CN114201372A

CN114201372A - Method, apparatus, device, medium and product for exception warning

Info

Publication number: CN114201372A
Application number: CN202111536221.7A
Authority: CN
Inventors: 荣伟光; 李力军; 谢昊龙; 唐鹏; 崔海丽; 冯万军; 余德海; 李艳艳
Original assignee: CCB Finetech Co Ltd
Current assignee: CCB Finetech Co Ltd
Priority date: 2021-12-15
Filing date: 2021-12-15
Publication date: 2022-03-18

Abstract

The present disclosure provides a method, apparatus, device, medium, and product for anomaly alerting. The abnormal alarm method comprises the following steps: acquiring database authority; based on the database authority, calling historical data of a preset time period, wherein the historical data comprises a plurality of workflow dimensions; performing first preprocessing on the historical data to finish classification according to the dimensions of the job flow to obtain historical reference values of different dimensions; obtaining current data of a workflow in a flow meter, wherein the current data comprises a plurality of workflow dimensions; performing second preprocessing on the current data to finish classification according to the dimensions of the workflow to obtain current state values of different dimensions; judging whether the current state value is larger than the historical reference value or not based on the same job flow dimension; and performing an abnormal alarm under the condition that the current state value is greater than the historical reference value.

Description

Method, apparatus, device, medium and product for exception warning

Technical Field

The present disclosure relates to the field of big data, and in particular, to a method, an apparatus, a device, a medium, and a product for an abnormal alarm.

Background

In the process of batch capturing of a large amount of data through the batch scheduling system in the current row, an abnormal event occurs, and the normal operation of the system is often influenced by the occurrence of the abnormal event. Therefore, when an abnormal event occurs, alarm processing needs to be performed for such abnormal event.

Disclosure of Invention

In view of the foregoing technical problems, the present disclosure provides a method, apparatus, device, medium, and product for exception warning.

A first aspect of the present disclosure provides a method of abnormal alarm, the method comprising: acquiring database authority; based on the database authority, calling historical data of a preset time period, wherein the historical data comprises a plurality of workflow dimensions; performing first preprocessing on the historical data to finish classification according to the dimensions of the job flow to obtain historical reference values of different dimensions; obtaining current data of a workflow in a flow meter, wherein the current data comprises a plurality of workflow dimensions; performing second preprocessing on the current data to finish classification according to the dimensions of the workflow to obtain current state values of different dimensions; judging whether the current state value is larger than the historical reference value or not based on the same job flow dimension; and performing an abnormal alarm under the condition that the current state value is greater than the historical reference value.

According to an embodiment of the present disclosure, the retrieving historical data of a preset time period based on the database permission includes: based on the database authority, calling historical data of a preset time period in a target library through a unified calling interface; and analyzing the historical data of the preset time period and storing the analyzed historical data into a local library.

According to an embodiment of the present disclosure, the performing a first preprocessing on the history data to complete classification according to the job flow dimensions to obtain history reference values of different dimensions includes: calculating an average value of the historical data for the historical data of each workflow dimension; and calculating the average value of the corresponding historical data according to a preset parameter factor to obtain the historical reference value.

According to an embodiment of the present disclosure, the performing a second preprocessing on the current data to complete classification according to the dimensions of the job flow to obtain current state values of different dimensions includes: selecting current data with a successful operation state for the current data of each workflow dimension to obtain first current data; denoising the first current data to obtain second current data; and calculating an average value based on the second current data to obtain the current state value.

According to an embodiment of the present disclosure, the denoising processing on the first current data to obtain second current data includes: calculating an average value of the first current data to obtain a first average value; and based on the first average value, eliminating the data with the difference value and/or the variance value larger than a preset threshold value in the first current data to obtain the second current data.

According to an embodiment of the present disclosure, the workflow dimension includes at least: a time dimension; the time dimension includes at least: the delay start time length and the run time length.

A second aspect of the present disclosure provides an apparatus for abnormality warning, the apparatus comprising: the system comprises a historical data acquisition module, a first preprocessing module, a current data acquisition module, a second preprocessing module, a judgment module and an alarm module, wherein the historical data acquisition module is used for acquiring database permission; based on the database authority, calling historical data of a preset time period, wherein the historical data comprises a plurality of workflow dimensions; the first preprocessing module is used for performing first preprocessing on the historical data and finishing classification according to the dimensions of the job flow to obtain historical reference values of different dimensions; the current data acquisition module is used for acquiring current data of a workflow in the flow meter, wherein the current data comprises a plurality of workflow dimensions; the second preprocessing module is used for carrying out second preprocessing on the current data and finishing classification according to the dimensions of the job flow to obtain current state values of different dimensions; the judging module is used for judging whether the current state value is larger than the historical reference value or not based on the same job flow dimension; and the alarm module is used for carrying out abnormal alarm under the condition that the current state value is greater than the historical reference value.

