CN115018106A

CN115018106A - Anomaly analysis method, device, equipment and computer-readable storage medium

Info

Publication number: CN115018106A
Application number: CN202110239967.5A
Authority: CN
Inventors: 姜志刚
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2021-03-04
Filing date: 2021-03-04
Publication date: 2022-09-06

Abstract

The application provides an anomaly analysis method, an anomaly analysis device, anomaly analysis equipment and a computer-readable storage medium; the method comprises the following steps: acquiring abnormal indexes of a service to be analyzed; determining a plurality of factor indexes of abnormal indexes based on index factor disassembling rules of the service to be analyzed; respectively determining the change information of the abnormal index and each factor index in the same time range; determining at least one candidate abnormal factor index and the abnormal weight of each candidate abnormal factor index based on the abnormal index and the change information of each factor index in the time range; determining at least one abnormality factor indicator from the at least one candidate abnormality factor indicator based on an abnormality weight for the at least one candidate abnormality factor indicator; and aiming at each abnormal factor index, carrying out multi-dimensional drilling analysis on the abnormal factor index based on the dimension list to be analyzed to obtain an abnormal root factor result of the abnormal index. Through the method and the device, the accuracy and the positioning efficiency of abnormal index root cause positioning can be improved.

Description

Anomaly analysis method, device, equipment and computer readable storage medium

Technical Field

The present application relates to, but not limited to, the field of information technology, and in particular, to an anomaly analysis method, apparatus, device, and computer-readable storage medium.

Background

When analyzing the operation condition of a service, it is usually necessary to analyze the abnormal fluctuation phenomenon of each index of the service, especially the abnormal fluctuation phenomenon of a Key Performance Indicator (KPI), so as to find out the cause of the abnormal fluctuation. In the related art, the root cause positioning of the abnormal business index can be realized by carrying out multi-dimensional analysis on the abnormal business index. However, in the multidimensional analysis of abnormal indexes in the related art, whether the service indexes are abnormal in different dimensions is respectively judged, so that abnormal root causes are screened and positioned. When judging whether the service index is abnormal in each dimension, only the influence on the service in a single dimension is considered, but the incidence relation of the service in multiple dimensions is not considered, so that the accuracy of positioning of the abnormal root is not high.

Disclosure of Invention

The embodiment of the application provides an anomaly analysis method, an anomaly analysis device, an anomaly analysis equipment and a computer readable storage medium, which can improve the accuracy of root cause positioning of business anomaly indexes and greatly shorten the time of anomaly root cause positioning.

The technical scheme of the embodiment of the application is realized as follows:

the embodiment of the application provides an anomaly analysis method, which comprises the following steps:

acquiring abnormal indexes of a service to be analyzed;

determining a plurality of factor indexes of the abnormal indexes based on an index factor disassembling rule of the service to be analyzed;

respectively determining the change information of the abnormal indexes and each factor index in the same time range;

determining at least one candidate abnormal factor index and an abnormal weight of each candidate abnormal factor index based on the change information of the abnormal index in the time range and the change information of each factor index in the time range;

determining at least one abnormality factor indicator from the at least one candidate abnormality factor indicator based on an abnormality weight of the at least one candidate abnormality factor indicator;

and aiming at each abnormal factor index, carrying out multi-dimensional drilling analysis on the abnormal factor index based on a dimension list to be analyzed to obtain an abnormal root factor result of the abnormal factor index.

In some embodiments, the change information includes a change trend and a change amount, and the determining at least one candidate abnormality factor indicator and the abnormality weight of each candidate abnormality factor indicator based on the change information of the abnormality indicator in the time range and the change information of each factor indicator in the time range includes: determining at least one candidate abnormal factor index having the same variation tendency as the abnormal index from the plurality of factor indexes based on the variation tendency of the abnormal index in the time range and the variation tendency of each factor index in the time range; determining an anomaly weight for each candidate anomaly factor indicator based on the amount of change of each candidate anomaly factor indicator over the time range.

In some embodiments, the determining the abnormality weight for each candidate abnormality factor indicator based on the amount of change of each candidate abnormality factor indicator over the time range includes: summing the variation of each candidate abnormal factor index in the time range to obtain the total abnormal variation; and for each candidate abnormal factor index, determining the proportion of the variation of the candidate abnormal factor index in the time range in the total abnormal variation as the abnormal weight of the candidate abnormal factor index.

In some embodiments, the method further comprises: under the condition that the abnormal indexes are determined not to be disassembled according to the index factor disassembling rule, determining at least one associated index associated with the abnormal indexes according to the index association rule of the service to be analyzed; and determining an abnormal root cause result of the abnormal index from the at least one associated index according to the associated type of each associated index and the abnormal index and the change trend of each associated index in the time range.

In some embodiments, the abnormal root cause result includes at least one abnormal associated indicator, and the determining the abnormal root cause result of the abnormal indicator from the at least one associated indicator according to the associated type of each associated indicator and the abnormal indicator and the change trend of each associated indicator in the time range includes: for each associated index in the at least one associated index, determining the associated index as an abnormal associated index when the associated type of the associated index and the abnormal index and the variation trend of the associated index in the time range meet specific conditions; wherein the specific condition comprises one of: the association type of the association index and the abnormal index is positive association, and the change trends of the association index and the abnormal index in the time range are the same; the association type of the association index and the abnormal index is reverse association, and the change trend of the association index and the abnormal index in the time range is opposite.

In some embodiments, the abnormal root cause result includes an abnormal dimension combination and an abnormal dimension value of each abnormal dimension in the abnormal dimension combination, and the performing multidimensional drill-down analysis on the abnormal factor index based on the dimension list to be analyzed to obtain the abnormal root cause result of the abnormal factor index includes: determining at least one abnormal dimension from the dimension list based on the degree of uniformity of variation of the abnormal factor indicator in each dimension in the dimension list within the time range; for each abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the change information of the abnormal factor index in the time range under each dimension value of the abnormal dimension; and determining the abnormal dimension value of each abnormal dimension based on the abnormal weight corresponding to each dimension value in each abnormal dimension, and adding each abnormal dimension to the abnormal dimension combination.

In some embodiments, the performing multidimensional drill-down analysis on the abnormal factor indicator based on the dimension list to be analyzed to obtain an abnormal root cause result of the abnormal factor indicator further includes: determining the cumulative abnormal weight corresponding to the abnormal dimension combination; under the condition that the accumulated abnormal weight is larger than a weight threshold value, excluding each abnormal dimension from the dimension list to obtain an updated dimension list; determining at least one abnormal dimension from the dimension list based on the degree of uniformity of change of the abnormal factor indicator in the time range under each dimension in the updated dimension list; for each abnormal dimension in the at least one abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the variation information of the abnormal factor index in the time range under each dimension value of the abnormal dimension and the accumulated abnormal weight; and determining the abnormal dimension value of each abnormal dimension based on the abnormal weight corresponding to each dimension value in each abnormal dimension, and adding each abnormal dimension to the abnormal dimension combination.

An embodiment of the present application provides an anomaly analysis device, including:

the acquisition module is used for acquiring abnormal indexes of the service to be analyzed;

the first determining module is used for determining a plurality of factor indexes of the abnormal indexes based on an index factor disassembling rule of the service to be analyzed;

the second determining module is used for respectively determining the change information of the abnormal indexes and each factor index in the same time range;

a third determining module, configured to determine at least one candidate abnormal factor indicator and an abnormal weight of each candidate abnormal factor indicator based on change information of the abnormal indicator in the time range and change information of each factor indicator in the time range;

a fourth determining module, configured to determine at least one abnormality factor indicator from the at least one candidate abnormality factor indicator based on an abnormality weight of the at least one candidate abnormality factor indicator;

and the drilling analysis module is used for carrying out multi-dimensional drilling analysis on the abnormal factor indexes based on the dimension list to be analyzed aiming at each abnormal factor index to obtain the abnormal root cause result of the abnormal factor index.

In some embodiments, the change information includes a trend of change and a change amount, and the third determination module is further configured to: determining at least one candidate abnormal factor index having the same variation tendency as the abnormal index from the plurality of factor indexes based on the variation tendency of the abnormal index in the time range and the variation tendency of each factor index in the time range; determining an anomaly weight for each candidate anomaly factor indicator based on the amount of change of each candidate anomaly factor indicator over the time range.

In some embodiments, the third determination module is further to: summing the variation of each candidate abnormal factor index in the time range to obtain the total abnormal variation; and for each candidate abnormal factor index, determining the proportion of the variation of the candidate abnormal factor index in the time range in the total abnormal variation as the abnormal weight of the candidate abnormal factor index.

In some embodiments, the apparatus further comprises: a fifth determining module, configured to determine, according to the index association rule of the service to be analyzed, at least one associated index associated with the abnormal index, when it is determined that the abnormal index is not resolvable according to the index factor resolution rule; a sixth determining module, configured to determine, according to the association type of each associated indicator and the abnormal indicator and the change trend of each associated indicator in the time range, an abnormal root cause result of the abnormal indicator from the at least one associated indicator.

