230000037361 pathway Effects 0.000 description 1
- 230000000306 recurrent effect Effects 0.000 description 1
- 230000002787 reinforcement Effects 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 238000012502 risk assessment Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 238000013526 transfer learning Methods 0.000 description 1
Landscapes
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment of the application discloses a method, a device, a storage medium and a program product for processing business, at least relates to artificial intelligence and other technologies, and can rapidly carry out risk prompt processing, thereby improving the accuracy and timeliness of risk alarming. The method comprises the following steps: acquiring first service data, wherein the first service data is real-time service data of the first service in the t acquisition period, and t is more than or equal to 1; determining a target detection feature of the first traffic data based on the timing feature of the first traffic data; detecting target detection characteristics of the first business data based on the first risk prediction model to obtain a first risk detection result, wherein the first risk detection result is used for indicating a risk alarm category when at least one business risk occurs in the first business data; and carrying out risk prompt processing on the first business data based on the first risk detection result.
Description
Technical Field
The embodiment of the application relates to the technical field of computers, in particular to a business processing method, a business processing device, a storage medium and a program product.
Background
The method has the advantages that the service data is detected, the abnormal service data is alarmed, the abnormal service data is found in time, and alarming and positioning are implemented, so that a developer can be assisted to quickly solve on-line faults.
In the related scheme, the mode of detecting the service data is usually a dynamic and static threshold alarming scheme. For example, threshold warning is performed by manually configuring upper and lower limits of the detection index; or according to the historical curve trend of the detection index, the characteristics of future trend, period, fluctuation and the like of the curve are determined in a self-adaptive mode, so that the upper limit threshold of the detection index is calculated dynamically. However, by adopting a dynamic and static threshold value alarming mode, a reasonable alarm threshold value can be set by excessively depending on maintenance experience of fortune dimension developers, so that once the alarm threshold value is set incorrectly, service data with risk cannot be timely detected, and risk warning cannot be carried out.
Disclosure of Invention
The embodiment of the application provides a method, a device, a storage medium and a program product for processing business, which can timely detect that first business data has business risks needing to be subjected to risk prompt in an alarming mode, can rapidly carry out risk prompt processing, and improves the accuracy and timeliness of risk alarming.
In a first aspect, an embodiment of the present application provides a method for service processing. The method comprises the following steps: acquiring first service data, wherein the first service data is real-time service data of the first service in the t acquisition period, and t is more than or equal to 1; determining a target detection feature of the first traffic data based on the timing feature of the first traffic data; detecting target detection characteristics of first service data based on a first risk prediction model to obtain a first risk detection result, wherein the first risk detection result is used for indicating a risk alarm type when at least one service risk occurs in the first service data, the first risk prediction model takes the risk alarm type for predicting the first service data as a training target, the detection characteristics of a first training sample marked with a risk alarm type marking label are taken as a machine learning model obtained by carrying out iterative training on a preset initial model by taking the detection characteristics of the first training sample as training data, and the first training sample is historical service data when the first service runs in the previous t-1 acquisition time period; and carrying out risk prompt processing on the first business data based on the first risk detection result.
In a second aspect, an embodiment of the present application provides a service processing apparatus. The service processing device comprises an acquisition unit and a processing unit. The acquisition unit is used for acquiring first service data, wherein the first service data is real-time service data when the first service runs in a t acquisition period, and t is more than or equal to 1. And the processing unit is used for determining the target detection characteristic of the first service data based on the time sequence characteristic of the first service data. The processing unit is used for detecting and processing target detection characteristics of the first service data based on a first risk prediction model to obtain a first risk detection result, wherein the first risk detection result is used for indicating a risk alarm type when at least one service risk occurs in the first service data, the first risk prediction model is a machine learning model obtained by iteratively training a preset initial model by taking the risk alarm type for predicting the first service data as a training target and taking the detection characteristics of a first training sample marked with a risk alarm type marking label as training data, and the first training sample is historical service data when the first service runs in the previous t-1 acquisition period. And the processing unit is used for carrying out risk prompt processing on the first business data based on the first risk detection result.
In some alternative examples, the processing unit is to: determining at least one detection index of the first service data based on the time sequence characteristics of the first service data, wherein the detection dimension of each detection index is different; performing feature extraction processing on the first service data under each detection index based on at least two time dimensions to obtain at least two first features of the corresponding detection index, wherein the time dimensions of each first feature in the detection index are different; weighting the corresponding first features based on the weight of each time dimension, and summing the weighted first features to obtain second features of the corresponding detection indexes; and performing linear mapping processing on the second characteristic of each detection index to obtain the target detection characteristic of the first service data.
In other alternative examples, the processing unit is configured to: performing time sequence decomposition processing on the first business data based on the time sequence characteristics of the first business data to obtain trend circulation characteristics, seasonal characteristics and random characteristics corresponding to the first business data, wherein the trend circulation characteristics are used for indicating the condition that the first business data presents periodicity, the seasonal characteristics are used for indicating the condition that the first business data presents the seasonality, and the random characteristics are used for indicating other conditions of the first business data except the periodicity and the seasonality; and performing index analysis processing on the first service data based on the trend circulation characteristics, the seasonal characteristics and the random characteristics to obtain at least one detection index of the first service data.
In other alternative examples, the processing unit is configured to: taking the target detection characteristics of the first service data as the input of a first risk prediction model to obtain the prediction probability of each service risk of the first service data; and determining a first risk detection result based on the prediction probability of each business risk of the first business data.
In other alternative examples, the processing unit is configured to: clustering each risk alarm category in a preset time length based on category information of each risk alarm category and target detection characteristics of the first service data to obtain an alarm level of each risk alarm category, wherein the preset time length is any time length in a t-th acquisition period; determining a target alarm strategy based on the alarm level of each risk alarm category; and carrying out risk prompt processing on the first service data based on the target alarm strategy.
In other alternative examples, the acquisition unit is further configured to: before detecting the target detection feature of the first service data based on the first risk prediction model to obtain a first risk detection result, acquiring historical service data during operation in the previous t-1 acquisition time periods to obtain a first training sample. The processing unit is used for: determining detection features of the first training sample based on the timing features of the first training sample; detecting the detection characteristics of the first training sample based on a preset initial model to obtain a second risk detection result, wherein the second risk detection result is used for indicating a risk alarm type prediction label when each business risk occurs in the first training sample; calculating the difference between the risk alarm category prediction label and the risk alarm category labeling label of the first training sample to obtain a target loss value; and updating model parameters of a preset initial model based on the target loss value to obtain a first risk prediction model.
In other alternative examples, the processing unit is configured to: sampling historical service data in the previous t-1 acquisition time periods to obtain a first positive sample and a first negative sample, wherein the first positive sample is represented as historical service data without labeling a risk alarm category labeling label in the previous t-1 acquisition time periods, and the first negative sample is represented as historical service data with labeling a risk alarm category labeling label in the previous t-1 acquisition time periods; resampling historical service data in an alarm period to obtain a second positive sample and a second negative sample, wherein the alarm period is an acquisition period when risk prompt is needed when service risk occurs to the historical service data in the previous t-1 acquisition periods; a first training sample is determined based on the first positive sample, the second positive sample, the first negative sample, and the second negative sample.
In other alternative examples, the processing unit is further configured to: after detecting target detection characteristics of first service data based on a first risk prediction model to obtain a first risk detection result, determining the first service data as a second training sample when the accuracy of the first risk detection result is smaller than a preset threshold value; acquiring sample weights of the first training samples and sample weights of the second training samples; weighting the first training sample based on the sample weight of the first training sample to obtain a third training sample, and weighting the second training sample based on the sample weight of the second training sample to obtain a fourth training sample; and carrying out iterative training on the first risk prediction model based on the third training sample and the fourth training sample to obtain an adjusted first risk prediction model, wherein the adjusted first risk prediction model is used for predicting a risk detection result of the business data in the t+1 acquisition period, and the risk detection result of the business data in the t+1 acquisition period is used for indicating a risk alarm category when each business risk occurs to the business data in the t+1 acquisition period.
In other alternative examples, the processing unit is configured to: calculating a sample weight of the first training sample based on the first time difference and a sample number of the first training sample, wherein the first sampling time difference is used for indicating a time span between a sampling time of the first training sample and a current running time of the first service; determining a sample weight of the second training sample based on a second time difference and a sample number of the second training sample, wherein the second sampling time difference is used to indicate a time span between a sampling time of the second training sample and a current run time;
in other alternative examples, the acquisition unit is further configured to: and updating model parameters of a preset initial model based on the target loss value, acquiring second service data after the first risk prediction model is obtained, wherein the second service data is real-time service data when the second service is operated, and the first service is different from the second service. The processing unit is used for: updating model parameters of the first risk prediction model based on the first training sample and the second service data to obtain a second risk prediction model, wherein the second risk prediction model is used for predicting a risk detection result of the second service data, and the risk detection result of the second service data is used for indicating a risk alarm category when each service risk occurs in the second service data.
In other alternative examples, the processing unit is configured to: determining a first training sample and second service data as target training data; conducting derivative calculation on model parameters of a first risk prediction model based on a preset back propagation model and target training data to obtain a first gradient of the first risk prediction model; summing the model parameters of the first risk prediction model and the first gradient to obtain first parameters of the first risk prediction model; conducting derivative calculation on first parameters of the first risk prediction model based on a preset back propagation model and target training data to obtain a second gradient of the first risk prediction model; summing the model parameters of the first risk prediction model and the second gradient to determine the second parameters of the first risk prediction model; and training to obtain a second risk prediction model based on the second parameters of the first risk prediction model.
A third aspect of an embodiment of the present application provides a service processing apparatus, including: memory, input/output (I/O) interfaces, and memory. The memory is used for storing program instructions. The processor is configured to execute the program instructions in the memory to perform the method for service processing corresponding to the implementation manner of the first aspect.