A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the above-described method of exception alerting.

A fourth aspect of the present disclosure also provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the above-described method of anomaly alerting.

A fifth aspect of the present disclosure also provides a computer program product comprising a computer program which, when executed by a processor, implements the above-described method of anomaly alerting.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be apparent from the following description of embodiments of the disclosure, which proceeds with reference to the accompanying drawings, in which:

fig. 1 schematically shows an application scenario diagram of an abnormal alarm according to an embodiment of the present disclosure.

FIG. 2 schematically illustrates a flow chart of a method of abnormal alerting, according to an embodiment of the present disclosure.

FIG. 3 schematically illustrates a flow chart of a method of first preprocessing in an exception alert according to an embodiment of the present disclosure.

FIG. 4 schematically illustrates a flow chart of a method of first preprocessing in an exception alert according to an embodiment of the present disclosure.

FIG. 5 schematically illustrates a full flow diagram of a historical data collection method according to an embodiment of the disclosure.

Fig. 6 schematically shows a block diagram of an apparatus for abnormality warning.

Fig. 7 schematically illustrates a block diagram of an electronic device implementing a method of an anomaly alarm according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is illustrative only and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. Moreover, in the following description, descriptions of well-known structures and techniques are omitted so as to not unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It is noted that the terms used herein should be interpreted as having a meaning that is consistent with the context of this specification and should not be interpreted in an idealized or overly formal sense.

Where a convention analogous to "at least one of A, B and C, etc." is used, in general such a construction is intended in the sense one having skill in the art would understand the convention (e.g., "a system having at least one of A, B and C" would include but not be limited to systems that have a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

Before describing the technical solution of the present disclosure, technical terms in the field are explained as follows:

token: a string of characters generated at the server can be regarded as parameters required for the permission check.

SQLite 3: a lightweight relational database realizes a self-sufficient, serverless, zero-configuration and transactional SQL database engine.

API: a set of subroutine definitions, protocols and tools for building application software. Generally, this is a well-defined set of communication methods between various software components.

And (3) operation flow: the stream is formed by a plurality of operations which enter the system and are sequentially stored in an external memory for processing.

In the prior art, an abnormal alarm is often given to a batch grabbing system only when a task is unsuccessfully executed, so that the increasing requirements for fine operation and maintenance cannot be met.

The embodiment of the disclosure provides an abnormal alarm method, which comprises the following steps: acquiring database authority; based on the database authority, calling historical data of a preset time period, wherein the historical data comprises a plurality of workflow dimensions; performing first preprocessing on the historical data to finish classification according to the dimensions of the job flow to obtain historical reference values of different dimensions; obtaining current data of a workflow in a flow meter, wherein the current data comprises a plurality of workflow dimensions; performing second preprocessing on the current data to finish classification according to the dimensions of the workflow to obtain current state values of different dimensions; judging whether the current state value is larger than the historical reference value or not based on the same job flow dimension; and performing an abnormal alarm under the condition that the current state value is greater than the historical reference value. According to the embodiment of the disclosure, the historical data is extracted through the calling interface and stored in the local library, so that the repeated calling of the interface is not needed in the subsequent data processing process, the access pressure to the database in the original system is reduced as much as possible, and the stability of the associated system is ensured. Meanwhile, the historical data is used as the reference value, so that the historical reference value has higher use value, and the triggering of alarm processing is more accurate.

As shown in fig. 1, the application scenario 100 according to this embodiment may include

terminal devices

101, 102, 103, a network device 104, and a server 105. The network 104 serves as a medium for providing communication links between the

terminal devices

101, 102, 103 and the server 105. Network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, to name a few.

The user may use the

terminal devices

101, 102, 103 to interact with the server 105 via the network 104 to receive or send messages or the like. The

terminal devices

101, 102, 103 may have installed thereon various communication client applications, such as shopping-like applications, web browser applications, search-like applications, instant messaging tools, mailbox clients, social platform software, etc. (by way of example only).