In some embodiments, the abnormal root cause result includes at least one abnormal association indicator, and the sixth determining module is further configured to: for each associated index in the at least one associated index, determining the associated index as an abnormal associated index when the associated type of the associated index and the abnormal index and the variation trend of the associated index in the time range meet specific conditions; wherein the specific condition comprises one of: the association type of the association index and the abnormal index is positive association, and the change trends of the association index and the abnormal index in the time range are the same; the association type of the association index and the abnormal index is reverse association, and the change trend of the association index and the change trend of the abnormal index in the time range are opposite.

In some embodiments, the abnormal root cause result includes an abnormal dimension combination and an abnormal dimension value of each abnormal dimension in the abnormal dimension combination, and the drill-down analysis module is further configured to: determining at least one abnormal dimension from the dimension list based on the degree of uniformity of variation of the abnormal factor indicator in each dimension in the dimension list within the time range; for each abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the change information of the abnormal factor index in the time range under each dimension value of the abnormal dimension; and determining the abnormal dimension value of each abnormal dimension based on the abnormal weight corresponding to each dimension value in each abnormal dimension, and adding each abnormal dimension to the abnormal dimension combination.

In some embodiments, the drill-down analysis module is further to: determining the cumulative anomaly weight corresponding to the anomaly dimension combination; under the condition that the accumulated abnormal weight is larger than a weight threshold, excluding each abnormal dimension from the dimension list to obtain an updated dimension list; determining at least one abnormal dimension from the dimension list based on the degree of uniformity of change of the abnormal factor indicator in each dimension in the updated dimension list within the time range; for each abnormal dimension in the at least one abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the change information of the abnormal factor index in the time range under each dimension value of the abnormal dimension and the accumulated abnormal weight; and determining the abnormal dimension value of each abnormal dimension based on the abnormal weight corresponding to each dimension value in each abnormal dimension, and adding each abnormal dimension to the abnormal dimension combination.

An embodiment of the present application provides an anomaly analysis device, including: a memory for storing executable instructions; and the processor is used for realizing the method provided by the embodiment of the application when executing the executable instructions stored in the memory.

Embodiments of the present application provide a computer-readable storage medium, which stores executable instructions for causing a processor to implement the method provided by the embodiments of the present application when the processor executes the executable instructions.

The embodiment of the application has the following beneficial effects:

firstly, determining a plurality of factor indexes of abnormal indexes of the service to be analyzed based on an index factor disassembling rule of the service to be analyzed, and respectively determining the abnormal indexes and the change information of each factor index in the same time range; secondly, determining at least one candidate abnormal factor index and the abnormal weight of each candidate abnormal factor index based on the change information of the abnormal index in the time range and the change information of each factor index in the time range; then, determining at least one abnormal factor index from the at least one candidate abnormal factor index based on the abnormal weight of the at least one candidate abnormal factor index; and finally, performing dimensionality drill-down analysis on each abnormal factor index to obtain an abnormal root cause result of the abnormal index. In this way, the change information of a plurality of factor indexes of the abnormal index and the abnormal weight of each candidate abnormal factor index are jointly considered during the root cause analysis, and the abnormal factor index is further subjected to multidimensional drill-down analysis, so that the accuracy of the root cause positioning of the business abnormal index can be improved. In addition, multi-dimensional drilling analysis can be automatically carried out, manual drilling investigation is not needed, at least one abnormal factor index is determined based on the abnormal weight of each candidate abnormal factor index, multi-dimensional drilling analysis is carried out on the abnormal factor index only, the scope of drilling analysis can be reduced, and time for positioning abnormal root causes can be greatly shortened.

Drawings

FIG. 1A is a schematic flow chart of a multi-dimensional root cause analysis method in the related art;

FIG. 1B is an alternative architectural diagram of an anomaly analysis system provided by embodiments of the present application;

FIG. 2 is a schematic diagram of an alternative structure of an anomaly analysis device provided in an embodiment of the present application;

FIG. 3 is a schematic flow chart diagram illustrating an alternative anomaly analysis method provided by an embodiment of the present application;

FIG. 4 is a schematic flow chart diagram illustrating an alternative anomaly analysis method provided by an embodiment of the present application;

FIG. 5 is a schematic flow chart diagram illustrating an alternative method for anomaly analysis provided by an embodiment of the present application;

FIG. 6A is a schematic flow chart diagram illustrating an alternative anomaly analysis method provided by an embodiment of the present application;

FIG. 6B is a schematic flow chart diagram illustrating an alternative anomaly analysis method provided by an embodiment of the present application;

fig. 7A is a schematic diagram of an index analysis page of a reporting system according to an embodiment of the present disclosure;

fig. 7B is a schematic view of an application scenario of an analysis module in a reporting system, which is implemented based on the anomaly analysis method provided in the embodiment of the present application;

fig. 7C is a schematic diagram of a parsing rule for parsing an advertisement revenue indicator according to an embodiment of the present application.

Detailed Description

In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be described in further detail with reference to the attached drawings, the described embodiments should not be considered as limiting the present application, and all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

In the following description, reference is made to "some embodiments" which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict.

Where similar language of "first/second" appears in the specification, the following description is added, and where reference is made to the term "first \ second \ third" merely to distinguish between similar items and not to imply a particular ordering with respect to the items, it is to be understood that "first \ second \ third" may be interchanged with a particular sequence or order as permitted, to enable the embodiments of the application described herein to be performed in an order other than that illustrated or described herein.

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of the present application only and is not intended to be limiting of the application.

Before further detailed description of the embodiments of the present application, terms and expressions referred to in the embodiments of the present application will be described, and the terms and expressions referred to in the embodiments of the present application will be used for the following explanation.

1) The following are attributed: finding out the cause of the abnormal movement;

2) abnormal contribution degree: the contribution ratio of the transaction in the subdivided scene to the overall transaction, for example, the income falls by 100w, wherein the WeChat advertisement traffic falls by 50w, and then the contribution degree is 50%.

In order to better understand the anomaly analysis method provided in the embodiments of the present application, an anomaly root cause analysis scheme in the related art is described below.

In the related art, a microsoft Adtributor system can be adopted to perform multidimensional root cause analysis on abnormal business indexes. Referring to fig. 1A, fig. 1A is a schematic diagram illustrating an implementation flow of a multidimensional root cause analysis method in the related art, where the method includes steps S11 to S14:

step S11, data collection: multidimensional time series data of the index is collected, and records comprising time stamps, indexes, dimensions, elements and the like are collected. Here, preliminary preprocessing may be performed on missing values, invalid values, and the like, to improve data quality.

Step S12, abnormality detection: and (3) predicting the indexes in real time by adopting an Auto Regression Moving Average (ARMA) time sequence model, comparing the predicted values with the real values of the indexes, and judging whether the indexes are abnormal or not. Here, the predicted value and the true value will be used for root cause analysis of the adopter system.

Step S13, root cause analysis: and (3) calculating probability P values, expected E values and standard deviation S values of all dimensions and elements of the abnormal indexes by adopting an Adtributor system, performing threshold value comparison analysis, and screening and positioning abnormal root causes. Here, the comparison analysis can be performed by using the Total factor productivity (TEP) and the Total Effective Efficiency of Production (TEEP) thresholds.

Step S14, the result is output: and outputting a multidimensional root cause analysis result, and visually feeding the result back to an operation and maintenance engineer.

In the above abnormal root cause analysis scheme in the related art, when determining whether the service index is abnormal in each dimension, only the influence on the service in a single dimension is considered, and the incidence relation of the service in multiple dimensions is not considered. However, in an actual service scenario, a complex composite index is not independently influenced by each individual dimension. Therefore, in the above-described abnormal root cause analysis scheme in the related art, the accuracy of the abnormal root cause location is not high.

The embodiment of the application provides an anomaly analysis method, an anomaly analysis device, an anomaly analysis equipment and a computer readable storage medium, which can improve the accuracy of root cause positioning of business anomaly indexes and greatly shorten the time of anomaly root cause positioning. An exemplary application of the abnormality analysis device provided in the embodiment of the present application is described below, and the abnormality analysis device provided in the embodiment of the present application may be implemented as various types of user terminals such as a notebook computer, a tablet computer, a desktop computer, a set-top box, a mobile device (for example, a mobile phone, a portable music player, a personal digital assistant, a dedicated messaging device, and a portable game device), and may also be implemented as a server. In the following, an exemplary application will be explained when the device is implemented as a server.

Referring to fig. 1B, fig. 1B is an optional schematic architecture diagram of the anomaly analysis system 100 according to the embodiment of the present application, which can perform root cause analysis on anomaly indicators of a service, where terminals (for example, a terminal 400-1 and a terminal 400-2) are connected to the server 200 through a network 300, and the network 300 may be a wide area network or a local area network, or a combination of the two.

The terminal is used for: displaying an interactive interface for analyzing the abnormal indexes of the service by the user on a graphical interface (exemplarily showing a graphical interface 410-1 and a graphical interface 410-2), receiving the abnormal indexes of the service to be analyzed input by the user, sending an abnormal analysis request to the server 200, and displaying the abnormal root cause result obtained from the server 200.