A fourth aspect of the embodiments of the present application provides a computer-readable storage medium having instructions stored therein, which when run on a computer, cause the computer to perform to execute the method corresponding to the embodiment of the first aspect described above.
A fifth aspect of the embodiments of the present application provides a computer program product comprising instructions which, when run on a computer or processor, cause the computer or processor to perform the method described above to perform the embodiment of the first aspect described above.
From the above technical solutions, the embodiment of the present application has the following advantages:
in the embodiment of the application, the first risk prediction model is a machine learning model obtained by iteratively training a preset initial model by taking a risk alarm type for predicting the first service data as a training target and taking the detection characteristic of a first training sample marked with a risk alarm type marking label as training data. The first training sample mentioned is understood to be historical traffic data of the first traffic as it runs during the first t-1 acquisition period. Moreover, since the first service data is real-time service data when the first service runs in the t-th acquisition period, and has time sequence, after the first service data is acquired, the target detection characteristic of the first service data can be determined based on the time sequence characteristic of the first service data. In this way, after the first risk prediction model is obtained through training, the target detection feature of the first service data can be used as input of the first risk prediction model, so that the target detection feature of the first service data can be detected and processed through the first risk prediction model, and the first risk detection result is obtained. And indicating the risk alarm category when at least one business risk occurs in the first business data according to the first risk detection result. And then, carrying out risk prompt processing on the first business data based on the first risk detection result. By means of the method, the risk warning type when the first service data is at risk is determined without setting the warning threshold based on a dynamic-static mode, corresponding target detection characteristics are determined by considering time sequence characteristics of the first service data, the risk warning type when the first service data is at least at one service risk is directly predicted by means of the first risk prediction model obtained through training, and the service risks which are needed to be subjected to risk prompt in the warning mode and are generated in the first service data can be timely detected, so that risk prompt processing can be rapidly performed, and accuracy and timeliness of risk warning are improved.
Drawings
In order to more clearly illustrate the embodiments of the application or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, it being obvious that the drawings in the following description are only some embodiments of the application, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
FIG. 1 illustrates a schematic diagram of an implementation environment provided by an embodiment of the present application;
FIG. 2 is a flow chart of a method for service processing according to an embodiment of the present application;
FIG. 3 is a schematic diagram of a process for determining target detection characteristics according to an embodiment of the present application;
FIG. 4 is a schematic flow chart of a risk alert provided in an embodiment of the present application;
FIG. 5A is a schematic flow chart of model training provided by an embodiment of the application;
FIG. 5B is a schematic diagram of a model training architecture provided by an embodiment of the present application;
FIG. 6 is a schematic diagram of a first flow of model update provided by an embodiment of the present application;
FIG. 7 is a schematic diagram of a second flow chart of model update provided by an embodiment of the present application;
Fig. 8 is a schematic structural diagram of a service processing device according to an embodiment of the present application;
fig. 9 shows a schematic hardware structure of a service processing device according to an embodiment of the present application.
Detailed Description
The embodiment of the application provides a method, a device, a storage medium and a program product for processing business, which can timely detect that first business data has business risks needing to be subjected to risk prompt in an alarming mode, can rapidly carry out risk prompt processing, and improves the accuracy and timeliness of risk alarming.
It will be appreciated that in the specific embodiments of the present application, related data such as user information, personal data of a user, etc. are involved, and when the above embodiments of the present application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data is required to comply with relevant laws and regulations and standards of relevant countries and regions.
The following description of the embodiments of the present application will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present application, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.
The terms "first," "second," "third," "fourth" and the like in the description and in the claims and in the above drawings, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments described herein may be implemented in other sequences than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
The business processing method provided by the embodiment of the application is realized based on artificial intelligence (artificial intelligence, AI). Artificial intelligence is the theory, method, technique and application system that uses a digital computer or a digital computer-controlled machine to simulate, extend and expand human intelligence, sense the environment, acquire knowledge and use the knowledge to obtain optimal results. In other words, artificial intelligence is an integrated technology of computer science that attempts to understand the essence of intelligence and to produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence, i.e. research on design principles and implementation methods of various intelligent machines, enables the machines to have functions of sensing, reasoning and decision.
The artificial intelligence technology is a comprehensive subject, and relates to the technology with wide fields, namely the technology with a hardware level and the technology with a software level. Artificial intelligence infrastructure technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and other directions.
In the embodiments of the present application, the artificial intelligence techniques mainly include the above-mentioned directions of machine learning and the like. For example, deep learning (deep learning) in Machine Learning (ML) may be involved, including artificial neural networks, and the like.
The method for processing the service provided by the embodiment of the application can be applied to a service processing device with data processing capability, such as a server, terminal equipment and the like. The server may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server or the like for providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (content delivery network, CDN), basic cloud computing services such as big data and artificial intelligent platforms, and the application is not limited in particular. The mentioned terminal devices may include, but are not limited to, smart phones, tablet computers, notebook computers, desktop computers, smart speakers, smart watches, smart voice interaction devices, smart home appliances, vehicle terminals, aircraft, medical devices, multimedia playback devices, etc.
In addition, the terminal device and the server may be directly connected or indirectly connected by wired communication or wireless communication, and the present application is not particularly limited. For example, the terminal device and the server may communicate with each other via a variety of communication means, including, but not limited to, third generation partnership project (3rd generation partnership project,3GPP), fifth generation mobile communication technology (5th generation mobile communication technology,5G), long term evolution (long term evolution, LTE), worldwide interoperability for microwave access (worldwide interoperability for microwave access, wiMAX) mobile communication, or computer network communication based on the TCP/IP protocol family (TCP/IP protocol suite, TCP/IP), user datagram protocol (user datagram protocol, UDP), and other communication technologies occurring in the future.
The above-mentioned service processing apparatus may be provided with machine learning capabilities. Machine Learning (ML) is a multi-domain interdisciplinary, involving multiple disciplines such as probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory, etc. It is specially studied how a computer simulates or implements learning behavior of a human to acquire new knowledge or skills, and reorganizes existing knowledge structures to continuously improve own performance. Machine learning is the core of artificial intelligence, a fundamental approach to letting computers have intelligence, which is applied throughout various areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, confidence networks, reinforcement learning, transfer learning, induction learning, teaching learning, and the like.
In the related scheme, risk warning is carried out on abnormal business data by adopting a dynamic and static threshold warning mode, and a reasonable warning threshold value is required to be set by excessively relying on maintenance experience of fortune dimension developers, so that once the warning threshold value is set incorrectly, the business data with risk cannot be timely detected, and risk prompt cannot be carried out on the business data.
Based on the above, the embodiment of the application provides a business processing method. The service processing method can be applied to service scenes such as system detection, network detection and the like. The method for processing the business provided by the application can be applied to a function, namely a service (functions as a service, faas) detection system for realizing risk detection and the like on the online business of the virtual game. In practical application, the method for processing the service provided by the embodiment of the application can also be applied to other application scenes, and the embodiment of the application does not limit the specific application scenes.
The method for processing the business provided by the embodiment of the application can adopt an artificial intelligent model, mainly relates to technical application of neural network, machine learning and the like, and predicts the first risk detection result through the neural network. The risk alarm category when at least one business risk occurs in the first business data can be indicated through the first risk detection result.
FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application.
As shown in FIG. 1, a model training device and a model using device may be included in the implementation environment. The described model training apparatus and model using apparatus may be directly connected or indirectly connected by wired communication or wireless communication, etc., and the present application is not particularly limited. In addition, the model training device may be a computer device such as the above-mentioned terminal device, server, or the like, for performing model training on the first risk prediction model or the like. The described first risk prediction model may be understood as a model for enabling prediction of a risk alert class of the first traffic data. In the embodiment of the present application, the first risk prediction model is a machine learning model obtained by iteratively training a preset initial model by using the detection feature of the first training sample labeled with the risk alarm category label as training data and the risk alarm category predicted as training target, and the specific model training process can be understood with reference to the content shown in the subsequent fig. 5A, which is not described herein. The model training device can train the first risk prediction model in a machine learning mode, so that the model training device has good risk alarm type automatic prediction performance.
For example, the model training apparatus mentioned above in fig. 1 may include a feature extraction module, an offline training module. The model training device can obtain detection features of the first training sample after feature extraction of time sequence features of the first training sample through the feature extraction module. The first training sample is historical service data of the first service running in the previous t-1 acquisition time periods, and t is more than or equal to 1. Then, the model training device uses the detected characteristics of the first training sample as training data, and performs iterative training processing on the detected characteristics of the first training sample through the offline training module so as to train and obtain the first risk prediction model.
The model training device may also store the trained first risk prediction model in a storage system such as a distributed file system (hadoop distributed file system, HDFS) so as to provide the model using device with service data detection processing. In some examples, the model training device may further include a new business cold start module in order to use the trained first risk prediction model to detect business data of a second business deployed in other entirely new business scenarios as well. The model training equipment acquires real-time service data of a second service in operation as second service data through a new service cold start module, takes the second service data as newly added training data, and further trains to obtain a second risk prediction model by continuously adjusting model parameters of the first risk prediction model, so that risk detection processing of the second service data is realized through the second risk prediction model. It should be noted that the first service and the second service are different services. The training process of the second risk prediction model may be specifically understood with reference to the following content shown in fig. 7, which will not be described herein.