The

terminal devices

101, 102, 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop portable computers, desktop computers, and the like.

The server 105 may be a server providing various services, such as a background management server (for example only) providing support for websites browsed by users using the

terminal devices

101, 102, 103. The background management server may analyze and perform other processing on the received data such as the user request, and feed back a processing result (e.g., a webpage, information, or data obtained or generated according to the user request) to the terminal device.

It should be noted that the method for providing an abnormal alarm provided by the embodiment of the present disclosure may be generally executed by the server 105. Accordingly, the system for providing an abnormal alarm provided by the embodiment of the present disclosure may be generally disposed in the server 105. The method for alarming for abnormality provided by the embodiment of the present disclosure may also be executed by a server or a server cluster which is different from the server 105 and can communicate with the

terminal devices

101, 102, 103 and/or the server 105. Accordingly, the abnormality warning system provided by the embodiment of the present disclosure may also be disposed in a server or a server cluster that is different from the server 105 and is capable of communicating with the

terminal devices

101, 102, 103 and/or the server 105.

It should be understood that the number of terminal devices, networks, and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

A method, apparatus, device, medium, and article of manufacture for exception alerting according to embodiments of the present disclosure will be described in detail with reference to fig. 2-4.

As shown in fig. 2, the embodiment provides a method for alarming an anomaly, where the method includes operation S210-operation S270, which includes the following steps:

in operation S210, a database authority is acquired;

in operation S220, based on the database authority, history data of a preset time period is called, the history data including a plurality of job flow dimensions.

According to the embodiment of the disclosure, based on the database authority, calling historical data of a preset time period in a target library through a unified calling interface; and analyzing the historical data of the preset time period and storing the analyzed historical data into a local library.

For example, the target library resides in a batch scheduling system, including an LB-Brach Job system. And the unified calling interface is stored in the local library, so that multiple data extraction operations of the target library are reduced, the data security of the target library is ensured, and the security of the current service is further maintained.

According to the embodiment of the disclosure, the preset time period comprises the time of the same business phase in the historical period. For example, when the current time is the end of year, the history data at the end of the last month of the year is extracted. For another example, if the current time is of any significance, the historical data of the last week is extracted.

According to the embodiment of the disclosure, the time period length of the preset time period is selected and can be accessed in a user-defined mode according to specific service conditions. For example, in the peak period of the individual service, if the peak period only has one or two days, only several days are selected for the time period length of the preset time period to dynamically adjust the reference threshold.

According to the embodiment of the disclosure, the historical data of the preset time period is analyzed and stored in a local library.

According to an embodiment of the present disclosure, the database permissions include at least a token.

According to the embodiment of the disclosure, when the picking of the database permission fails, the preset times are picked again, and if the database permission is not obtained, the database permission is exited.

For example, the preset number of times of re-picking is 3 times.

For example, a token value is obtained by calling a unified portal interface, then the token value is created in a local sqlite3 database, and data at the end of the last week and/or the last month is obtained through an api interface of a batch scheduling system based on the obtained token, and is analyzed and stored.

According to the embodiment of the disclosure, based on the database authority, historical data of a preset time period in a target library is called through a unified calling interface.

It is worth mentioning that, when performing batch scheduling in the prior art, a web crawler tool is usually adopted, according to an analysis web foreground calling process, relevant parameters are spliced in codes to perform background http calling, and then json data returned by a background is analyzed, stored, analyzed, displayed or called in other manners to complete a processing flow. For example, an application program call entry provided by an LB-BatchJob system is called by a python url llib2 library, and an http post/get request is sent to acquire the source data of the target. For another example, the task data access part is mostly directly connected with the scheduling system background DB in a jdbc mode.

But such data source schemas above may pose some unexpected risk to the source library.

In operation S230, a first pre-processing is performed on the history data to complete classification according to the dimensions of the job flow, so as to obtain history reference values with different dimensions.

The existing abnormal alarm only alarms the operation failure state, so that the index is too single, and the operation and maintenance personnel are not favorable for finding and processing problems.