The server 200 is configured to: acquiring abnormal indexes of a service to be analyzed; determining a plurality of factor indexes of the abnormal indexes based on an index factor disassembling rule of the service to be analyzed; respectively determining the change information of the abnormal index and each factor index in the same time range; determining at least one candidate abnormal factor index and an abnormal weight of each candidate abnormal factor index based on the change information of the abnormal index in the time range and the change information of each factor index in the time range; determining at least one abnormality factor indicator from the at least one candidate abnormality factor indicator based on an abnormality weight for the at least one candidate abnormality factor indicator; and aiming at each abnormal factor index, carrying out multi-dimensional drilling analysis on the abnormal factor index based on a dimension list to be analyzed to obtain an abnormal root factor result of the abnormal factor index.

In some embodiments, the server 200 may be a standalone physical server, or may be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, web services, cloud communications, middleware services, domain name services, security services, CDNs, and big data and artificial intelligence platforms. The terminal may be, but is not limited to, a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and the like. The terminal and the server may be directly or indirectly connected through wired or wireless communication, which is not limited in the embodiment of the present invention.

In some embodiments, the server 200 may also be a node in a blockchain system, where the blockchain system may be a distributed node formed by a plurality of nodes (any form of computing device in an access network, such as a server and a user terminal) and a client, a Peer-To-Peer (P2P, Peer To Peer) network is formed between the nodes, and the P2P Protocol is an application layer Protocol running on top of a Transmission Control Protocol (TCP). In a blockchain system, any machine, such as a server, a terminal, can join to become a node.

Referring to fig. 2, fig. 2 is a schematic structural diagram of an abnormality analysis apparatus 200 according to an embodiment of the present application, where the abnormality analysis apparatus 200 shown in fig. 2 includes: at least one processor 210, memory 250, at least one network interface 220, and a user interface 230. The various components in the anomaly analysis device 200 are coupled together by a bus system 240. It is understood that the bus system 240 is used to enable communications among the components. The bus system 240 includes a power bus, a control bus, and a status signal bus in addition to a data bus. For clarity of illustration, however, the various buses are labeled as bus system 240 in fig. 2.

The Processor 210 may be an integrated circuit chip having Signal processing capabilities, such as a general purpose Processor, a Digital Signal Processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc., wherein the general purpose Processor may be a microprocessor or any conventional Processor, etc.

The user interface 230 includes one or more output devices 231, including one or more speakers and/or one or more visual display screens, that enable the presentation of media content. The user interface 230 also includes one or more input devices 232, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

The memory 250 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid state memory, hard disk drives, optical disk drives, and the like. Memory 250 optionally includes one or more storage devices physically located remote from processor 210.

The memory 250 includes volatile memory or nonvolatile memory, and can also include both volatile and nonvolatile memory. The nonvolatile Memory may be a Read Only Memory (ROM), and the volatile Memory may be a Random Access Memory (RAM). The memory 250 described in embodiments herein is intended to comprise any suitable type of memory.

In some embodiments, memory 250 is capable of storing data, examples of which include programs, modules, and data structures, or a subset or superset thereof, to support various operations, as exemplified below.

An operating system 251 including system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks;

a network communication module 252 for communicating to other computing devices via one or more (wired or wireless) network interfaces 220, exemplary network interfaces 220 including: bluetooth, wireless compatibility authentication (WiFi), and Universal Serial Bus (USB), and the like;

a presentation module 253 for enabling presentation of information (e.g., a user interface for operating peripherals and displaying content and information) via one or more output devices 231 (e.g., display screen, speakers, etc.) associated with the user interface 230;

an input processing module 254 for detecting one or more user inputs or interactions from one of the one or more input devices 232 and translating the detected inputs or interactions.

In some embodiments, the abnormality analysis apparatus provided in the embodiments of the present application may be implemented in software, and fig. 2 shows an abnormality analysis apparatus 255 stored in a memory 250, which may be software in the form of programs and plug-ins, and includes the following software modules: the obtaining module 2551, the first determining module 2552, the second determining module 2553, the third determining module 2554, the fourth determining module 2555 and the drill-down analyzing module 2556 are logical and thus may be arbitrarily combined or further divided according to the functions implemented.

The functions of the respective modules will be explained below.

In other embodiments, the anomaly analysis Device provided in the embodiments of the present Application may be implemented in hardware, and for example, the anomaly analysis Device provided in the embodiments of the present Application may be a processor in the form of a hardware decoding processor, which is programmed to execute the storage method provided in the embodiments of the present Application, for example, the processor in the form of the hardware decoding processor may be one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), Field Programmable Gate Arrays (FPGAs), or other electronic components.

The method for analyzing an anomaly provided by the embodiment of the present application will be described below with reference to an exemplary application and implementation of a terminal or a server provided by the embodiment of the present application.

Referring to fig. 3, fig. 3 is an optional flowchart of the anomaly analysis method provided in the embodiment of the present application, and will be described below with reference to the steps shown in fig. 3, where the execution subject of the following steps may be the foregoing terminal or server.

In step S101, an abnormal index of a service to be analyzed is obtained;

here, the abnormal index is an index of abnormal fluctuation occurring in the service to be analyzed, and may be obtained by automatic identification of the monitoring system, or may be input by a user after being manually found. The abnormality index may be a numerical index such as advertisement income, exposure, visit amount, or the like, or a proportional index such as conversion rate, success rate, failure rate, or the like.

In step S102, based on an index factor parsing rule of the service to be analyzed, determining multiple factor indexes of the abnormal index;

here, the index factor disassembling rule is a rule for performing factor disassembling on the index in the service to be analyzed, and may be determined in advance based on the association relationship between the indexes in the service to be analyzed. In implementation, the index factor parsing rule of the service to be analyzed may be obtained by manual combing based on expert experience, or may be automatically obtained by data mining according to the numerical relationship between indexes, which is not limited herein.

The factor index of the abnormality index is an index corresponding to a factor or an element constituting the abnormality index, and may include, but is not limited to, a multiplicative factor index, an additive factor index, and the like. By querying an index factor disassembling rule of a service to be analyzed, multiple factor indexes of an abnormal index can be determined, where the multiple factor indexes may be partial factor indexes of the abnormal index or all factor indexes of the abnormal factor index, which is not limited in the embodiment of the present application. For example, for an advertisement service, if the abnormal index is advertisement revenue, since the advertisement revenue can be determined by the product of advertisement request amount, exposure rate, filling rate and thousands of display revenue, the advertisement revenue index can be broken down into an advertisement request amount index, an exposure rate index, a filling rate index and a thousands of display revenue index, and the advertisement request amount index, the exposure rate index, the filling rate index and the thousands of display revenue index are four factor indexes of the advertisement revenue index.

In some embodiments, the factor index may be further decomposed to obtain the factor index of the factor index.

In step S103, determining variation information of the abnormality index and each of the factor indexes in the same time range respectively;

here, the time range may be input by the user or may be default. The change information of the index may include, but is not limited to, one or more of a variation amount, a variation tendency, a duration of the variation, and the like of the index. The change information of the index in the time range may be the change information of the ring ratio of the value of the index in the time range, or the change information of the value of the index in the time range relative to the value in the specific comparison time range, which is not limited herein. During implementation, the values of the abnormal index and each factor index in the same time range can be respectively obtained, and the change information of the abnormal index and each factor index in the time range is determined according to the values of the abnormal index and each factor index in the time range.

In step S104, at least one candidate abnormality factor index and an abnormality weight of each candidate abnormality factor index are determined based on the change information of the abnormality index in the time range and the change information of each factor index in the time range.

Here, the candidate abnormality factor index is a factor index that is likely to be abnormal among the plurality of factor indexes. In implementation, a person skilled in the art may determine the candidate abnormal factor index in the multiple factor indexes in an appropriate manner according to actual situations, and is not limited herein. For example, the abnormal index and the change trend of each factor index in the time range may be determined based on the abnormal index and the change information of each factor index in the time range, and the factor index having the same change trend as the abnormal index is determined as a candidate abnormal factor index, the abnormal index and the change amount of each factor index in the time range may be determined based on the abnormal index and the change information of each factor index in the time range, and the factor index having the change amount exceeding a specific threshold value may be determined as a candidate abnormal factor index, and the factor index having the similarity larger than the specific similarity threshold value may be determined as a candidate abnormal factor index by calculating the similarity between the value curve of each factor index and the value curve of the abnormal index in the time range.

The abnormal weight of the candidate abnormal factor indicator is a weight representing a contribution degree of a change of the candidate abnormal factor indicator to an overall change of the abnormal indicator, and may be a weight of a variation of the candidate abnormal factor indicator in the overall variation of the abnormal indicator, or a weight of a change rate of the candidate abnormal factor indicator in the overall change rate of the abnormal indicator, which is not limited herein.