In addition, the first risk prediction model obtained after training can be deployed in model using equipment. The model using device may be a computer device such as the above-mentioned terminal device, server, or the like, and the embodiment of the present application is not particularly limited. When it is required to detect whether the first business data has business risk and what kind of business risk has occurred, the model using device can process the target detection feature of the first business data through the above mentioned first risk prediction model, so as to predict and obtain a first risk detection result corresponding to the first business data. Furthermore, the model using device can also perform risk prompt processing on the first business data based on the first risk detection result. It should be noted that the first service data mentioned is real-time service data when the first service runs in the t-th acquisition period.
For example, the model-using device mentioned above in fig. 1 may include a real-time prediction and continuous learning module and a risk alert module. After the model using device obtains the first service data, the model using device can read the first risk prediction model from the storage system such as the HDFS based on the real-time prediction and continuous learning module, and can realize detection processing of the first service data based on the real-time prediction and continuous learning module, so that a first risk detection result is obtained through prediction. And then, the model using equipment also carries out risk prompt processing on the first business data based on the first risk detection result through the risk alarm module so as to prompt corresponding development and operation staff to carry out risk processing. In other examples, in order to prevent the detection feature of the service data before the first risk prediction model forgets during continuous learning, the model using device may further use the service data when the accuracy of the risk detection result obtained by the real-time prediction and continuous learning module is less than the preset threshold value as the newly added training data, and further feed back the newly added training data to the model training device. Thus, the model training device can update the first risk prediction model in time, and accuracy of risk detection is improved.
In order to facilitate understanding of the technical solution of the present application, in the embodiment of the present application, the method for executing the service processing provided in the embodiment of the present application with the terminal device as the execution body may be other devices in the actual application, which is not limited herein. The following describes a method for processing a service according to an embodiment of the present application with reference to the accompanying drawings.
Fig. 2 shows a flowchart of a method for service processing according to an embodiment of the present application. As shown in fig. 2, the method for processing the service may include the following steps:
201. and acquiring first service data, wherein the first service data is real-time service data of the first service in the t acquisition period, and t is more than or equal to 1.
In this example, the first service may include, but is not limited to, a virtual game service in a game farm, and the embodiment of the present application is not limited to. In addition, the first service data mentioned can be understood as service data generated during the t-th acquisition period of the first service during operation. The service data may include, but is not limited to, service traffic, etc., and the embodiments of the present application are not limited to.
202. A target detection characteristic of the first traffic data is determined based on the timing characteristic of the first traffic data.
In this example, since the first service data has time sequence, after the first service data is acquired, the corresponding target detection feature is determined in consideration of the time sequence feature according to the first service data. The described chronology is understood to mean that the traffic data is generated in the run-time order of the traffic. The timing characteristics mentioned may include, but are not limited to, year, quarter, season, month, day, time, etc., and are not limited in particular embodiments of the present application.
Illustratively, the above-mentioned determination of the target detection characteristic of the first traffic data based on the timing characteristic of the first traffic data may be understood with reference to the process flow provided in fig. 3 described below. As shown in fig. 3, the process flow for determining the target detection feature at least includes the following steps:
s301, determining at least one detection index of the first service data based on the time sequence characteristics of the first service data, wherein the detection dimension of each detection index is different.
In this example, since the first service data has the time sequence characteristic, after the first service data is acquired, the time sequence decomposition processing may be performed on the first service data based on the time sequence characteristic of the first service data, so as to obtain the trend circulation characteristic, the season characteristic and the random characteristic corresponding to the first service data. And then, performing index analysis processing on the first service data based on the trend circulation characteristics, the seasonal characteristics and the random characteristics, so as to select at least one detection index for obtaining the first service data. By way of example, it is determined whether one or more of the waveform variation and the variance variation of the first service data under each initial index satisfies a preset condition of the corresponding initial index by the trend circulation characteristic, the seasonal characteristic, and the random characteristic. When one or more of the waveform change and the variance change are judged to meet the preset conditions of the corresponding initial indexes, the initial indexes corresponding to the preset conditions are selected as detection indexes.
It should be noted that the trend cyclic characteristic corresponding to the first service data mentioned can indicate the condition that the first service data presents periodicity. For example, the periodicity of the first service data may be understood as the first service data exhibits a certain periodic trend with time. The period may include, but is not limited to, 1 hour, 1 day, one week, 1 month, etc., and is not particularly limited in embodiments of the present application. By way of example, in some scenarios, the trend cyclic feature may also be understood as a periodic feature, and the names of the trend cyclic feature are not limited in the embodiments of the present application.
In addition, the mentioned seasonal characteristic corresponding to the first business data can indicate that the first business data presents a seasonal situation. Seasonal it is understood that the current business data shows a seasonal trend with time, such as spring, summer, autumn and winter, and the present application is not limited thereto. In addition, the random feature corresponding to the first service data described can indicate that the first service data presents other conditions besides periodicity and seasonality.
Furthermore, the mentioned detection indexes can be classified into performance detection indexes and custom detection indexes according to versatility. The performance detection index may be understood as an index common to all services, such as, but not limited to, an index of occupancy of a central processing unit (central processing unit, CPU), usage of a disk, occupancy of a memory, and a network packet loss rate. In practical applications, the performance detection index may also include other indexes that can be used to detect the performance of the service, which is not limited in the embodiment of the present application. The described custom detection index is understood to be a detection index specific to a service in terms of network services, such as, but not limited to, a service entry per second query rate (QPS), a number of request errors, a downstream request QPS, a number of downstream request errors, a number of threads, a request average delay, and the like. In practical application, the custom detection index may also include other indexes, which is not limited in the embodiment of the present application.
S302, performing feature extraction processing on the first service data under each detection index based on at least two time dimensions to obtain at least two first features of the corresponding detection index, wherein the time dimensions of the first features in the detection index are different.
In this example, after the processing in step S301 is performed to obtain at least one detection index of the first service data, feature extraction processing can be performed on the first service data under each detection index based on at least two time dimensions, so as to obtain at least two first features of the corresponding detection index. It should be noted that the time dimension of each first feature described is not the same. References to at least two time dimensions include, but are not limited to, time, minutes, seconds, milliseconds, years, months, days, etc., and embodiments of the present application are not limited.
For example, taking the detection index as the CPU occupancy rate as an example, taking time, minute and second as three time dimensions as examples, respectively calculating the average value of the CPU occupancy rate of the first service data under the detection index of the CPU occupancy rate through the three time dimensions of time, minute and second, thereby obtaining three corresponding first features, namely a h ,a m ,a s . Wherein a is h Represents the average value of CPU occupancy rate, a, under the time dimension of 'time' m Represents the average value of CPU occupancy rate, a, under the time dimension of' minutes s Represents the average of CPU occupancy at "seconds" in the time dimension.
It should be noted that, the extraction process of at least two first features of other detection indexes may also be understood by referring to the above-mentioned detection indexes as examples of CPU occupancy, which is not described herein.
S303, carrying out weighting processing on the corresponding first features based on the weight of each time dimension, and carrying out summation processing on the weighted first features to obtain second features of the corresponding detection indexes.
In this example, after determining at least two first features of each detection indicator, a weight assignment process may also be performed on each first feature. Illustratively, the corresponding weighted first feature is obtained by acquiring a weight of each time dimension and weighting the corresponding first feature according to the weight of each time dimension. In this way, all the weighted first features are summed, so that the second features of the corresponding detection indexes are obtained. For example, taking the example shown in the above step S302 as an example, if the weights of time, minute and second are respectively 0.3, 0.3 and 0.4, the second feature of the detection index of the CPU occupancy rate is calculated as a=0.3·a h +0.3·a m +0.4·a s 。
Note that the weights of the mentioned time dimensions need to satisfy that the sum of the weights of all the time dimensions is 1. The weight of each time dimension may include other values besides the above mentioned 0.3, 0.3 and 0.4, and the embodiment of the present application is not limited thereto. In addition, the determination process of the second feature of the other detection index may also be understood with reference to the above-mentioned detection index as an example of the CPU occupancy rate, which is not described herein.
S304, performing linear mapping processing on the second characteristic of each detection index to obtain the target detection characteristic of the first service data.
In this example, at the time of determining each testAfter the second features of the indexes are measured, the second features of each detection index can be mapped into a high-dimensional space in a linear mapping (linear project) mode, so that a high-dimensional feature vector of each detection index is obtained. Thus, after the high-dimensional feature vectors of all the detection indexes are fused, the target detection features of the first service data can be obtained. For example, the mentioned linear mapping approach can be understood with reference to the following approach, i.e., x= Σ i＝ 1 Linear(a i ) Wherein x represents the target detection feature of the first service data, a i A second feature representing the ith detection index, linear (a i ) And (3) representing a high-dimensional feature vector of the ith detection index, wherein i is more than or equal to 1, and i is an integer.
In other examples, after determining the second feature of each detection indicator, normalization processing and normalization processing may be further performed on the second feature of each detection indicator, and then linear mapping processing may be performed on the second feature of each detection indicator after normalization processing and normalization processing, so as to obtain the target detection feature of the first service data. The specific process of performing the linear mapping process may be understood with reference to the foregoing, which is not described herein.
203. And detecting and processing target detection characteristics of the first business data based on a first risk prediction model to obtain a first risk detection result, wherein the first risk detection result is used for indicating a risk alarm type when at least one business risk occurs in the first business data, the first risk prediction model takes the risk alarm type for predicting the first business data as a training target, the detection characteristics of a first training sample marked with a risk alarm type marking label are taken as a machine learning model obtained by carrying out iterative training on a preset initial model by taking training data as training data, and the first training sample is historical business data when the first business runs in the previous t-1 acquisition period.