It should be noted that, in the prior art, most of the time, for the threshold value of the abnormal alarm, a fixed reference threshold value is set according to human experience, and then the abnormal alarm is realized by comparing the fixed reference threshold value with the data during operation. However, when the magnitude of the job is large, maintaining a huge reference threshold is a time-consuming and labor-consuming task, and since some jobs depend on upstream and downstream, the fitness between the job operation rule and the fixed reference threshold is not high, that is, there is a high coupling between different job flow data. Meanwhile, the fixed reference threshold value cannot dynamically reflect the processing conditions of the workload in different service processing stages. Therefore, compared with a mode of manually setting a fixed reference threshold value and then performing abnormal alarm, the mode of acquiring historical data in a preset time period as a reference value enables the reference value obtained by the historical data to have higher use value and to be more accurate in triggering of subsequent alarm processing.

In operation S240, current data of a workflow in a flow meter is obtained, the current data including a plurality of workflow dimensions.

According to an embodiment of the present disclosure, the current data includes full-volume workflow data whose current day state is not ended.

In operation S250, a second preprocessing is performed on the current data to complete classification according to the dimensions of the job flow, so as to obtain current state values of different dimensions.

In operation S260, it is determined whether the current state value is greater than the history reference value based on the same job flow dimension.

For example, when the delay start time length of which the job flow dimension is the time dimension is long, comparison is performed based on the time length of the delay start time length, and whether the current state value is larger than the history reference value is compared. For another example, when the job flow dimension is a run-time length of the time dimension, the comparison is performed based on the run-time length. Of course, the common determination may be performed in combination with a plurality of dimensions.

In operation S270, in case that the current state value is greater than the historical reference value, an abnormal alarm is performed.

According to the embodiment of the disclosure, the abnormal alarm comprises interface output display of a result. And finally displaying the list of the entered historical treatment cases for the user to drive in to view.

According to the embodiment of the disclosure, the historical data is extracted through the calling interface and stored in the local library, so that the repeated calling of the interface is not needed in the subsequent data processing process, the access pressure to the database in the original system is reduced as much as possible, and the stability of the associated system is ensured. Meanwhile, the historical data is used as the reference value, so that the historical reference value has higher use value, and the triggering of alarm processing is more accurate.

As shown in fig. 3, the embodiment provides a method for first preprocessing in an abnormal alarm, where the method includes operations S310 to S320, and the method specifically includes the following steps:

in operation S310, for history data of each job flow dimension, an average value of the history data is calculated.

According to an embodiment of the present disclosure, data values that are too large and too small in the historical data are filtered out.

In operation S320, an average value of the corresponding history data is calculated according to a preset parameter factor, so as to obtain the history reference value.

According to the embodiment of the disclosure, the parameter factors include artificially set numerical values, and different parameter factors are selected for different implementation scenes. For example, typically, the parameter factor takes 0.8.

Specifically, the historical reference value is equal to the product of the parameter factor and the average of the historical data.

According to the embodiment of the disclosure, the scale of abnormal judgment is more flexible by setting the parameter factors

FIG. 4 schematically illustrates a flow chart of a method of second preprocessing in an exception alert according to an embodiment of the present disclosure.

As shown in fig. 4, the embodiment provides a second preprocessing method in an abnormal alarm, where the method includes operations S410 to S430, and the specific steps are as follows:

in operation S410, for the current data of each workflow dimension, the current data whose running status is successful is selected, and the first current data is obtained.

In operation S420, denoising is performed on the first current data to obtain second current data.

According to the embodiment of the disclosure, calculating an average value of the first current data to obtain a first average value; and based on the first average value, eliminating the data with the difference value and/or the variance value larger than a preset threshold value in the first current data to obtain the second current data.

For example, the preset threshold may be 0.5.

In operation S430, an average value is calculated based on the second current data, resulting in the current state value.

According to the embodiment of the disclosure, the current data is denoised, abnormal points of the data are eliminated, and the current main data is analyzed, so that false alarm and false report are avoided.

As shown in fig. 5, this embodiment provides a full flow of a historical data collection method.

In operation S51, the unified portal acquisition token is called using the configured account name and password.

In operation S52, it is determined whether the acquisition is successful.

In operation S53, yes, the local SQLite3 database is obtained.

In operation S54, it is judged whether the acquisition was successful.

In operation S55, yes, it is checked whether there is history data of the last week in the library.

In operation S56, history data is acquired through a call interface based on the token value.

In operation S57, it is determined whether the acquisition is successful.

In operation S58, yes, the history data is acquired through the call interface based on the token value.