In step S105, at least one abnormality factor index is determined from the at least one candidate abnormality factor index based on the abnormality weight of the at least one candidate abnormality factor index.

Here, according to the abnormality weight of each candidate abnormality factor index, the contribution degree of the change of each candidate abnormality factor index to the overall change of the abnormality index can be determined, so that the abnormality factor index among the candidate abnormality factor indexes can be determined. In implementation, the candidate abnormality factor index having an abnormality weight exceeding a specific weight threshold value among the at least one candidate abnormality factor index may be determined as an abnormality factor index, or a specific number of candidate abnormality factor indices having the largest abnormality weight among the candidate abnormality factor indices may be determined as abnormality factor indices.

In step S106, for each abnormal factor indicator, performing multidimensional drill-down analysis on the abnormal factor indicator based on the dimension list to be analyzed, so as to obtain an abnormal root cause result of the abnormal factor indicator.

Here, the dimension list to be analyzed includes at least one dimension that needs to be subjected to multidimensional drill-down analysis, and the dimension in the dimension list to be analyzed may be input by a user, may also be preset, and may also be automatically determined according to a service to be analyzed or an abnormal factor index, which is not limited herein. For example, for an advertisement service, the list of dimensions to be analyzed may include, but is not limited to, a traffic dimension, a platform dimension, an industry dimension, a customer dimension, and the like. In some embodiments, for each dimension, at least one dimension value may be included in the dimension, for example, for a flow dimension, dimension values such as WeChat flow and QQ flow may be included, for a platform dimension, dimension values such as an android platform, an apple operating system platform, and a Windows platform may be included, and for an industry dimension, dimension values such as a game industry, an education industry, and an e-commerce industry may be included.

The abnormal root cause result of the abnormal index may include, but is not limited to, one or more of an abnormal dimension, an abnormal dimension value, an abnormal event, and the like, which cause the abnormal index to fluctuate abnormally. In implementation, each dimension in the dimension list to be analyzed may be in the same layer or different layers during drill-down analysis, multi-dimensional layer-by-layer drill-down analysis is performed on the abnormal factor index by traversing the dimension list to be analyzed, the abnormal dimension value, the abnormal event and the like in the current layer are determined during drill-down analysis of each layer, and finally, when the drill-down analysis is completed, the abnormal dimension value, the abnormal event and the like determined in each layer can be used as the abnormal root cause result of the abnormal index.

In the embodiment of the application, firstly, a plurality of factor indexes of abnormal indexes of the service to be analyzed are determined based on an index factor disassembling rule of the service to be analyzed, and the abnormal indexes and the change information of each factor index in the same time range are respectively determined; secondly, determining at least one candidate abnormal factor index and the abnormal weight of each candidate abnormal factor index based on the change information of the abnormal index in the time range and the change information of each factor index in the time range; then, determining at least one abnormal factor index from the at least one candidate abnormal factor index based on the abnormal weight of the at least one candidate abnormal factor index; and finally, performing dimensionality drill-down analysis on each abnormal factor index to obtain an abnormal root factor result of the abnormal index. In this way, the change information of a plurality of factor indexes of the abnormal index and the abnormal weight of each candidate abnormal factor index are jointly considered during the root cause analysis, and the abnormal factor index is further subjected to multidimensional drill-down analysis, so that the accuracy of the root cause positioning of the business abnormal index can be improved. In addition, multi-dimensional drilling analysis can be automatically carried out, manual drilling investigation is not needed, at least one abnormal factor index is determined based on the abnormal weight of each candidate abnormal factor index, multi-dimensional drilling analysis is carried out on the abnormal factor index only, the scope of drilling analysis can be reduced, and time for positioning abnormal root causes can be greatly shortened.

In some embodiments, referring to fig. 4, fig. 4 is an optional flowchart of the anomaly analysis method provided in the embodiments of the present application, based on fig. 3, where the change information includes a change trend and a change amount, and step S104 may be implemented by steps S401 to S402 as follows. The following will be described with reference to each step, and the execution subject of the following steps may be the foregoing terminal or server.

In step S401, at least one candidate abnormality factor index having the same tendency as the abnormality index is determined from the plurality of factor indexes based on the tendency of change of the abnormality index in the time range and the tendency of change of each factor index in the time range.

Here, the trend of the index may include, but is not limited to, one of rising, falling, vibrating, leveling, and the like, and may further include a rate at which the index rises or falls in a time range, a frequency of the vibration, and the like. In implementation, if the abnormal index rises within the time range, the candidate abnormal factor index determined by the factor index that also rises within the same time range may be used, and if the abnormal index falls within the time range, the candidate abnormal factor index determined by the factor index that also falls within the same time range may be used. In some embodiments, fitting may be performed on the abnormal index and the value of each factor index in the same time range to obtain an abnormal index and a value curve of each factor index, and by comparing the similarity between the value curve of each factor index and the value curve of the abnormal index, it is determined whether the variation trend of each factor index and the change trend of the abnormal index in the same time range are the same, so that the factor index with the similarity smaller than a specific similarity threshold may be determined as a candidate abnormal factor index.

In step S402, an abnormality weight for each candidate abnormality factor index is determined based on the amount of change of each candidate abnormality factor index in the time range.

Here, the abnormality weight of the candidate abnormality factor index may be a weight representing a degree of contribution of the variation amount of the candidate abnormality factor index to the overall variation amount of the abnormality index. In implementation, the ratio of the variation of the candidate abnormal factor index to the overall variation of the abnormal factor index is determined as the abnormal weight of the candidate abnormal factor index, or the variation of each candidate abnormal factor index is summed to obtain the sum of the variations of each candidate abnormal factor index, and the ratio of the variation of each candidate abnormal factor index to the sum of the variations is determined as the abnormal weight of the candidate abnormal factor index.

In some embodiments, the step S402 can be implemented by the following steps S421 to S422: step S421, summing the variation of each candidate abnormal factor index in the time range to obtain the total abnormal variation; step S422, for each candidate abnormal factor indicator, determining a ratio of a variation of the candidate abnormal factor indicator in the time range to the total abnormal variation amount as an abnormal weight of the candidate abnormal factor indicator.

In the embodiment of the application, at least one candidate abnormal factor index with the same change trend as the abnormal index is determined from a plurality of factor indexes on the basis of the abnormal index and the change trend of each factor index in the same time range, and the abnormal weight of each candidate abnormal factor index is determined on the basis of the change amount of each candidate abnormal factor index in the time range. Therefore, the candidate abnormal factor indexes and the abnormal weight of each candidate abnormal factor index can be determined quickly and accurately, and the efficiency of abnormal root cause positioning can be improved.

In some embodiments, referring to fig. 5, fig. 5 is an optional flowchart of the anomaly analysis method provided in the embodiments of the present application, and based on fig. 3, the method may further perform the following steps S501 to S502. The following will be described with reference to each step, and the execution subject of the following steps may be the foregoing terminal or server.

In step S501, in a case that it is determined that the abnormal indicator is not disassemblable according to the indicator factor disassembling rule, at least one associated indicator associated with the abnormal indicator is determined according to an indicator association rule of the service to be analyzed.

Here, whether the abnormal index is disassemblable or not may be determined by matching the index factor disassemblable rule, and for the abnormal index that is not disassemblable, at least one associated index associated with the abnormal index may be determined according to the index association rule of the service to be analyzed. The index association rule of the service to be analyzed may include an association relationship between indexes in the service to be analyzed. In implementation, the index association rule of the service to be analyzed may be obtained by manual combing based on expert experience, or may be automatically obtained by data mining according to the numerical relationship between indexes, which is not limited herein.

In step S502, an abnormal root result of the abnormal indicator is determined from the at least one relevant indicator according to the type of association between each relevant indicator and the abnormal indicator and the variation trend of each relevant indicator in the time range.

Here, the association type between the association index and the abnormal index may include, but is not limited to, forward association, reverse association, and the like. The abnormal root cause result of the abnormal index is a root cause causing the abnormal index to generate abnormal fluctuation, and may include at least one related index causing the abnormal index to generate abnormal fluctuation. In implementation, according to actual conditions, the tube related index, of which the type of association with the abnormal index and the variation trend meet set conditions, in the at least one related index may be determined as the related index causing the abnormal fluctuation of the abnormal index.

In some embodiments, the abnormal root cause result includes at least one abnormal association indicator. Correspondingly, the step S502 can be implemented by the following step S521:

step S521, for each associated index of the at least one associated index, in a case that a type of association between the associated index and the abnormal index and a variation trend of the associated index in the time range satisfy a specific condition, determining the associated index as an abnormal associated index; wherein the specific condition comprises one of:

the association type of the association index and the abnormal index is positive association, and the change trends of the association index and the abnormal index in the time range are the same;

the association type of the association index and the abnormal index is reverse association, and the change trend of the association index and the abnormal index in the time range is opposite.