In this example, after determining the target detection feature of the first service data, the target detection feature of the first service data may be used as an input of the first risk prediction model. And detecting and processing the target detection characteristics of the first business data through the first risk prediction model, so as to predict a first risk detection result. And reflecting the risk alarm category when at least one business risk occurs in the first business data according to the first risk detection result. The mentioned risk alarm categories may include, but are not limited to, CPU occupancy alarms, memory occupancy alarms, disk usage alarms, etc., and the embodiments of the present application are not limited in particular. It should be noted that the risk alert category mentioned in the embodiment of the present application is related to the aforementioned detection index. The mentioned business risk may also include, but is not limited to, CPU occupation risk, memory occupation risk, disk usage risk, etc., and the embodiment of the present application is not limited in particular. For example, in the case of occurrence of CPU occupation risk, a prompt for CPU occupation alarm is required; similarly, in the case of a memory occupancy risk, a memory occupancy alarm is required to be prompted. For other business risks, a prompt of a corresponding risk alarm class needs to be performed, and detailed description is omitted here.
The first risk prediction model is a machine learning model obtained by taking a risk alarm type for predicting first service data as a training target, taking detection characteristics of a first training sample marked with a risk alarm type marking label as training data, and performing iterative training on a preset initial model. The first training sample is historical service data of the first service when the first service runs in the previous t-1 acquisition time periods. The training process of the described first risk prediction model may be understood with reference to the flowchart shown in fig. 5, which will not be described in detail herein.
In other examples, the target detection feature of the first service data may be used as an input of a first risk prediction model, and prediction processing is performed on the target detection feature of the first service data through the first risk prediction model, so as to obtain a prediction probability when each service risk occurs in the first service data. And then, determining a corresponding risk alarm category based on the prediction probability of each business risk occurrence of the first business data, and further obtaining a first risk detection result. For example, if the predicted probability of the first service data when the CPU occupation risk occurs is 0.8, and the preset threshold when the risk alarm is required for the occurrence of the CPU occupation risk is 0.6, the comparison can be made to know that 0.8 is greater than 0.6, which indicates that the first service data has the CPU occupation risk, and the corresponding risk alarm category is the CPU occupation alarm.
It should be noted that the above mentioned preset threshold value of 0.6 is only an exemplary description, and other values may be used in practical applications, which is not limited in the embodiment of the present application.
204. And carrying out risk prompt processing on the first business data based on the first risk detection result.
In this example, after the first risk detection result is determined, risk prompt processing can be performed on the first service data based on the first risk detection result. In an exemplary embodiment, in order to avoid frequent risk prompting on the first service data, reduce multiple times of service risks of the same risk alarm category and notify developers and maintainers, in a process of performing risk prompting processing on the first service data based on a first risk detection result, clustering processing may be performed on each risk alarm category within a preset duration based on category information of each risk alarm category and a target detection feature of the first service data, so as to obtain an alarm level of each risk alarm category. The mentioned preset time period is any time period within the t-th acquisition period. Then, a target alert policy is determined based on the alert level for each risk alert category. For example, a corresponding target alert policy may be selected from the set of alert policies based on the alert level of each risk alert type. In this way, after the target alarm strategy is selected and obtained, risk prompt processing is carried out on the first service data according to the target alarm strategy.
The mentioned category information of the risk alert category can indicate the specific type of the corresponding risk alert category, such as CPU memory alert, memory occupancy alert, etc. The alarm levels of the described risk alarm types may include, but are not limited to, mild alarms, moderate alarms, severe alarms, etc., and are not particularly limited in embodiments of the present application. In practice, the alert levels may also include, but are not limited to, level 1, level 2, level 3, and so on. The higher the number of grades, the higher the risk degree of the service risk, and the higher the degree of the alarm to be made.
In addition, the described alarm policy set may include at least one alarm policy, such as a sms alarm, a mail alarm, a phone alarm, etc., which is not limited in the embodiment of the present application. It should be noted that, the mapping relationship between the alarm level and the alarm policy may include a one-to-one relationship or a one-to-many relationship, which is not limited in the embodiment of the present application. For example, the light alarm may perform risk prompt by means of mail alarm, the moderate alarm may perform risk prompt by means of short message alarm, the serious alarm may select to perform risk prompt by means of telephone alarm, etc., and in the embodiment of the present application, the corresponding alarm mode may be flexibly selected based on the alarm level without specific limitation.
For example, fig. 4 shows a schematic flow chart of risk warning provided in an embodiment of the present application. As shown in fig. 4, taking two risk alert categories, i.e., a CPU occupancy alert and a memory occupancy alert as an example, at least one service risk of the first service data is predicted for multiple times within a preset period of time (e.g., 3 minutes), for example, 5 times, the first service data occurrence risk alert category is predicted to be the CPU occupancy risk of the CPU occupancy alert, and 3 times, the first service data occurrence risk alert category is predicted to be the memory occupancy risk of the memory occupancy alert. At this time, the first service data of 5 times of predicting the occurrence of the CPU occupation risk within 3 minutes is not required to be prompted by 5 times of CPU occupation alarm, and the first service data of 3 times of predicting the occurrence of the memory occupation risk is also not required to be prompted by 3 times of memory occupation alarm, but the CPU occupation alarm obtained by 5 times of predicting within 3 minutes is added to the waiting queue, and the memory occupation alarm obtained by 3 times of predicting is also added to the waiting queue. In this way, based on the category information of the CPU occupation alarm and the target detection feature of the current service data, the 5 CPU occupation alarms are clustered by an unsupervised K-means clustering algorithm, so that the alarm level of the CPU occupation alarm, such as a moderate alarm, is obtained. Similarly, based on the category information of the memory occupancy alarm and the target detection feature of the current service data, clustering is performed on the 3 memory occupancy alarms through an unsupervised K-means clustering algorithm, so that the alarm level of the memory occupancy alarm, such as a mild alarm, is obtained.
Moreover, as the light alarm can carry out risk prompt in a mail alarm mode, the moderate alarm can carry out risk prompt in a short message alarm mode, when the alarm level of the CPU occupation alarm is determined to be the moderate alarm, a developer and an operation and maintenance person can be informed in a short message alarm mode, so that the developer and the operation and maintenance person can know that the CPU occupation risk occurs in the first service data, and a proper processing strategy is selected to process the CPU occupation risk, such as checking whether an application program and the like generating the first service data are abnormal or not. Likewise, when the alarm level of the memory occupation alarm is determined to be a mild alarm, a mail alarm mode can be selected to notify the developer and the operation and maintenance personnel, so that the developer and the operation and maintenance personnel can know that the memory occupation risk occurs in the first service data, and a proper processing strategy is selected to process the memory occupation risk, such as regular memory cleaning and the like. Through the method, risk warning categories with time sequence and event similarity in the same preset duration can be notified to developers and maintainers only once, the developers and maintainers are assisted in reducing the risk investigation time, warning storm is avoided through warning level self-adaptive selection of warning modes, and invalid information is filtered.
The method for processing the business provided by the embodiment of the application can accurately predict the risk alarm category, and is greatly dependent on the model performance of the first risk prediction model, and the training process of the first risk prediction model is described in detail through the method embodiment.
Fig. 5A shows a schematic flow chart of model training provided by an embodiment of the present application. For convenience of description, the following embodiments are presented taking an execution subject of model training as a server as an example. As shown in fig. 5A, the model training process at least includes the following steps:
501. historical service data of the operation in the first t-1 acquisition time intervals are acquired to acquire a first training sample.
In this example, the first training sample may be understood as historical traffic data for the first traffic as it was running during the first t-1 acquisition period. After each of the first t-1 acquisition time periods runs to complete the first service, the service data of the first service during each acquisition time period can be stored in a database, so that historical service data of the first service is constructed and obtained, and the historical service data is convenient to serve as training data of the first risk prediction model. In addition, after the historical service data of the first service is obtained, risk analysis processing can be performed on the historical service data, so that the historical service data with service risk is obtained. In this way, the acquisition period corresponding to the historical service data with the service risk is taken as the alarm period, the risk alarm category of the historical service data in the alarm period is determined based on the service risk of the historical service data in the alarm period, and the historical service data in the corresponding alarm period is labeled based on the risk alarm category of the historical service data in the alarm period. In this way, before training the first risk prediction model, historical service data of the first service may be obtained from the database as a first training sample. It should be noted that the described alarm period can also be understood as an acquisition period when risk prompt is required when the service risk occurs in the historical service data in the previous t-1 acquisition periods.
Illustratively, the first training sample includes a positive sample and a negative sample.
Wherein the positive samples may comprise two parts of content, namely a first positive sample and a second positive sample. The first positive sample can be understood to be a sample obtained after sampling the historical service data in the previous t-1 acquisition time periods, namely the first positive sample is represented as the historical service data without the risk warning category labeling label in the previous t-1 acquisition time periods. The second positive sample is a sample obtained after resampling the historical service data in the alarm period, namely the second positive sample is represented as the historical service data without the risk alarm category label in the alarm period. Illustratively, after resampling to obtain the second positive sample, random noise following normal distribution may also be added to the second positive sample, so as to enhance the data expression capability of the second positive sample.
Similarly, the negative samples may then comprise two parts of content, namely a first negative sample and a second negative sample. The first negative sample can be understood as a sample obtained by sampling historical service data in the previous t-1 acquisition time periods, and the first negative sample is represented as the historical service data of the labeling label of the risk warning category in the previous t-1 acquisition time periods. The second negative sample is a sample obtained after resampling the historical service data in the alarm period, namely the second negative sample is the historical service data marked with the risk alarm category marking label in the alarm period. Illustratively, after resampling to obtain the second negative sample, random noise following normal distribution may be further added to the second negative sample, so as to enhance the data expression capability of the second negative sample.
Thus, after sampling the first positive and negative samples and resampling the second negative and positive samples, the first training sample may be constructed based on the first positive, second positive, first negative and second negative samples. By adopting the mode, the second positive sample and the second negative sample obtained by resampling in the alarm period are used as a part of the first training sample, so that the problem of unbalance of the positive and negative samples in the model training process can be relieved, and the model training efficiency is improved.