Embodiments of the present disclosure select a lightweight SQLite3 file database in the database instead of the mysql/oracle, etc. medium and large business database. The benefit of using the SQLite3 file database is that the operating systems of typical releases are pre-installed, and the SQLite3 forgiving and easy to maintain.

Based on the above method for alarming abnormality shown in fig. 2-5, the present disclosure also provides an apparatus for alarming abnormality. The apparatus will be described in detail below with reference to fig. 6.

Fig. 6 schematically shows a block diagram of an anomaly alarm apparatus according to an embodiment of the present disclosure.

As shown in fig. 6, this embodiment provides an apparatus 600 for abnormality warning, the apparatus 600 including: a database authority acquisition module 610, a historical data acquisition module 620, a first preprocessing module 630, a current data acquisition module 640, a second preprocessing module 650, a judgment module 660 and an alarm module 670,

wherein the content of the first and second substances,

the database permission obtaining module 610 is configured to obtain a database permission;

the historical data obtaining module 620 is configured to, based on the database permission, retrieve historical data of a preset time period, where the historical data includes a plurality of workflow dimensions;

the first preprocessing module 630 is configured to perform first preprocessing on the historical data, so as to complete classification according to the dimensions of the job flow to obtain historical reference values of different dimensions;

the current data obtaining module 640 is configured to obtain current data of a workflow in a flow meter, where the current data includes multiple workflow dimensions;

the second preprocessing module 650 is configured to perform second preprocessing on the current data, so as to complete classification according to the dimensions of the job flow to obtain current state values of different dimensions;

the judging module 660 is configured to judge whether the current state value is greater than the historical reference value based on the same job flow dimension; and

the alarm module 670 is configured to perform an abnormal alarm when the current state value is greater than the historical reference value.

Fig. 7 schematically shows a block diagram of an electronic device suitable for implementing a method for extracting outline features of a video key frame image according to an embodiment of the present disclosure.

As shown in fig. 7, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701, which can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM)702 or a program loaded from a storage section 708 into a Random Access Memory (RAM) 703. The processor 701 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or associated chipset, and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), among others. The processor 701 may also include on-board memory for caching purposes. The processor 701 may comprise a single processing unit or a plurality of processing units for performing the different actions of the method flows according to embodiments of the present disclosure.

In the RAM 703, various programs and data necessary for the operation of the electronic apparatus 700 are stored. The processor 701, the ROM 702, and the RAM 703 are connected to each other by a bus 704. The processor 701 performs various operations of the method flows according to the embodiments of the present disclosure by executing programs in the ROM 702 and/or the RAM 703. It is noted that the programs may also be stored in one or more memories other than the ROM 702 and RAM 703. The processor 701 may also perform various operations of method flows according to embodiments of the present disclosure by executing programs stored in the one or more memories.

Electronic device 700 may also include input/output (I/O) interface 705, which input/output (I/O) interface 705 is also connected to bus 704, according to an embodiment of the present disclosure. The electronic device 700 may also include one or more of the following components connected to the I/O interface 705: an input portion 706 including a keyboard, a mouse, and the like; an output section 707 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage section 708 including a hard disk and the like; and a communication section 709 including a network interface card such as a LAN card, a modem, or the like. The communication section 709 performs communication processing via a network such as the internet. A drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 710 as necessary, so that a computer program read out therefrom is mounted into the storage section 708 as necessary.

The present disclosure also provides a computer-readable storage medium, which may be contained in the apparatus/device/system described in the above embodiments; or may exist separately and not be assembled into the device/apparatus/system. The computer-readable storage medium carries one or more programs which, when executed, implement the method according to an embodiment of the disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, a computer-readable storage medium may include the ROM 702 and/or the RAM 703 and/or one or more memories other than the ROM 702 and the RAM 703 described above.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the method illustrated in the flow chart. When the computer program product runs in a computer system, the program code is used for causing the computer system to realize the item recommendation method provided by the embodiment of the disclosure.

The computer program performs the above-described functions defined in the system/apparatus of the embodiments of the present disclosure when executed by the processor 701. The systems, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

In one embodiment, the computer program may be hosted on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted in the form of a signal on a network medium, distributed, downloaded and installed via the communication section 709, and/or installed from the removable medium 711. The computer program containing program code may be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

In such an embodiment, the computer program can be downloaded and installed from a network through the communication section 709, and/or installed from the removable medium 711. The computer program, when executed by the processor 701, performs the above-described functions defined in the system of the embodiment of the present disclosure. The systems, devices, apparatuses, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the present disclosure.