In the embodiment of the application, for the non-dismantlable abnormal indexes, at least one associated index associated with the abnormal indexes is determined according to the index association rule of the service to be analyzed, and the abnormal root cause result of the abnormal indexes is determined from the at least one associated index according to the association type of each associated index and the abnormal index and the change trend of each associated index. Therefore, the abnormal root cause result can be analyzed for the non-detachable abnormal index, so that the universality of the abnormal analysis method can be improved, and the accuracy of the root cause result can be further improved due to the fact that the association type of the association index and the abnormal index and the change trend of the association index are comprehensively considered when the abnormal root cause result is determined.

In some embodiments, referring to fig. 6A, fig. 6A is an optional flowchart of the anomaly analysis method provided in the embodiment of the present application, based on fig. 3, the anomaly root cause result includes an anomaly dimension combination and an anomaly dimension value of each anomaly dimension in the anomaly dimension combination, and in step S106, based on a dimension list to be analyzed, the anomaly factor index is subjected to multidimensional drill-down analysis to obtain the anomaly root cause result of the anomaly index, which may be implemented by steps S601 to S603 as follows. The following description will be made in conjunction with each step, and the execution subject of the following steps may be the foregoing terminal or server.

In step S601, determining at least one abnormal dimension from the dimension list based on the degree of uniformity of variation of the abnormal factor indicator in each dimension in the dimension list in the time range;

here, the degree of uniformity of the change of the abnormal factor indicator in a dimension in a certain time range may be a degree of uniformity of a distribution of changes of the abnormal factor indicator in values of the dimensions in the time range, and the more non-uniform the distribution of changes indicates that the value of the abnormal factor indicator is more likely to be abnormal in the dimension. In practice, the degree of uniformity of the variation may be reflected by a statistical indicator capable of representing the degree of uniformity of the distribution of variation of the abnormal factor indicator under the values of the dimensions in the time range, and may include, but is not limited to, one or more of a kini coefficient of the variation, a standard deviation of the variation, a variance, and the like.

In some embodiments, the degree of uniformity of the variation of the abnormal factor indicator in each dimension in the dimension list in the time range includes a kini coefficient of the variation of the abnormal factor indicator in each dimension value of each dimension in the dimension list in the time range. Since a larger kini coefficient indicates a more uneven distribution of changes, in implementation, at least one dimension having a largest corresponding kini coefficient may be determined as an abnormal dimension, and a dimension having a kini coefficient greater than a specific threshold of the kini coefficient may also be determined as an abnormal dimension, which is not limited herein.

In step S602, for each abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the variation information of the abnormal factor indicator in the time range under each dimension value of the abnormal dimension;

here, the abnormal weight corresponding to each dimension value of the abnormal dimension is a weight representing a contribution degree of a change of the abnormal factor index under each dimension value of the abnormal dimension to an overall change of the abnormal factor index, and may be a weight of a change amount of the abnormal factor index under each dimension value of the abnormal dimension in an overall change amount of the abnormal factor index, or a weight of a change rate of the abnormal factor index under each dimension value of the abnormal dimension in an overall change rate of the abnormal factor index, which is not limited herein. In implementation, a person skilled in the art may determine the abnormal weight corresponding to each dimension value of the abnormal dimension in a suitable manner according to actual conditions. For example, for a numerical index, the corresponding abnormal weight when dimension 1 is 1: contri (dimension 1 is value 1) is the integral variable of the variable/abnormal index corresponding to the value 1; for the proportional index, take the income display index for thousands of times as an example, the income display for thousands of times is income/exposure amount, and dimension 1 is the corresponding abnormal weight when taking value 1: contri (dimension 1 is 1) (the income corresponding to the value 1 in the current time dimension 1/the exposure corresponding to the value 1 in the current time dimension 1-the exposure corresponding to the value 1 in the income/contrast time dimension 1/the exposure corresponding to the value 1 in the contrast time dimension 1)/(the total thousand display income at the current time-the total thousand display income at the contrast time).

In step S603, an abnormal dimension value of each abnormal dimension is determined based on the abnormal weight corresponding to each dimension value in each abnormal dimension, and each abnormal dimension is added to the abnormal dimension combination.

Here, according to the anomaly weight corresponding to each dimension value in each anomaly dimension, the contribution degree of the change of the anomaly factor index under each dimension value of the anomaly dimension to the overall change of the anomaly factor index can be determined, so that the anomaly dimension value of each anomaly dimension can be determined. In implementation, the abnormal dimension value whose abnormal weight exceeds the specific weight threshold may be determined as an abnormal factor index, or a specific number of dimension values with the maximum abnormal weight in the dimension values of the abnormal dimension may be determined as abnormal dimension values, which is not limited herein.

In the embodiment of the application, at least one abnormal dimension is determined based on the variation uniformity degree of the abnormal factor index in each dimension in the dimension list, for each abnormal dimension, the abnormal weight corresponding to each dimension value of the abnormal dimension is determined based on the variation information of the abnormal factor index in each dimension value of the abnormal dimension, and the abnormal dimension value of the abnormal dimension is determined based on the abnormal weight corresponding to each dimension value. Therefore, whether the abnormal factor indexes are abnormal in all dimensions can be simply and accurately judged, and the change condition of the abnormal factor indexes in each dimension in the dimension list is comprehensively considered when the abnormal dimensions are positioned, so that the accuracy of positioning the abnormal dimensions can be effectively improved, and the accuracy of value positioning of the abnormal dimensions can be improved.

In some embodiments, referring to fig. 6B, fig. 6B is an optional schematic flow chart of the anomaly analysis method provided in the embodiment of the present application, and based on fig. 6A, in step S106, the following steps S611 to S615 may also be performed after step S603. The following will be described with reference to each step, and the execution subject of the following steps may be the foregoing terminal or server.

In step S611, determining an accumulated anomaly weight corresponding to the anomaly dimension combination;

here, the abnormal dimension combination is a combination of values of each abnormal dimension of the abnormal dimensions selected from the dimensions analyzed in the multidimensional drill-down analysis. The accumulated abnormal weight of the abnormal dimension combination can represent the weight of the change of the abnormal factor index relative to the overall change of the abnormal factor index under the condition that the abnormal dimension value of each abnormal dimension in the abnormal dimension combination is met. In implementation, a ratio between a variation of the abnormal factor index in the abnormal dimension value satisfying each abnormal dimension in the abnormal dimension combination and an overall variation of the abnormal factor index may be determined as an accumulated abnormal weight of the abnormal dimension combination, or a ratio between a variation rate of the abnormal factor index in the abnormal dimension value satisfying each abnormal dimension in the abnormal dimension combination and an overall variation rate of the abnormal factor index may be determined as an accumulated abnormal weight of the abnormal dimension combination, which is not limited herein. For example, the abnormal dimension combination includes an abnormal dimension 1and an abnormal dimension 2, where there is an abnormal dimension value 1 in the abnormal dimension 1and an abnormal dimension value 2 in the abnormal dimension 2, the cumulative abnormal weight corresponding to the abnormal dimension combination may be an occupation ratio of a variation corresponding to the abnormal factor index when the abnormal dimension 1 takes the abnormal dimension value 1and the abnormal dimension 2 takes the abnormal dimension value 2 to an overall variation of the abnormal factor index.

In step S612, under the condition that the cumulative abnormal weight is greater than the weight threshold, excluding each abnormal dimension from the dimension list to obtain an updated dimension list;

here, the weight threshold may be set by a user or may be a default, which is not limited herein.

In step S613, determining at least one abnormal dimension from the dimension list based on the degree of uniformity of change of the abnormal factor indicator in each dimension in the updated dimension list within the time range;

here, step S613 corresponds to step S601 described above, and in implementation, reference may be made to a specific embodiment of step S601 described above.

In step S614, for each abnormal dimension of the at least one abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the variation information of the abnormal factor indicator in the time range under each dimension value of the abnormal dimension and the accumulated abnormal weight;

here, in the multidimensional drilling analysis process, when each abnormal dimension is analyzed, the cumulative abnormal weight corresponding to the current abnormal dimension combination may be considered in a combined manner, and the abnormal weight corresponding to each dimension value of the current abnormal dimension may be determined. In implementation, the anomaly weight corresponding to each dimension value of the anomaly dimension may be determined by a product of a contribution degree of a change of the anomaly factor index under each dimension value of the anomaly dimension relative to an overall change of the anomaly factor index and the accumulated anomaly weight. For example, the abnormal weight corresponding to each dimension value of the abnormal dimension may be a product of a contribution degree of a variation of the abnormal factor indicator at each dimension value of the abnormal dimension in the overall variation of the abnormal factor indicator and the accumulated abnormal weight, or may be a product of a contribution degree of a variation rate of the abnormal factor indicator at each dimension value of the abnormal dimension in the overall variation rate of the abnormal factor indicator and the accumulated abnormal weight.

In step S615, an abnormal dimension value of each abnormal dimension is determined based on an abnormal weight corresponding to each dimension value in each abnormal dimension, and each abnormal dimension is added to the abnormal dimension combination.

Here, step S615 corresponds to step S603 described above, and in practice, reference may be made to a specific embodiment of step S603 described above.