502. The detection features of the first training sample are determined based on the timing features of the first training sample.
In this example, after the first training sample is obtained, the detection features of the first training sample may also be determined based on the timing features of the first training sample. The first training sample is subjected to time sequence decomposition processing based on the time sequence characteristics of the first training sample, so as to obtain trend circulation characteristics, seasonal characteristics and random characteristics corresponding to the first training sample. And then, performing index analysis processing on the first training sample based on the trend circulation characteristics, the seasonal characteristics and the random characteristics corresponding to the first training sample to obtain at least one detection index of the first training sample. Further, feature extraction processing is performed on the first training sample under each detection index based on at least two time dimensions, so that at least two third features of the corresponding detection index are obtained, and the time dimensions of each third feature in the detection index are different. And then, carrying out weighted summation processing on the corresponding third characteristic based on the weight of each time dimension to obtain a fourth characteristic of the corresponding detection index. In this way, the fourth feature of each detection index is subjected to linear mapping processing, so that the detection feature of the first training sample is obtained.
It should be noted that, how to determine the detection feature of the first training sample based on the time sequence feature of the first training sample may be specifically understood by referring to the content shown in the foregoing steps S301 to S304 in fig. 3 in detail, which is not described herein. The third feature described may also be understood with reference to the first feature in step S302 in fig. 3, which is not described herein. The fourth feature described above may also be understood with reference to the second feature in step S303 in fig. 3, which is not described herein.
503. And detecting the detection characteristics of the first training sample based on a preset initial model to obtain a second risk detection result, wherein the second risk detection result is used for indicating a risk alarm type prediction label when each business risk occurs in the first training sample.
In this example, after determining the detection feature of the first training sample, the detection feature of the first training sample may be used as an input of a preset initial model, and then the detection feature of the first training sample is detected by means of the preset initial model, so as to predict a second risk detection result. The second risk detection result may also be understood by referring to the first risk detection result shown in step 203 in fig. 2, which is not described herein.
The mentioned preset initial model may include, but is not limited to, a gating loop unit (gated recurrent unit, GRU) or the like, in particularThe embodiment of the application is not limited. For example, fig. 5B shows a schematic structural diagram of model training provided by an embodiment of the present application. As shown in fig. 5B, taking a GRU model as a preset initial model as an example, after the detected feature of the first training sample is calculated, the detected feature of the first training sample may be input into the GRU model, and the sequential feature of the continuous frame is calculated by the GRU model, thereby obtaining the output y t The specific calculation formula is as follows:
r {t} ＝σ(W {r} *[h {t-1} ,x {t} ]+b {r} )
z {t} ＝σ(W {z} *[h {t-1} ,x {t} ]+b {z} )
y t ＝σ(Wo*h {t} )
wherein x is {t} Representing the detection characteristics of the first training sample in the t-th acquisition period, h {t-1} Representing the characteristics transferred from the previous node, sigma is a sigmoid function, and its output to 0 or 1 can be used as the gating signal of the GRU model, W {r} 、W {z} W, wo are parameter matrices in the GRU model, b {r} 、b {z} 、b {c} 、r {t} 、z {t} Is a model parameter of the GRU model.
Thus, the feature y of GRU layer output is calculated t The feature y can then be used t As input to the full connection layer, the risk alert class prediction label y1 of the first training sample is obtained, that is y1=softmax (y t ) Where softmax is the activation function.
504. And calculating the difference between the risk alarm category prediction label and the risk alarm category labeling label of the first training sample to acquire a target loss value.
In this example, since the output of the deep neural network is expected to be as close as possible to the truly desired value, the weight vector of each layer of the neural network can be updated by comparing the predicted value of the current network with the truly desired target value and then based on the difference between the two (of course, there is typically an initialization process before the first update, i.e. pre-configuring parameters for each layer in the deep neural network), for example, if the predicted value of the network is higher, the weight vector is adjusted to be lower than predicted, and the adjustment is continued until the neural network can predict the truly desired target value. Thus, it is necessary to define in advance "how to compare the difference between the predicted value and the target value", which is a loss function (loss function) or an objective function (objective function), which are important equations for measuring the difference between the predicted value and the target value. Taking the loss function as an example, the higher the output value (loss) of the loss function is, the larger the difference is, and then the training of the deep neural network becomes a process of reducing the loss as much as possible.
Therefore, after the risk alarm category prediction label is obtained based on the preset initial model prediction, the difference between the risk alarm category prediction label and the risk alarm category labeling label of the first training sample can be calculated. For example, the difference between the risk alert class prediction label and the risk alert class annotation label of the first training sample may be calculated by a cross entropy (cross entropy) loss function, e.g., loss (x, y) = - Σy·log (y 1), where y1 represents the risk alert class prediction label of the first training sample, y represents the risk alert class annotation label of the first training sample, loss (x, y) is a target loss value, and x is a detection feature of the first training sample.
It should be noted that, the difference between the risk alert category prediction tag and the risk alert category labeling tag is calculated only by taking cross entropy (cross entropy) loss function as an example. In practical applications, the difference may be calculated by using other loss functions, which is not limited in the embodiment of the present application.
505. And adjusting model parameters of a preset initial model based on the target loss value to obtain a first risk prediction model.
In this example, after the target loss value is calculated, the model parameters of the preset initial model can be updated and adjusted based on the target loss value, so as to obtain the first risk prediction model. For example, the target loss value may be iteratively optimized based on a gradient descent algorithm until the training result meets the condition of terminating the model training. It should be noted that the gradient descent algorithm may include random gradient descent, random gradient descent with a driving term, adaptive gradient algorithm (ada ptive gradient), adaptive matrix estimation algorithm (adaptive moment estimation), and the like, which are not particularly limited in the embodiment of the present application. In addition, the condition for terminating the model training may include that the training iteration number satisfies a preset value or the target loss value is smaller than a preset value, etc., which is not specifically limited in the present application.
In other examples, in order to continuously update the iterative first risk prediction model during the operation of the first service, after the first risk prediction model is obtained based on the process flow training of fig. 5A, the embodiment of the present application may further use a continuous learning manner, and based on the original first training sample, service data when a prediction deviation or a prediction error occurs in the first risk prediction model during the prediction of the risk alarm category is used as incremental training data, so as to continuously update the iterative first risk prediction model during the operation of the first service, and effectively correct the prediction deviation of the first risk prediction model. This can be understood in particular with reference to the following processing scheme, namely:
firstly, detecting the accuracy of a first risk detection result, and judging whether the accuracy of the first risk detection result is smaller than a preset threshold value. For example, it may be determined based on a manual experience that the first risk detection result does not actually reach the degree of risk prompting, but due to reasons such as false alarm and missing alarm of the first risk prediction model, the first risk prediction model predicts that risk prompting needs to be performed on the first service data corresponding to the first risk detection result, and at this time, the first risk prediction model may be considered to perform false alarm processing or missing alarm processing on the first service data, so that accuracy of the first risk detection result may be determined. In this way, under the condition that the accuracy of the first risk detection result is determined to be smaller than the preset threshold value, the first service data can be determined to be the second training sample. Thus, the first training samples obtained in the previous step are combined to be used as training data of the first risk prediction model.
Then, the sample weight of the first training sample and the sample weight of the second training sample are obtained. For example, in order to prevent the first risk prediction model from forgetting the historical service data learned before the continuous learning process, the weight assignment process may be further performed on the first training sample and the second training sample. For example, the weight of historical traffic data sampled for a certain sampling period may gradually decrease with the length of time from the current run time. Thus, in the process of obtaining the sample weight of the first training sample, the sample weight w of the first training sample may be calculated based on the first time difference and the sample number of the first training sample t1 I.e.Where a1 represents the number of samples of the first training sample and t1 represents the first time difference. It should be noted that the first time difference t1 is used to indicate a time span between the sampling time of the first training sample and the current running time of the first service. For example, if the sampling time of the first training sample is 8 points and the current first service is operated at 10 points, the first time difference t1=10-8=2 (hours). Likewise, in the process of obtaining the sample weight of the second training sample, the sample weight w of the second training sample may be specifically calculated based on the second time difference and the sample number of the second training sample t2 I.e. +.>Where a2 represents the number of samples of the second training sample and t2 represents the second time difference. The second time difference t2 is used for indicating the second training sampleThe time span between the sampling time and the current running time of the first service. It should be noted that the above-mentioned sampling time is 8 points, and the current running time is 10 points, which is only a schematic description, and other values may be included in practical applications, which is not particularly limited by the present application.
In this way, the first training sample is weighted based on the sample weight of the first training sample to obtain a third training sample, and the second training sample is weighted based on the sample weight of the second training sample to obtain a fourth training sample. Further, iterative training is carried out on the first risk prediction model based on the third training sample and the fourth training sample, and an adjusted first risk prediction model is obtained. After the adjusted first risk prediction model is obtained, the detection features of the service data in the t+1 acquisition period can be detected by using the adjusted first risk prediction model, so that a risk detection result of the service data in the t+1 acquisition period can be obtained. It should be noted that, the risk detection result of the service data in the t+1 acquisition period is used to indicate the risk alarm category when each of the service risks occurs to the service data in the t+1 acquisition period.
For example, fig. 6 shows a first flowchart of model update provided by an embodiment of the present application. As shown in fig. 6, after the first risk prediction model is used to predict the first service data at the t-th moment, the first service data at the t-th moment may also be used as incremental training data, that is, the above-mentioned second training sample. In this way, by weighting and sampling the first training sample and the second training sample, the model parameters of the first risk prediction model can be updated and adjusted based on the third training sample and the fourth training sample obtained after weighting, so as to obtain the adjusted first risk prediction model. And then detecting the target detection characteristics of the business data at the t+1 moment based on the adjusted first risk prediction model, so as to predict and obtain a risk detection result of the business data at the t+1 moment. The processing flow is continuously repeated to continuously update the first risk prediction model, so that the first risk prediction model does not generate prediction deviation due to fluctuation or scene change of service data such as service flow, the prediction deviation of the first risk prediction model is effectively corrected, and the prediction accuracy is improved.