In accordance with embodiments of the present disclosure, program code for executing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, these computer programs may be implemented using high level procedural and/or object oriented programming languages, and/or assembly/machine languages. The programming language includes, but is not limited to, programming languages such as Java, C + +, python, the "C" language, or the like. The program code may execute entirely on the user computing device, partly on the user device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., through the internet using an internet service provider).

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that various combinations and/or combinations of features recited in the various embodiments and/or claims of the present disclosure can be made, even if such combinations or combinations are not expressly recited in the present disclosure. In particular, various combinations and/or combinations of the features recited in the various embodiments and/or claims of the present disclosure may be made without departing from the spirit or teaching of the present disclosure. All such combinations and/or associations are within the scope of the present disclosure.

The embodiments of the present disclosure have been described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described separately above, this does not mean that the measures in the embodiments cannot be used in advantageous combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be devised by those skilled in the art without departing from the scope of the present disclosure, and such alternatives and modifications are intended to be within the scope of the present disclosure.

Claims

1. A method of anomaly alerting, the method comprising:

acquiring database authority;

based on the database authority, calling historical data of a preset time period, wherein the historical data comprises a plurality of workflow dimensions;

performing first preprocessing on the historical data to finish classification according to the dimensions of the job flow to obtain historical reference values of different dimensions;

obtaining current data of a workflow in a flow meter, wherein the current data comprises a plurality of workflow dimensions;

performing second preprocessing on the current data to finish classification according to the dimensions of the workflow to obtain current state values of different dimensions;

judging whether the current state value is larger than the historical reference value or not based on the same job flow dimension; and

and performing abnormal alarm under the condition that the current state value is greater than the historical reference value.

2. The abnormal alarm method of claim 1, wherein the retrieving historical data for a preset time period based on the database authority comprises:

based on the database authority, calling historical data of a preset time period in a target library through a unified calling interface; and

and analyzing the historical data of the preset time period and storing the analyzed historical data into a local library.

3. The abnormal alarm method according to claim 1, wherein the performing of the first preprocessing on the historical data to complete classification according to the job flow dimension to obtain historical reference values of different dimensions comprises:

calculating an average value of the historical data for the historical data of each workflow dimension; and

and calculating the average value of the corresponding historical data according to a preset parameter factor to obtain the historical reference value.

4. The method for alarming abnormality according to claim 1, wherein the second preprocessing is performed on the current data to complete classification according to the job flow dimension, so as to obtain current state values of different dimensions, and the method comprises:

selecting current data with a successful operation state for the current data of each workflow dimension to obtain first current data;

denoising the first current data to obtain second current data; and

and calculating an average value based on the second current data to obtain the current state value.

5. The abnormality warning method according to claim 4, wherein said denoising the first current data to obtain second current data includes:

calculating an average value of the first current data to obtain a first average value; and

and based on the first average value, eliminating the data with the difference value and/or the variance value larger than a preset threshold value in the first current data to obtain the second current data.

6. The method according to any of claims 1-5, wherein the workflow dimensions include at least: a time dimension; the time dimension includes at least: the delay start time length and the run time length.

7. An apparatus for anomaly alerting, the apparatus comprising: a database authority acquisition module, a historical data acquisition module, a first preprocessing module, a current data acquisition module, a second preprocessing module, a judgment module and an alarm module,

wherein the content of the first and second substances,

the database permission acquisition module is used for acquiring database permission;

the historical data acquisition module is used for calling historical data of a preset time period based on the database authority, and the historical data comprises a plurality of workflow dimensions;

the first preprocessing module is used for performing first preprocessing on the historical data and finishing classification according to the dimensions of the job flow to obtain historical reference values of different dimensions;

the current data acquisition module is used for acquiring current data of a workflow in the flow meter, wherein the current data comprises a plurality of workflow dimensions;

the second preprocessing module is used for carrying out second preprocessing on the current data and finishing classification according to the dimensions of the job flow to obtain current state values of different dimensions;

the judging module is used for judging whether the current state value is larger than the historical reference value or not based on the same job flow dimension; and

and the alarm module is used for carrying out abnormal alarm under the condition that the current state value is greater than the historical reference value.

8. An electronic device, comprising:

one or more processors;

a storage device for storing one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-6.

9. A computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the method of any one of claims 1-6.

10. A computer program product comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1-6.