In the embodiment of the application, by determining the cumulative abnormal weight corresponding to the abnormal dimension combination, under the condition that the cumulative abnormal weight is greater than the weight threshold, multi-dimensional drilling analysis is continuously performed on the abnormal factor index, for each abnormal dimension, the abnormal weight corresponding to each dimension value of the abnormal dimension is determined based on the variation information and the cumulative abnormal weight of the abnormal factor index under each dimension value of the abnormal dimension, and the abnormal dimension value of each abnormal dimension is determined based on the abnormal weight corresponding to each dimension value in each abnormal dimension. Therefore, in the process of multi-dimensional drilling analysis, when each layer of dimension is analyzed, the influence of the currently selected abnormal dimensions and the variation of the abnormal dimension value of each abnormal dimension on the index variation of the abnormal factor is considered in a combined manner, and the abnormal dimensions forming the abnormal root cause result and the abnormal dimension value of each abnormal dimension are determined step by step, so that the accuracy of abnormal dimension positioning and the accuracy of abnormal dimension value positioning can be further improved.

Next, an exemplary application of the embodiment of the present application in a practical application scenario will be described. Taking abnormal index analysis of the advertisement service as an example, in actual service, a complex comprehensive index is not independently influenced by each individual dimension, and one comprehensive index can be further decomposed into each factor index, for example, for advertisement income, the index can be decomposed into indexes such as request amount, exposure amount, thousands of display income (eCPM), and the like, so that more practical suggestions can be provided for solving the problem of reduction of the advertisement income by further analyzing the cause of abnormal change of each factor index. On the basis, the embodiment of the application provides an anomaly analysis method, and aiming at the abnormal fluctuation phenomenon of the core indexes of the advertisement service, the fluctuation reason can be found in a mode of multi-dimensional joint attribution and index association. The method can be used for realizing an analysis module of the report system, is applied to an abnormal fluctuation analysis scene of the advertising business income index in the report system, provides an abnormal analysis function of the business index for the report system, and displays the abnormal factor data obtained by analysis on an index analysis page as a part of the report.

Referring to fig. 7A, fig. 7A is a schematic diagram of an index analysis page of a reporting system provided in an embodiment of the present application, where the index analysis page 70 may include an index list area 71, a screening input area 72, and a result display area 73, a user may select a service index to be analyzed in the index list area 71, perform a dimension screening operation in the screening input area 72, screen a dimension to be analyzed, and by clicking a query button 721 in the screening input area 72, a root cause analysis result that abnormally fluctuates the selected service index in the screened dimension may be queried, and a result of the root cause analysis may be displayed in the result display area 73.

Referring to fig. 7B, fig. 7B is a schematic view of an application scenario of an analysis module in a reporting system, where the analysis module is implemented based on the anomaly analysis method provided in the embodiment of the present application, the analysis module 710 may receive an abnormal service index to be analyzed through an Nginx service access layer 720, and obtain data used for anomaly analysis, such as the formatted abnormal service index, correlation index, index factor parsing rule, factor index, from the MySQL database 740 or the drive system 750 through a query agent 730, where the data used for anomaly analysis, such as the abnormal service index, the correlation index, the index factor parsing rule, the factor index, and the like, may be data that is preprocessed by a Unified Scheduling (US) module 760 and stored in the MySQL database 740 or the drive system 750. After the data for anomaly analysis is queried by the query agent 730, the analysis module 710 performs anomaly analysis on the abnormal service index to be analyzed, and can obtain and output a root cause result of the abnormal fluctuation. In addition, the BlackBox module 770 may also call the analysis module 710 to perform abnormal business index analysis based on the stored business index analysis plan, and record the detailed information of the execution.

In implementation, the data for performing abnormal business index analysis may be determined according to an actual business scenario. For example, the analysis of advertising revenue fluctuations may be analyzed based On advertising effectiveness data and competition data, the target data may be stored in a multidimensional analysis system drive that supports On-Line Analytical Processing (OLAP), the dimensions of the target data may cover, but are not limited to, one or more of the dimensions of advertising attributes, advertiser attributes, industry attributes, placement portfolio policies, commodity attributes, in-play status, etc., and the targets may cover, but are not limited to, one or more of the basic targets of presentation, Click, consumption, Conversion, behavior, predicted Conversion Rate (pCVR), predicted Click Through Rate (pCTR), bid mean, price adjustment factor, etc. In some embodiments, the metric data may also be stored using other suitable storage systems, such as Clickhouse, Tencent's Hermes systems, and the like.

The embodiment of the application provides an anomaly analysis method, for an anomaly index of a service to be analyzed, if the anomaly index can be disassembled, a multiplication factor disassembly analysis can be performed on the anomaly index, and if the anomaly index cannot be disassembled, a positive-negative correlation analysis can be performed on the anomaly index. When the method is implemented, whether the abnormal indexes can be disassembled or not can be judged according to the set disassembling rule, and the disassembled abnormal indexes are continuously disassembled. The parsing rule may be set after analyzing the service in advance according to expert experience, and refer to fig. 7C, where fig. 7C is a schematic diagram of a parsing rule for parsing the advertising revenue index provided in this embodiment of the present application. As shown in fig. 7C, revenue in the advertisement service can be broken down into four factor indicators: the system comprises a request amount, a filling rate, an exposure rate and eCPM, wherein the request amount, the filling rate, the exposure rate and the eCPM can be further subjected to factor factorization respectively, and the factorized drilling analysis or other further customized analysis can be performed on the factorized index. For example, the request amount may be further decomposed into an initiation request amount, a request failure rate, and a traffic policy, where the initiation request amount may further perform traffic dimension drill-down analysis or event correlation analysis, and the request failure rate may further perform traffic dimension drill-down analysis or background service level agreement analysis.

For the disassembly analysis of the multiplication factors, abnormal factor indexes can be analyzed by calculating the differential contribution degree of each factor index, wherein the differential contribution degree can be the abnormal weight of the factor index; for the positive and negative correlation analysis, a simple positive and negative qualitative correlation may be used to analyze the correlation index matching the fluctuation of the abnormal index, for example, the correlation index correlating with the abnormal index in the positive direction or the negative direction may be determined by a preset positive and negative correlation rule, an index having the same fluctuation trend as the abnormal index in the correlation index correlating with the abnormal index in the positive direction may be determined as the correlation index matching the fluctuation of the abnormal index, and an index having the opposite fluctuation trend to the abnormal index in the correlation index correlating with the negative direction may be determined as the correlation index matching the fluctuation of the abnormal index.

In analyzing the revenue index, the following steps S711 to S714 may be adopted to calculate the transaction contribution of each factor index:

step S711 decomposes the revenue index into a product of a plurality of factor indexes. For example, the revenue indicator may be factored using the following equation 1-1:

revenue-request amount-exposure-fill-rate eCPM (1-1);

step S712, respectively calculating a ratio of the income indicator between the values of the time period i and the time period j, and a ratio of the product of each factor indicator between the values of the time period i and the time period j. For example, the following equations 1-2 can be used to compare the revenue index and the values of the factor indexes in the time period i and the time period j:

step S713, respectively taking logarithms of the ratio of the income indexes between the values of the time period i and the time period j and the ratio of the product of each factor index between the values of the time period i and the time period j, and converting the products of a plurality of multiplication factor indexes into the sum of a plurality of subentries. For example, the product of multiple multiplicative factor indicators may be converted to a sum of multiple subentries using equations 1-3 as follows:

step S714, if the sum of the sub-items is greater than 0, regarding each sub-item greater than 0 in the sub-items, taking the ratio of the sub-item in the sum of the sub-items greater than 0 as the variation contribution degree of the factor index corresponding to the sub-item, and taking one or more factor indexes with the highest variation contribution degree for further analysis; if the sum of the sub-items is less than 0, regarding each sub-item less than 0 in the sub-items, taking the ratio of the sub-item in the sum of the sub-items less than 0 as the variation contribution degree of the factor index corresponding to the sub-item, and taking one or more factor indexes with the highest variation contribution degree for further analysis. Here, further analysis of the factor indicators may include, but is not limited to, multidimensional drill-down analysis, indicator customization analysis, and the like.

In some embodiments, when performing multi-dimensional drill-down analysis on the factor index, each dimension in the dimension list to be analyzed may be traversed, and when performing traversal access on each dimension, the factor index may be analyzed in the currently accessed dimension based on the abnormal dimension combination determined by the previous access and the dimension value of each abnormal dimension in the abnormal dimension combination, so as to determine the current abnormal dimension combination and the abnormal dimension value of each abnormal dimension in the current abnormal dimension combination. In implementation, for the dimension d of the current traversal visit, the following steps S721 to S725 may be adopted for analysis:

step S721, a dimension analysis vector array V ═ V1, V2, … … Vn ] corresponding to each dimension value of the factor index under the dimension d is calculated, where n is the number of dimension values under the dimension d. Aiming at a dimension value i under a dimension d, a corresponding dimension analysis vector Vi is (value _ now, value _ cmp, base, diff, scale), wherein i is an integer which is more than or equal to 1and less than or equal to n; value _ now is the value of the factor index at the current time under the condition that the dimension d is the dimension value i; value _ cmp is the value of the factor index at the comparison moment under the condition that the dimension d is the dimension value i; the base is a base number corresponding to the factor index when the factor index is a proportional value, if the factor index is a proportional value, the base number is a value of an index corresponding to a denominator of the proportional value at the current moment, and the index corresponding to the denominator of the factor index can be determined according to the definition of the factor index; diff is the difference between value _ now and value _ cmp; scale is the ratio of change of value _ now to value _ cmp.