It should be noted that, in the process of continuously updating and training the first risk prediction model in the continuous learning manner, the model update may be automatically triggered at fixed time intervals during the operation of the first service, or may be triggered according to risk alarms. The specific trigger mode is selected to update the model, and the embodiment of the application is not limited.
In other examples, the first risk prediction model or the adjusted first risk prediction model is obtained by training based on the service data of the first service, and can be widely applied to a prediction scenario for implementing a risk detection result of the service data of the first service. However, when a new service (i.e., the second service mentioned later) occurs, it is difficult to train a risk prediction model applicable to the second service due to lack of historical service data of the second service. Therefore, in order to enable the first risk prediction Model obtained through training to learn the distinction between the first service and the second service, the first risk prediction Model is quickly adapted to various other service scenes except the first service, and on the basis of training to obtain the first risk prediction Model, a migration method based on Model-Agnostic Meta-Learning (MAML) algorithm is adopted to train out the risk prediction Model adapted to the second service. For example, after the model parameters of the preset initial model are adjusted based on the target loss value to obtain the first risk prediction model, the second service data may also be obtained. The second service data mentioned is real-time service data when the second service is run. And then, updating model parameters of the first risk prediction model based on the first training sample and the second service data to obtain a second risk prediction model. The second risk prediction model can be used for predicting a risk detection result of the second service data. The mentioned risk detection result of the second service data can indicate the risk alarm category when each service risk occurs in the second service data. The contents of the business risk, risk alert category, etc. described herein may be specifically understood with reference to the foregoing contents shown in fig. 2, and will not be described herein.
The specific process of updating the second risk prediction model may be understood with reference to the process flow shown in fig. 7. For example, fig. 7 shows a second flow chart of model update provided by the embodiment of the application. As shown in fig. 7, after the model parameters of the preset initial model are adjusted based on the target loss value to obtain the first risk prediction model, second service data are obtained, and the first training sample and the second service data are used as target training data. For example, the target training data may also be constructed by extracting the same number of samples as the second service data from the first training samples, and then using the extracted samples and the second service data. Then, deriving and calculating model parameters phi of the first risk prediction model based on a preset back propagation model and target training data to obtain a first gradient g of the first risk prediction model 1 I.e.Further, model parameters phi and first gradients g for the first risk prediction model 1 Summing to obtain a first parameter θ of the first risk prediction model, i.e., θ=φ+g 1 . In this way, after the first parameter θ of the first risk prediction model is calculated, derivative calculation is performed on the first parameter θ of the first risk prediction model again based on the preset back propagation model and the target training data, so as to obtain the second gradient g of the first risk prediction model 2 I.e. +.>Further, model parameters phi and second gradients g for the first risk prediction model 2 Performing summation processing to determine a second parameter phi of the first risk prediction model 1 I.e. phi 1 ＝φ+g 2 . Finally, a second parameter phi based on the first risk prediction model 1 And training to obtain a second risk prediction model. Repeatedly go upThe process can take the finally determined model parameters as the initialization parameters of the second risk prediction model, and further adapt to a prediction scene of a risk detection result of service data of the second service, so that the problem of lack of historical service data during cold start of a new service can be realized. For changeable current network environment, the method for rapidly adapting to the new service scene can timely detect the service risk when the new service is on line, also reduces the model learning cost and saves the computing resource.
It should be noted that the above-mentioned back propagation model may also be understood as a back propagation algorithm, which is not limited in the embodiment of the present application. In addition, the above-mentioned process of performing parameter update on the first risk prediction model to obtain the second risk prediction model shown in fig. 7 may also be applicable to performing parameter update on the first risk prediction model obtained by adjustment in fig. 6 to obtain the second risk prediction model, which is not described in detail herein.
In the embodiment of the application, the first risk prediction model is a machine learning model obtained by iteratively training a preset initial model by taking a risk alarm type for predicting the first service data as a training target and taking the detection characteristic of a first training sample marked with a risk alarm type marking label as training data. The first training sample mentioned is understood to be historical traffic data of the first traffic as it runs during the first t-1 acquisition period. Moreover, since the first service data is real-time service data when the first service runs in the t-th acquisition period, and has time sequence, after the first service data is acquired, the target detection characteristic of the first service data can be determined based on the time sequence characteristic of the first service data. In this way, after the first risk prediction model is obtained through training, the target detection feature of the first service data can be used as input of the first risk prediction model, so that the target detection feature of the first service data can be detected and processed through the first risk prediction model, and the first risk detection result is obtained. And indicating the risk alarm category when at least one business risk occurs in the first business data according to the first risk detection result. And then, carrying out risk prompt processing on the first business data based on the first risk detection result. By means of the method, the risk warning type when the first service data is at risk is determined without setting the warning threshold based on a dynamic-static mode, corresponding target detection characteristics are determined by considering time sequence characteristics of the first service data, the risk warning type when the first service data is at least at one service risk is directly predicted by means of the first risk prediction model obtained through training, and the service risks which are needed to be subjected to risk prompt in the warning mode and are generated in the first service data can be timely detected, so that risk prompt processing can be rapidly performed, and accuracy and timeliness of risk warning are improved.
The foregoing description of the solution provided by the embodiments of the present application has been mainly presented in terms of a method. It should be understood that, in order to implement the above-described functions, hardware structures and/or software modules corresponding to the respective functions are included. Those of skill in the art will readily appreciate that the various illustrative modules and algorithm steps described in connection with the embodiments disclosed herein may be implemented as hardware or combinations of hardware and computer software. Whether a function is implemented as hardware or computer software driven hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
The embodiment of the application can divide the functional modules of the device according to the method example, for example, each functional module can be divided corresponding to each function, and two or more functions can be integrated in one processing module. The integrated modules may be implemented in hardware or in software functional modules. It should be noted that, in the embodiment of the present application, the division of the modules is schematic, which is merely a logic function division, and other division manners may be implemented in actual implementation.
The following describes the service processing device in the embodiment of the present application in detail, and fig. 8 is a schematic diagram of an embodiment of the service processing device provided in the embodiment of the present application. As shown in fig. 8, the service processing apparatus may include an acquisition unit 801 and a processing unit 802.
The acquiring unit 801 is configured to acquire first service data, where the first service data is real-time service data when the first service runs in a t-th acquisition period, and t is greater than or equal to 1. A processing unit 802 for determining a target detection characteristic of the first traffic data based on the timing characteristic of the first traffic data. The processing unit 802 is configured to perform detection processing on a target detection feature of the first service data based on a first risk prediction model, so as to obtain a first risk detection result, where the first risk detection result is used to indicate a risk alarm class when at least one service risk occurs in the first service data, the first risk prediction model uses the risk alarm class for predicting the first service data as a training target, uses a detection feature of a first training sample labeled with the risk alarm class label as a training data, and performs iterative training on a machine learning model obtained by performing iterative training on a preset initial model, where the first training sample is historical service data when the first service runs in a previous t-1 acquisition period. The processing unit 802 is configured to perform risk prompting processing on the first service data based on the first risk detection result. It may be specifically understood with reference to the descriptions of steps 201 to 204 in fig. 2, which are not described herein.
In some alternative examples, processing unit 802 is to: determining at least one detection index of the first service data based on the time sequence characteristics of the first service data, wherein the detection dimension of each detection index is different; performing feature extraction processing on the first service data under each detection index based on at least two time dimensions to obtain at least two first features of the corresponding detection index, wherein the time dimensions of each first feature in the detection index are different; weighting the corresponding first features based on the weight of each time dimension, and summing the weighted first features to obtain second features of the corresponding detection indexes; and performing linear mapping processing on the second characteristic of each detection index to obtain the target detection characteristic of the first service data.
In other alternative examples, processing unit 802 is configured to: performing time sequence decomposition processing on the first business data based on the time sequence characteristics of the first business data to obtain trend circulation characteristics, seasonal characteristics and random characteristics corresponding to the first business data, wherein the trend circulation characteristics are used for indicating the condition that the first business data presents periodicity, the seasonal characteristics are used for indicating the condition that the first business data presents the seasonality, and the random characteristics are used for indicating other conditions of the first business data except the periodicity and the seasonality; and performing index analysis processing on the first service data based on the trend circulation characteristics, the seasonal characteristics and the random characteristics to obtain at least one detection index of the first service data.
In other alternative examples, processing unit 802 is configured to: taking the target detection characteristics of the first service data as the input of a first risk prediction model to obtain the prediction probability of each service risk of the first service data; and determining a first risk detection result based on the prediction probability of each business risk of the first business data.
In other alternative examples, processing unit 802 is configured to: clustering each risk alarm category in a preset time length based on category information of each risk alarm category and target detection characteristics of the first service data to obtain an alarm level of each risk alarm category, wherein the preset time length is any time length in a t-th acquisition period; determining a target alarm strategy based on the alarm level of each risk alarm category; and carrying out risk prompt processing on the first service data based on the target alarm strategy.
In other alternative examples, the acquisition unit 801 is further configured to: before detecting the target detection feature of the first service data based on the first risk prediction model to obtain a first risk detection result, acquiring historical service data during operation in the previous t-1 acquisition time periods to obtain a first training sample. The processing unit 802 is configured to: determining detection features of the first training sample based on the timing features of the first training sample; detecting the detection characteristics of the first training sample based on a preset initial model to obtain a second risk detection result, wherein the second risk detection result is used for indicating a risk alarm type prediction label when each business risk occurs in the first training sample; calculating the difference between the risk alarm category prediction label and the risk alarm category labeling label of the first training sample to obtain a target loss value; and updating model parameters of a preset initial model based on the target loss value to obtain a first risk prediction model.
In other alternative examples, processing unit 802 is configured to: sampling historical service data in the previous t-1 acquisition time periods to obtain a first positive sample and a first negative sample, wherein the first positive sample is represented as historical service data without labeling a risk alarm category labeling label in the previous t-1 acquisition time periods, and the first negative sample is represented as historical service data with labeling a risk alarm category labeling label in the previous t-1 acquisition time periods; resampling historical service data in an alarm period to obtain a second positive sample and a second negative sample, wherein the alarm period is an acquisition period when risk prompt is needed when service risk occurs to the historical service data in the previous t-1 acquisition periods; a first training sample is determined based on the first positive sample, the second positive sample, the first negative sample, and the second negative sample.
In other alternative examples, processing unit 802 is further configured to: after detecting target detection characteristics of first service data based on a first risk prediction model to obtain a first risk detection result, determining the first service data as a second training sample when the accuracy of the first risk detection result is smaller than a preset threshold value; acquiring sample weights of the first training samples and sample weights of the second training samples; weighting the first training sample based on the sample weight of the first training sample to obtain a third training sample, and weighting the second training sample based on the sample weight of the second training sample to obtain a fourth training sample; and carrying out iterative training on the first risk prediction model based on the third training sample and the fourth training sample to obtain an adjusted first risk prediction model, wherein the adjusted first risk prediction model is used for predicting a risk detection result of the business data in the t+1 acquisition period, and the risk detection result of the business data in the t+1 acquisition period is used for indicating a risk alarm category when each business risk occurs to the business data in the t+1 acquisition period. It is specifically understood with reference to the foregoing description of fig. 6, and details thereof are not repeated herein.
In other alternative examples, processing unit 802 is configured to: calculating a sample weight of the first training sample based on the first time difference and a sample number of the first training sample, wherein the first sampling time difference is used for indicating a time span between a sampling time of the first training sample and a current running time of the first service; determining a sample weight of the second training sample based on a second time difference and a sample number of the second training sample, wherein the second sampling time difference is used to indicate a time span between a sampling time of the second training sample and a current run time;
in other alternative examples, the acquisition unit 801 is further configured to: and updating model parameters of a preset initial model based on the target loss value, acquiring second service data after the first risk prediction model is obtained, wherein the second service data is real-time service data when the second service is operated, and the first service is different from the second service. The processing unit 802 is configured to: updating model parameters of the first risk prediction model based on the first training sample and the second service data to obtain a second risk prediction model, wherein the second risk prediction model is used for predicting a risk detection result of the second service data, and the risk detection result of the second service data is used for indicating a risk alarm category when each service risk occurs in the second service data. It is specifically understood with reference to the foregoing description of fig. 7, and details thereof are not described herein.
In other alternative examples, processing unit 802 is configured to: determining a first training sample and second service data as target training data; conducting derivative calculation on model parameters of a first risk prediction model based on a preset back propagation model and target training data to obtain a first gradient of the first risk prediction model; summing the model parameters of the first risk prediction model and the first gradient to obtain first parameters of the first risk prediction model; conducting derivative calculation on first parameters of the first risk prediction model based on a preset back propagation model and target training data to obtain a second gradient of the first risk prediction model; summing the model parameters of the first risk prediction model and the second gradient to determine the second parameters of the first risk prediction model; and training to obtain a second risk prediction model based on the second parameters of the first risk prediction model.
The service processing apparatus in the embodiment of the present application is described above from the point of view of the modularized functional entity, and the service processing device in the embodiment of the present application is described below from the point of view of hardware processing. Fig. 9 is a schematic structural diagram of a service processing device according to an embodiment of the present application. The service processing device may vary considerably due to different configurations or capabilities. The traffic processing device may include at least one processor 901, communication lines 907, memory 903, and at least one communication interface 904.
The processor 901 may be a general purpose central processing unit (central processing unit, CPU), microprocessor, application-specific integrated circuit (server IC), or one or more integrated circuits for controlling the execution of programs in accordance with aspects of the present application.
Communication line 907 may include a pathway to transfer information between the aforementioned components.
The communication interface 904, uses any transceiver-like device for communicating with other devices or communication networks, such as ethernet, radio access network (radio access network, RAN), wireless local area network (wireless local area networks, WLAN), etc.
The memory 903 may be a read-only memory (ROM) or other type of static storage device that may store static information and instructions, a random access memory (random access memory, RAM) or other type of dynamic storage device that may store information and instructions, and the memory may be stand-alone and coupled to the processor via a communication line 907. The memory may also be integrated with the processor.
The memory 903 is used for storing computer-executable instructions for executing the present application, and is controlled by the processor 901. The processor 901 is configured to execute computer-executable instructions stored in the memory 903, thereby implementing the method provided by the above-described embodiment of the present application.
Alternatively, the computer-executable instructions in the embodiments of the present application may be referred to as application program codes, which are not particularly limited in the embodiments of the present application.
In a specific implementation, as an embodiment, the service processing device may include a plurality of processors, such as processor 901 and processor 902 in fig. 9. Each of these processors may be a single-core (single-CPU) processor or may be a multi-core (multi-CPU) processor. A processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (e.g., computer program instructions).
In a specific implementation, the service processing device may further comprise an output device 905 and an input device 906, as an embodiment. The output device 905 communicates with the processor 901 and may display information in a variety of ways. The input device 906, in communication with the processor 901, may receive input of a target object in a variety of ways. For example, the input device 906 may be a mouse, a touch screen device, a sensing device, or the like.
The service processing device may be a general-purpose device or a special-purpose device. In a specific implementation, the service processing device may be a server, a terminal device, or the like, or an apparatus having a similar structure in fig. 9. The embodiment of the application is not limited to the type of the service processing equipment.
Note that the processor 901 in fig. 9 may cause the service processing apparatus to execute the method in the method embodiment corresponding to fig. 2 to 7 by calling the computer-executable instructions stored in the memory 903.
In particular, the functions/implementation of the processing unit 802 in fig. 8 may be implemented by the processor 901 in fig. 9 invoking computer executable instructions stored in the memory 903. The function/implementation procedure of the acquisition unit 801 in fig. 8 can be implemented by the communication interface 904 in fig. 9.
The embodiment of the present application also provides a computer storage medium storing a computer program for electronic data exchange, where the computer program causes a computer to execute some or all of the steps of any one of the service processing methods described in the above method embodiments.
Embodiments of the present application also provide a computer program product comprising a non-transitory computer-readable storage medium storing a computer program operable to cause a computer to perform some or all of the steps of a method of any one of the business processes described in the method embodiments above.
In the above embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, which are not repeated herein.
In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of elements is merely a logical functional division, and there may be additional divisions of actual implementation, e.g., multiple elements or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.
The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed over a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.
The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be embodied in essence or a part contributing to the prior art or all or part of the technical solution in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a read-only memory (ROM), a random access memory (random access memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.
The above-described embodiments may be implemented in whole or in part by software, hardware, firmware, or any combination thereof, and when implemented in software, may be implemented in whole or in part in the form of a computer program product.
The computer program product includes one or more computer instructions. When the computer-executable instructions are loaded and executed on a computer, the processes or functions in accordance with embodiments of the present application are fully or partially produced. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by a wired (e.g., coaxial cable, fiber optic, digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). Computer readable storage media can be any available media that can be stored by a computer or data storage devices such as servers, data centers, etc. that contain an integration of one or more available media. Usable media may be magnetic media (e.g., floppy disks, hard disks, magnetic tape), optical media (e.g., DVD), or semiconductor media (e.g., SSD)), or the like.
The above embodiments are only for illustrating the technical solution of the present application, and are not limiting; although the application has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims (15)
1. A method of service processing, comprising:
acquiring first service data, wherein the first service data is real-time service data of a first service in a t acquisition period, and t is more than or equal to 1;
determining a target detection feature of the first traffic data based on the timing feature of the first traffic data;
detecting target detection characteristics of the first service data based on a first risk prediction model to obtain a first risk detection result, wherein the first risk detection result is used for indicating a risk alarm type when at least one service risk occurs in the first service data, the first risk prediction model is a machine learning model obtained by taking the risk alarm type for predicting the first service data as a training target, taking the detection characteristics of a first training sample marked with a risk alarm type marking label as training data and carrying out iterative training on a preset initial model, and the first training sample is historical service data when the first service operates in the previous t-1 acquisition time period;
And carrying out risk prompt processing on the first business data based on the first risk detection result.
2. The method of claim 1, wherein determining the target detection characteristic of the first traffic data based on the timing characteristic of the first traffic data comprises:
determining at least one detection index of the first service data based on the time sequence characteristics of the first service data, wherein the detection dimension of each detection index is different;
performing feature extraction processing on the first service data under each detection index based on at least two time dimensions to obtain at least two first features of the corresponding detection indexes, wherein the time dimensions of each first feature in the detection indexes are different;
weighting the corresponding first features based on the weight of each time dimension, and summing the weighted first features to obtain corresponding second features of the detection index;
and carrying out linear mapping processing on the second characteristics of each detection index to obtain target detection characteristics of the first service data.