In step S722, the kini coefficients gini _ diff and gini _ scale of the diff and scale of each dimension analysis vector in the dimension analysis vector array V are calculated respectively.

In step S723, when at least one of gini _ diff and gini _ scale is greater than the corresponding threshold of the kini coefficient, the dimension d is added as the abnormal dimension candidate _ dim to the abnormal dimension combination. Since the kini coefficients gini _ diff and gini _ scale can reflect the uniformity degree of the variation distribution of the value of the factor index in the dimension d, the larger the gini _ diff and gini _ scale are, the more non-uniform the variation distribution of the value of the factor index in the dimension d is, and further the more likely the value of the factor index is abnormal in the dimension d.

Step S724 is to select the dimension value with the largest diff from the dimension values of candidate _ dim as the abnormal dimension value of candidate _ dim, where the contribution of the change of the abnormal dimension value to the overall change is diff/root _ diff. root _ diff is the overall variation of the factor index.

Step S725, if the contribution of the change of the abnormal dimension value to the overall change is lower than the threshold T, outputting the current abnormal dimension combination and the abnormal dimension value of each abnormal dimension in the current abnormal dimension combination as an attribution result, otherwise, continuing accessing the next dimension for drill-down analysis.

In some embodiments, the following steps S731 to S739 may be further adopted to perform multidimensional drill-down analysis on the factor index:

step S731, determining all analysis dimensions dims _ all;

in step S732, initializing a dimension value tree dim _ value _ tree [ ];

step S733, traversing each dimension in all analysis dimensions, and determining a selected dimension value array dims _ value _ selected in the dimension value tree;

here, each element in the dims _ value _ selected includes a currently selected dimension, a dimension value of the dimension, and an abnormal weight of the dimension value;

step S734, determining a filtering condition corresponding to the dimension value array dims _ value _ selected: filters is getFilters (dims _ value _ selected);

here, the filtering condition is a dimension value condition that matches a dimension value of each dimension in the dims _ value _ selected, for example, if dims _ value _ selected is [ [ dimension 1 is value 1, dimension 2 is value 2], the corresponding filtering condition is "dimension 1 is value 1and dimension 2 is value 2";

step S735, based on dims _ value _ selected, calculates a list of remaining candidate dimensions: dim _ left _ all-getDims (dim _ value _ selected); if dim _ left is empty, ending traversal, otherwise entering step S736; wherein getDims () is used for obtaining each currently selected dimension;

step S736, obtaining the kini coefficient corresponding to the variation of the factor index under each dimension value of each dimension in the remaining candidate dimension list, when the selected dimension value in the filtering condition is satisfied: dim _ gini _ list ═ [ (dim, getGini (dim, filters, DIFF)) for dim in dims _ left ];

step S737, the 2 dimensions with the highest kini coefficient in the remaining candidate dimension list are screened for further analysis: dim _ candidate ═ x [0] for x in topN _ GINI (dim _ GINI _ list,2) if GINI > GINI _ THRESHOLD ]; if dim _ candidate is empty, ending the traversal; otherwise, acquiring the corresponding accumulated contribution value under the current filtering condition: acc _ distribution (getacccontrol (bits _ value _ selected));

here, the accumulated contribution value under the current filtering condition is a contribution degree of the value change of the factor index relative to the overall change of the factor index under the condition that the dimension value of each dimension in the filtering condition is satisfied. For example, for the filtering condition, "dimension 1 equals to value 1and dimension 2 equals to value 2", the cumulative contribution value equals to Contri (dimension 1 equals to value 1) × (dimension 2 equals to value 2| dimension 1 equals to value 1), where Contri (dimension 1 equals to value 1) is the contribution of the change of the factor index under the dimension value 1 of dimension 1 to the overall change of the factor index, and Contri (dimension 2 equals to value 2| dimension 1 equals to value 1) is the contribution of the change of the factor index under the condition that the dimension value 1 of dimension 1and the dimension value 2 of dimension 2 to the change of the factor index under the dimension value 2 of dimension 2. In the calculation of the contribution degree, for the numerical index:

contri (dimension 1 is 1) is diff/total diff corresponding to dimension 1;

in contrast (dimension 2 is a value of 2| dimension 1 is a value of 1) | dimension 1 is a value of 1and dimension 2 is a value of 2 corresponds to diff/dimension 1 is a value of 1.

For the scale-type index, taking the eCPM index as an example, eCPM is the revenue/exposure:

contri (dimension 1 is 1) (the income corresponding to dimension 1 at the current moment/the exposure corresponding to dimension 1 at the current moment-the exposure corresponding to dimension 1 at the comparison moment-the exposure corresponding to dimension 1 at the income/the exposure corresponding to dimension 1 at the comparison moment is 1)/(total eCPM at the current moment-total eCPM at the comparison moment);

a contra (dimension 2 ═ 2| dimension 1 ═ 1) ═ exposure (with dimension 1 at the current time being value 1and dimension 2 being value 2, the corresponding revenue/current time dimension 1 being value 1and dimension 2 being value 2-exposure corresponding to-contrast time dimension 1 being value 1and dimension 2 being value 2-revenue/contrast time dimension 1 being value 1and dimension 2 being value 2)/(exposure corresponding dimension 1 at the current time being value 1-contrast time dimension 1 being total eCPM corresponding to value 1).

Step S738, obtain the dimension value with the largest transaction contribution of each dimension in dim _ candidate: a value, acc _ contribution getmostdistribution (dim) for dim in dim _ dial;

here, getmostcorribution (dim) is the maximum value of the degree of fluctuation contribution of each dimension value in the dimension dim.

Step S739, screening out the dimension value with the transaction contribution degree greater than the contribution degree threshold from dim _ value _ candidate: a value final for a value in value corrected value acc _ correction > restriction _ THRESHOLD; if dim _ value _ final is empty, ending the traversal; otherwise, updating the selected value of dims _ value _ selected + dimvalue _ final, and updating the updated dims _ value _ selected to the dimvalue _ tree.

Here, after the traversal is finished, the dimension and the dimension value selected in the dims _ value _ selected may be used as the abnormal root cause result of the factor indicator.

The beneficial effects of the anomaly analysis method provided by the embodiment of the application are described below in combination with the application in the actual service scene. For example, the revenue of the advertisement oCPX bidding model (a bidding model with conversion cost as optimization objective) on 26/9/2020 is increased by about 12% compared to the revenue of the advertisement oCPX bidding model on 19/9/2020.

By adopting the anomaly analysis method provided by the embodiment of the application to carry out root cause analysis on the index fluctuation, the following query conditions can be input:

{“interval”:“2020-09-26/2020-09-26”,“interval_cmp”:“2020-09-19/2020-09-19”,“filters”:[“is_ocpx＝1”],“metric”:“cost”}；

wherein, interval is the time to be analyzed, interval _ cmp is the comparison time, filters is the screening condition of the index to be analyzed, and metric is the index to be analyzed.

For the input query condition, the following output results can be obtained:

when the anomaly analysis of the revenue indexes of the advertisement oCPX bidding model is carried out, the running time of the method is 59 seconds, and the time for positioning the transaction can be effectively shortened. It can be seen from the above output results that the contribution degree of the average bid index to revenue improvement determined by factorization is the highest, reaching 56.769%, and therefore, the average bid index can be determined as an abnormal factor index; through carrying out multi-dimensional drill-down analysis on the average bid index, the highest contribution degree of a dimension value '104' in an optimization target dimension and a dimension value 'Li Si' in a customer dimension to income improvement is determined and reaches nearly 50%, so that the optimization target dimension and the customer dimension can be determined as abnormal dimensions, and the dimension value '104' in the optimization target dimension and the dimension value 'Li Si' in the customer dimension are determined as abnormal dimension values.

According to the anomaly analysis method provided by the embodiment of the application, the reason of the abnormal fluctuation of the index can be found in a multi-dimensional joint attribution and index association mode, the accuracy of root cause positioning can be effectively improved, the time of abnormal movement positioning can be effectively shortened, and the time consumed by hours of labor is reduced to the time consumed by minutes.

Continuing with the exemplary structure of the anomaly analysis device 255 provided in the embodiments of the present application implemented as software modules, in some embodiments, as shown in fig. 2, the software modules stored in the anomaly analysis device 255 of the memory 250 may include:

an obtaining module 2551, configured to obtain an abnormal index of a service to be analyzed;

a first determining module 2552, configured to determine multiple factor indexes of the abnormal index based on an index factor disassembling rule of the service to be analyzed;

a second determining module 2553, configured to determine change information of the abnormal indicator and each of the factor indicators in the same time range, respectively;

a third determining module 2554, configured to determine at least one candidate abnormality factor indicator and an abnormality weight of each candidate abnormality factor indicator based on the change information of the abnormality indicator in the time range and the change information of each factor indicator in the time range;

a fourth determining module 2555, configured to determine at least one abnormality factor indicator from the at least one candidate abnormality factor indicator based on an abnormality weight of the at least one candidate abnormality factor indicator;

and the drilling analysis module 2556 is configured to perform multidimensional drilling analysis on the abnormal factor indexes based on the dimension list to be analyzed to obtain abnormal root cause results of the abnormal factors.

In some embodiments, the change information includes a trend of change and a change amount, and the third determination module is further configured to: determining at least one candidate abnormal factor index having the same variation tendency as the abnormal index from the plurality of factor indexes based on the variation tendency of the abnormal index in the time range and the variation tendency of each factor index in the time range; and determining the abnormality weight of each candidate abnormality factor index based on the variation of each candidate abnormality factor index in the time range.

In some embodiments, the third determination module is further to: summing the variation of each candidate abnormal factor index in the time range to obtain the total abnormal variation; for each candidate abnormal factor index, determining the proportion of the variation of the candidate abnormal factor index in the time range in the total abnormal variation as the abnormal weight of the candidate abnormal factor index.

In some embodiments, the apparatus further comprises: a fifth determining module, configured to determine, according to the index association rule of the service to be analyzed, at least one associated index associated with the abnormal index, when it is determined that the abnormal index is not resolvable according to the index factor resolution rule; a sixth determining module, configured to determine, according to a correlation type between each correlation indicator and the abnormal indicator and a change trend of each correlation indicator in the time range, an abnormal root cause result of the abnormal indicator from the at least one correlation indicator.

In some embodiments, the abnormal root cause result includes at least one abnormal association indicator, and the sixth determining module is further configured to: for each associated index in the at least one associated index, determining the associated index as an abnormal associated index when the associated type of the associated index and the abnormal index and the variation trend of the associated index in the time range meet specific conditions; wherein the specific condition comprises one of: the correlation type of the correlation index and the abnormal index is positive correlation, and the variation trends of the correlation index and the abnormal index in the time range are the same; the association type of the association index and the abnormal index is reverse association, and the change trend of the association index and the change trend of the abnormal index in the time range are opposite.

In some embodiments, the abnormal root cause result includes an abnormal dimension combination and an abnormal dimension value of each abnormal dimension in the abnormal dimension combination, and the drill-down analysis module is further configured to: determining at least one abnormal dimension from the dimension list based on the degree of uniformity of change of the abnormal factor index in each dimension in the dimension list in the time range; for each abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the change information of the abnormal factor index in the time range under each dimension value of the abnormal dimension; and determining the abnormal dimension value of each abnormal dimension based on the abnormal weight corresponding to each dimension value in each abnormal dimension, and adding each abnormal dimension to the abnormal dimension combination.

In some embodiments, the drill-down analysis module is further to: determining the cumulative abnormal weight corresponding to the abnormal dimension combination; under the condition that the accumulated abnormal weight is larger than a weight threshold, excluding each abnormal dimension from the dimension list to obtain an updated dimension list; determining at least one abnormal dimension from the dimension list based on the degree of uniformity of change of the abnormal factor indicator in each dimension in the updated dimension list within the time range; for each abnormal dimension in the at least one abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the variation information of the abnormal factor index in the time range under each dimension value of the abnormal dimension and the accumulated abnormal weight; and determining the abnormal dimension value of each abnormal dimension based on the abnormal weight corresponding to each dimension value in each abnormal dimension, and adding each abnormal dimension to the abnormal dimension combination.

Embodiments of the present application provide a computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, so that the computer device executes the abnormality analysis method according to the embodiment of the present application.

Embodiments of the present application provide a computer-readable storage medium storing executable instructions, which when executed by a processor, will cause the processor to perform an anomaly analysis method provided by embodiments of the present application, for example, the method shown in fig. 3.

In some embodiments, the computer-readable storage medium may be memory such as FRAM, ROM, PROM, EP-ROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or may be various devices including one or any combination of the above memories.

In some embodiments, executable instructions may be written in any form of programming language (including compiled or interpreted languages), in the form of programs, software modules, scripts or code, and may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

By way of example, executable instructions may, but need not, correspond to files in a file system, and may be stored in a portion of a file that holds other programs or data, such as in one or more scripts in a hypertext Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, sub-programs, or portions of code).

By way of example, executable instructions may be deployed to be executed on one computing device or on multiple computing devices at one site or distributed across multiple sites and interconnected by a communication network.

In summary, according to the embodiments of the present application, the accuracy of root cause location of a service abnormal index can be improved, and the time for locating an abnormal root cause can be greatly shortened.

The above description is only an example of the present application, and is not intended to limit the scope of the present application. Any modification, equivalent replacement, and improvement made within the spirit and scope of the present application are included in the protection scope of the present application.

Claims

1. An abnormality analysis method, characterized by comprising:

acquiring abnormal indexes of a service to be analyzed;

determining at least one abnormality factor indicator from the at least one candidate abnormality factor indicator based on an abnormality weight for the at least one candidate abnormality factor indicator;

2. The method of claim 1, wherein the change information includes a trend of change and a quantity of change, and the determining at least one candidate anomaly factor indicator and the anomaly weight for each candidate anomaly factor indicator based on the change information of the anomaly indicator in the time range and the change information of each factor indicator in the time range comprises:

determining at least one candidate abnormal factor index having the same variation tendency as the abnormal index from the plurality of factor indexes based on the variation tendency of the abnormal index in the time range and the variation tendency of each factor index in the time range;

and determining the abnormality weight of each candidate abnormality factor index based on the variation of each candidate abnormality factor index in the time range.

3. The method of claim 2, wherein determining the anomaly weight for each candidate anomaly factor indicator based on the amount of change of each candidate anomaly factor indicator in the time range comprises:

summing the variation of each candidate abnormal factor index in the time range to obtain the total abnormal variation;

for each candidate abnormal factor index, determining the proportion of the variation of the candidate abnormal factor index in the time range in the total abnormal variation as the abnormal weight of the candidate abnormal factor index.

4. The method of claim 1, further comprising:

under the condition that the abnormal indexes are determined not to be disassembled according to the index factor disassembling rule, determining at least one associated index associated with the abnormal indexes according to the index association rule of the service to be analyzed;

and determining an abnormal root cause result of the abnormal index from the at least one associated index according to the associated type of each associated index and the abnormal index and the change trend of each associated index in the time range.

5. The method according to claim 4, wherein the abnormal root cause result comprises at least one abnormal associated index, and the determining the abnormal root cause result of the abnormal index from the at least one associated index according to the association type of each associated index with the abnormal index and the variation trend of each associated index in the time range comprises:

for each associated index in the at least one associated index, determining the associated index as an abnormal associated index when the associated type of the associated index and the abnormal index and the variation trend of the associated index in the time range meet specific conditions; wherein the specific condition comprises one of:

6. The method according to claim 1, wherein the abnormal root cause result includes an abnormal dimension combination and an abnormal dimension value of each abnormal dimension in the abnormal dimension combination, and the performing multidimensional drill-down analysis on the abnormal factor index based on the dimension list to be analyzed to obtain the abnormal root cause result of the abnormal factor index includes:

determining at least one abnormal dimension from the dimension list based on the degree of uniformity of variation of the abnormal factor indicator in each dimension in the dimension list within the time range;

for each abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the change information of the abnormal factor index in the time range under each dimension value of the abnormal dimension;

and determining the abnormal dimension value of each abnormal dimension based on the abnormal weight corresponding to each dimension value in each abnormal dimension, and adding each abnormal dimension to the abnormal dimension combination.

7. The method according to claim 6, wherein the performing multidimensional drill-down analysis on the abnormal factor indicator based on the dimension list to be analyzed to obtain an abnormal root cause result of the abnormal factor indicator further comprises:

determining the cumulative abnormal weight corresponding to the abnormal dimension combination;

under the condition that the accumulated abnormal weight is larger than a weight threshold value, excluding each abnormal dimension from the dimension list to obtain an updated dimension list;

determining at least one abnormal dimension from the dimension list based on the degree of uniformity of change of the abnormal factor indicator in the time range under each dimension in the updated dimension list;

for each abnormal dimension in the at least one abnormal dimension, determining an abnormal weight corresponding to each dimension value of the abnormal dimension based on the variation information of the abnormal factor index in the time range under each dimension value of the abnormal dimension and the accumulated abnormal weight;

8. An abnormality analysis device characterized by comprising:

9. An abnormality analysis apparatus characterized by comprising:

a memory for storing executable instructions;

a processor for implementing the method of any one of claims 1 to 7 when executing executable instructions stored in the memory.

10. A computer-readable storage medium having stored thereon executable instructions for, when executed by a processor, implementing the method of any one of claims 1 to 7.