3. The method of claim 2, wherein determining at least one detection indicator of the first traffic data based on the timing characteristics of the first traffic data comprises:
Performing time sequence decomposition processing on the first service data based on the time sequence characteristics of the first service data to obtain trend circulation characteristics, seasonal characteristics and random characteristics corresponding to the first service data, wherein the trend circulation characteristics are used for indicating the condition that the first service data presents periodicity, the seasonal characteristics are used for indicating the condition that the first service data presents the seasonality, and the random characteristics are used for indicating other conditions of the first service data except the periodicity and the seasonality;
and performing index analysis processing on the first service data based on the trend circulation characteristic, the seasonal characteristic and the random characteristic to obtain at least one detection index of the first service data.
4. A method according to any one of claims 1 to 3, wherein the detecting the target detection feature of the first service data based on the first risk prediction model to obtain a first risk detection result includes:
taking the target detection characteristics of the first business data as the input of the first risk prediction model to obtain the prediction probability of each business risk of the first business data;
The first risk detection result is determined based on the prediction probability when each of the business risks occurs to the first business data.
5. A method according to any one of claims 1 to 3, wherein performing risk prompting processing on the first service data based on the first risk detection result comprises:
clustering each risk alarm category in a preset time length based on category information of each risk alarm category and target detection characteristics of the first service data to obtain an alarm level of each risk alarm category, wherein the preset time length is any time length in the t-th acquisition period;
determining a target alarm strategy based on the alarm level of each risk alarm category;
and carrying out risk prompt processing on the first service data based on the target alarm strategy.
6. A method according to any one of claims 1 to 3, wherein, before the detecting the target detection feature of the first service data based on the first risk prediction model, the method further comprises:
acquiring historical service data during operation in the previous t-1 acquisition time periods to acquire and obtain the first training sample;
Determining a detection feature of the first training sample based on a timing feature of the first training sample;
detecting the detection characteristics of the first training sample based on a preset initial model to obtain a second risk detection result, wherein the second risk detection result is used for indicating a risk alarm type prediction label when each business risk occurs in the first training sample;
calculating the difference between the risk alarm category prediction label and the risk alarm category labeling label of the first training sample to obtain a target loss value;
updating the model parameters of the preset initial model based on the target loss value to obtain the first risk prediction model.
7. The method of claim 6, wherein the obtaining the first training sample comprises:
sampling the historical service data in the previous t-1 acquisition time periods to obtain a first positive sample and a first negative sample, wherein the first positive sample is represented as the historical service data which is not marked with the risk alarm category marking label in the previous t-1 acquisition time periods, and the first negative sample is represented as the historical service data which is marked with the risk alarm category marking label in the previous t-1 acquisition time periods;
Resampling historical service data in an alarm period to obtain a second positive sample and a second negative sample, wherein the alarm period is an acquisition period when risk prompt is needed when the historical service data generates the service risk in the previous t-1 acquisition periods;
the first training sample is determined based on the first positive sample, the second positive sample, the first negative sample, and the second negative sample.
8. The method according to claim 6, wherein after the detecting the target detection feature of the first service data based on the first risk prediction model, the method further comprises:
when the accuracy of the first risk detection result is smaller than a preset threshold value, determining that the first service data is a second training sample;
acquiring the sample weight of the first training sample and the sample weight of the second training sample;
weighting the first training sample based on the sample weight of the first training sample to obtain a third training sample, and weighting the second training sample based on the sample weight of the second training sample to obtain a fourth training sample;
And performing iterative training on the first risk prediction model based on the third training sample and the fourth training sample to obtain an adjusted first risk prediction model, wherein the adjusted first risk prediction model is used for predicting a risk detection result of service data in a t+1st acquisition period, and the risk detection result of the service data in the t+1st acquisition period is used for indicating a risk alarm category when each service risk occurs to the service data in the t+1st acquisition period.
9. The method of claim 8, wherein the obtaining the sample weights of the first training sample and the second training sample comprises:
calculating a sample weight of the first training sample based on a first time difference and a sample number of the first training sample, wherein the first sampling time difference is used for indicating a time span between a sampling time of the first training sample and a current running time of the first service;
a sample weight of the second training sample is determined based on a second time difference and a sample number of the second training sample, wherein the second sampling time difference is used to indicate a time span between a sampling time of the second training sample and the current run time.
10. The method of claim 6, wherein after updating the model parameters of the pre-set initial model based on the target loss value to obtain the first risk prediction model, the method further comprises:
acquiring second service data, wherein the second service data is real-time service data when a second service is operated, and the first service is different from the second service;
updating model parameters of the first risk prediction model based on the first training sample and the second service data to obtain a second risk prediction model, wherein the second risk prediction model is used for predicting a risk detection result of the second service data, and the risk detection result of the second service data is used for indicating a risk alarm category when each service risk occurs in the second service data.
11. The method of claim 10, wherein updating the model parameters of the first risk prediction model based on the first training samples and the second business data to obtain a second risk prediction model comprises:
determining the first training sample and the second service data as target training data;
Conducting derivative calculation on model parameters of the first risk prediction model based on a preset back propagation model and the target training data to obtain a first gradient of the first risk prediction model;
summing the model parameters of the first risk prediction model and the first gradient to obtain first parameters of the first risk prediction model;
conducting derivative calculation on the first parameter of the first risk prediction model based on the preset back propagation model and the target training data to obtain a second gradient of the first risk prediction model;
summing the model parameters of the first risk prediction model and the second gradient to determine the second parameters of the first risk prediction model;
and training to obtain a second risk prediction model based on the second parameter of the first risk prediction model.
12. A service processing apparatus, comprising:
the acquisition unit is used for acquiring first service data, wherein the first service data is real-time service data of the first service in the t acquisition period, and t is more than or equal to 1;
a processing unit, configured to determine a target detection feature of the first service data based on a timing feature of the first service data;
The processing unit is configured to perform detection processing on target detection features of the first service data based on a first risk prediction model, so as to obtain a first risk detection result, where the first risk detection result is used to indicate a risk alarm class when at least one service risk occurs in the first service data, the first risk prediction model uses the risk alarm class predicted by the first service data as a training target, uses a detection feature of a first training sample labeled by the risk alarm class label as a machine learning model obtained by performing iterative training on a preset initial model by using training data, and the first training sample is historical service data when the first service runs in a previous t-1 acquisition period;
and the processing unit is used for carrying out risk prompt processing on the first business data based on the first risk detection result.
13. A service processing apparatus, characterized in that the service processing apparatus comprises: an input/output (I/O) interface, a processor, and a memory, the memory having program instructions stored therein;
the processor is configured to execute program instructions stored in a memory to perform the method of any one of claims 1 to 11.
14. A computer readable storage medium comprising instructions which, when run on a computer device, cause the computer device to perform the method of any of claims 1 to 11.
15. A computer program product, characterized in that the computer program product comprises instructions which, when run on a computer device or a processor, cause the computer device or the processor to perform the method of any of claims 1 to 11.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310129467.5A CN117213508A (en) | 2023-01-31 | 2023-01-31 | Method, device, storage medium and program product for business processing |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310129467.5A CN117213508A (en) | 2023-01-31 | 2023-01-31 | Method, device, storage medium and program product for business processing |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117213508A true CN117213508A (en) | 2023-12-12 |
Family
ID=89046787
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310129467.5A Pending CN117213508A (en) | 2023-01-31 | 2023-01-31 | Method, device, storage medium and program product for business processing |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117213508A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118133277A (en) * | 2024-05-07 | 2024-06-04 | 上海冰鉴信息科技有限公司 | Seatunnel-based service data management method and Seatunnel-based service data management system |
-
2023
- 2023-01-31 CN CN202310129467.5A patent/CN117213508A/en active Pending
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN118133277A (en) * | 2024-05-07 | 2024-06-04 | 上海冰鉴信息科技有限公司 | Seatunnel-based service data management method and Seatunnel-based service data management system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11616707B2 (en) | Anomaly detection in a network based on a key performance indicator prediction model | |
| US10831827B2 (en) | Automatic extraction of user mobility behaviors and interaction preferences using spatio-temporal data | |
| US11190562B2 (en) | Generic event stream processing for machine learning | |
| AU2016328959B2 (en) | Updating attribute data structures to indicate trends in attribute data provided to automated modeling systems | |
| CN110489964A (en) | Account detection method, device, server and storage medium | |
| CN106992994A (en) | A kind of automatically-monitored method and system of cloud service | |
| CN112800116B (en) | Method and device for detecting abnormity of service data | |
| US10878324B2 (en) | Problem analysis and priority determination based on fuzzy expert systems | |
| CN110162939B (en) | Man-machine identification method, equipment and medium | |
| CN113537337A (en) | Training method, abnormality detection method, apparatus, device, and storage medium | |
| CN113825165B (en) | 5G slice network congestion early warning method and device based on time diagram network | |
| CN117213508A (en) | Method, device, storage medium and program product for business processing | |
| CN110766236A (en) | Power equipment state trend prediction method based on statistical analysis and deep learning | |
| CN112866281A (en) | Distributed real-time DDoS attack protection system and method | |
| WO2023240087A1 (en) | Systems for application enhanced data labeling for ai training and methods thereof | |
| CN115499187A (en) | API safety monitoring model training method, monitoring method, device and equipment | |
| CN115296876A (en) | Network security early warning system of self-adaptation mimicry technique | |
| CN110825589A (en) | Anomaly detection method and device for micro-service system and electronic equipment | |
| CN114266288A (en) | Network element detection method and related device | |
| AU2021218217A1 (en) | Systems and methods for preventative monitoring using AI learning of outcomes and responses from previous experience. | |
| Mao et al. | Perception Analysis and Early Warning of Home‐Based Care Health Information Based on the Internet of Things | |
| CN109919744A (en) | Detection method neural network based and device | |
| CN113746668B (en) | Application process fault prediction method, device, equipment and readable storage medium | |
| CN113810212B (en) | Root cause positioning method and device for 5G slice user complaints | |
| US20240144075A1 (en) | Updating label probability distributions of data points |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication |