WO2024093256A1 - 一种异常根因定位方法、装置、设备及介质 - Google Patents

一种异常根因定位方法、装置、设备及介质 Download PDF

Info

Publication number
WO2024093256A1
WO2024093256A1 PCT/CN2023/101083 CN2023101083W WO2024093256A1 WO 2024093256 A1 WO2024093256 A1 WO 2024093256A1 CN 2023101083 W CN2023101083 W CN 2023101083W WO 2024093256 A1 WO2024093256 A1 WO 2024093256A1
Authority
WO
WIPO (PCT)
Prior art keywords
abnormal
data item
sample
data
root cause
Prior art date
Application number
PCT/CN2023/101083
Other languages
English (en)
French (fr)
Inventor
蒋敏
雷霭荻
刘翔
欧阳森山
王尚超
陈琛
谭丽娟
卢浩田
邱权
孙健庭
范东皖
罗佳丽
刘翔锋
张历记
赵炜煜
Original Assignee
成都飞机工业（集团）有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 成都飞机工业（集团）有限责任公司 filed Critical 成都飞机工业（集团）有限责任公司
Publication of WO2024093256A1 publication Critical patent/WO2024093256A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0639—Performance analysis of employees; Performance analysis of enterprise or organisation operations
    • G06Q10/06393—Score-carding, benchmarking or key performance indicator [KPI] analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/02—Banking, e.g. interest calculation or account maintenance
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
    • G06Q50/06—Energy or water supply

Definitions

  • the present application relates to the field of intelligent operation and maintenance technology, and in particular to a method, device, equipment and medium for locating the root cause of an abnormality.
  • the main purpose of this application is to provide a method for locating the root cause of an abnormality, aiming to solve the technical problem that the existing abnormal indicator locating method cannot accurately locate the root cause of the abnormal indicator.
  • the present application proposes: a method for locating the root cause of an abnormality, comprising the following steps:
  • the abnormal data item obtaining an abnormal field corresponding to the abnormal data item
  • the abnormal root cause of the target system is located according to the abnormal field.
  • obtaining a data item set based on the abnormal indicator includes:
  • the abnormal indicator is a derived indicator
  • the abnormal indicator is decomposed according to the calculation rule of the abnormal indicator to obtain the data item set;
  • the abnormal indicator is taken as a data item set.
  • determining the abnormal data item according to the data fluctuation information of the data item in the data item set includes:
  • the time node when the abnormal indicator appears obtain a first sample and a second sample corresponding to each of the data items in the data item set; wherein the first sample is a set of data items corresponding to the data item within a preset time period before the time node, and the second sample is a set of data items corresponding to the data item within the time node and a preset time period after the time node;
  • An abnormal data item is determined according to the data fluctuation information of each of the first samples and each of the second samples.
  • determining the abnormal data item according to the data fluctuation information of each of the first samples and each of the second samples includes:
  • the data item is a non-abnormal data item
  • judging whether the data item is an abnormal data item according to the maximum discreteness of the first sample and the average difference of the data items of the second sample includes:
  • the data item is a non-abnormal data item
  • the data item is an abnormal data item.
  • acquiring, according to the abnormal data item, an abnormal field corresponding to the abnormal data item includes:
  • the original field of the abnormal data item is obtained
  • the calculated field is a single field
  • the calculated field is an abnormal field
  • the calculation field When the calculation field is multiple fields, obtain the third sample and the fourth sample corresponding to each of the calculation fields; wherein the third sample is the second preset time before the time node when the abnormal indicator appears.
  • the third sample is a set of fields corresponding to the calculated field within the time node and a second preset time period after the time node;
  • an abnormal field in the calculated field is determined.
  • locating the abnormal root cause of the target system according to the abnormal field includes:
  • the abnormal root cause of the target system is located according to the mapping relationship between the database corresponding to the abnormal field and the target system.
  • the present application further proposes: a device for locating the root cause of an abnormality, the device comprising:
  • a first acquisition module is used to acquire abnormal indicators of the target system
  • a second acquisition module used for obtaining a data item set based on the abnormal indicator
  • a determination module configured to determine abnormal data items according to data fluctuation information of data items in the data item set
  • a third acquisition module configured to acquire, according to the abnormal data item, an abnormal field corresponding to the abnormal data item
  • a positioning module is used to locate the abnormal root cause of the target system according to the abnormal field.
  • an electronic device comprising: at least one processor, at least one memory and computer program instructions stored in the memory, and when the computer program instructions are executed by the processor, the method as described above is implemented.
  • the present application further proposes: a storage medium having computer program instructions stored thereon, which implements the above method when the computer program instructions are executed by a processor.
  • the abnormal root cause location method described in the present application obtains abnormal indicators of the target system; obtains a data item set based on the abnormal indicators; determines abnormal data items based on data fluctuation information of data items in the data item set; obtains abnormal fields corresponding to the abnormal data items based on the abnormal data items; and locates the abnormal root cause of the target system based on the abnormal fields, thereby solving the technical problem that the existing abnormal indicator location method cannot accurately locate the root cause of the abnormal indicator.
  • the abnormal root cause location method of the present application locates abnormal data items based on data fluctuation information of data items in the data item set obtained by the abnormal indicators, and can accurately determine the abnormal data items in the data item set through the data fluctuation information, eliminates data items that are not related to the root cause of the abnormality, and narrows the scope of the abnormal root cause. It locates the abnormal fields based on the abnormal data items, which can facilitate users to analyze the causes of the abnormal root causes, take timely measures, and improve the operating efficiency of the enterprise. Finally, according to the abnormal field, the abnormal field can be located. The root cause of the abnormality is located in the segment, and the root cause of the abnormality is traced back layer by layer through abnormal indicators, which further narrows the scope of the root cause of the abnormality, thereby improving the accuracy of locating the root cause of the abnormality.
  • FIG1 is a flow chart of the abnormality root cause location method according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a process for obtaining a data item set according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a process for determining abnormal data items based on data fluctuation information according to an embodiment of the present application.
  • FIG. 4 is a schematic diagram of an abnormality root cause locating device according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of an electronic device according to an embodiment of the present application.
  • a data item may correspond to multiple fields in the database, including dimension fields and calculation fields. The dimension fields do not participate in the calculation of the indicators.
  • the calculation fields may be a single field or multiple fields. If the root cause of the abnormality is located only through the data items corresponding to the abnormal indicators, the range of the root cause of the abnormality will be expanded, reducing the accuracy of locating the root cause of the abnormality.
  • the embodiment of the present application proposes to solve the above technical problem.
  • the present application proposes: a method for locating the root cause of an abnormality, comprising the following steps:
  • the abnormal indicators of the target system are obtained.
  • the abnormal indicators refer to data abnormal points whose values exceed the preset thresholds.
  • the target system issues an alarm message.
  • the abnormal indicators can be located according to the alarm information to obtain the abnormal indicators.
  • an indicator may correspond to one or more data items, and the corresponding data item set can be obtained through the abnormal indicator.
  • the step of obtaining a data item set based on the abnormal indicator includes:
  • a derived indicator refers to an indicator that is combined based on data items, that is, one derived indicator corresponds to two or more data items.
  • the abnormal indicator can be decomposed to obtain a set of data items corresponding to the abnormal indicator, thereby avoiding the problem of locating the root cause of the abnormality due to missing data items.
  • the step of decomposing the abnormal indicator can be omitted, thereby improving the efficiency of locating the root cause of the abnormality.
  • the abnormal indicator is a derived indicator, decompose the abnormal indicator according to the calculation rule of the abnormal indicator to obtain the data item set;
  • the abnormal indicator is a derived indicator
  • the abnormal indicator is formed by the combined operation of two or more data items.
  • the abnormal indicator can be decomposed according to the calculation rule of the abnormal indicator to obtain a data item set.
  • the abnormal cause of the abnormal indicator may be caused by one or more data items in the data item set.
  • the abnormal indicator is used as a data item set.
  • the abnormal indicator is not a derived indicator, that is, the abnormal indicator is an atomic indicator, there is no need to decompose the abnormal indicator.
  • the abnormal indicator is taken as a data item set, so the acquired data item set only includes one data item, omitting the step of decomposing the abnormal indicator, thereby improving the efficiency of locating the root cause of the abnormality.
  • the abnormal data items are determined based on the data fluctuation information of each data item in the data item set, and the data items that are not related to the root cause of the abnormality are eliminated, so as to further narrow the scope of the abnormal root cause and improve the accuracy of locating the abnormal root cause.
  • the data fluctuation information can be calculated by the Pearson correlation coefficient, and a preset number of data items before and after the time node when the abnormal indicator appears are selected as data samples, and each data item and the abnormal indicator in the data sample are substituted into the Pearson correlation coefficient calculation formula for calculation to obtain the correlation between each data item in the data sample and the abnormal indicator, and the data items are sorted according to the size of the correlation, and the data item with the largest correlation is the abnormal data item, wherein the Pearson correlation coefficient is common knowledge and will not be repeated here.
  • the step of determining abnormal data items according to data fluctuation information of data items in the data item set includes:
  • the time node when the abnormal indicator appears obtain a first sample and a second sample corresponding to each of the data items in the data item set; wherein the first sample is the time node
  • the first sample is a set of data items corresponding to the data item within a preset time period before the time node
  • the second sample is a set of data items corresponding to the data item within a preset time period after the time node and the time node;
  • a time node when the abnormal indicator appears is obtained, and the time node can be obtained through the alarm information of the abnormal indicator.
  • a corresponding first sample and a second sample are obtained, wherein the first sample is a set of data items corresponding to the data item within a preset time period before the time node, and the second sample is a set of data items corresponding to the data item within a preset time period after the time node.
  • the preset time period is determined according to the target system.
  • the preset time period can be 10 minutes, one hour, one day, one week, etc.; the first sample is recorded as Tn ⁇ x 1 , x 2 ,...,x n ⁇ , and the second sample is recorded as Sn ⁇ y 1 ,y 2 ,...,y n ⁇ , wherein y 1 is the data item corresponding to the time node when the abnormal indicator appears;
  • the preset time period is determined according to the target system, when the target system is an electric power system, a banking system or other system with a large amount of data acquisition, the preset time period can be set in minutes to avoid the problem of reduced efficiency in locating the root cause of abnormalities due to too large a number of samples.
  • the preset time period can be set in hours or larger time units to avoid inaccurate data fluctuation information due to too small data samples, thereby causing errors in locating the root cause of abnormalities.
  • S32 Determine an abnormal data item according to the data fluctuation information of each of the first samples and each of the second samples.
  • data fluctuation information of the first sample and the second sample is obtained respectively. Since the second sample includes data items corresponding to the abnormal indicators, if there are abnormal data items in the second sample, there will be differences between the data fluctuation information of the second sample and the data fluctuation information of the first sample.
  • the abnormal data items in the data item set can be determined by comparing the data fluctuation information of the first sample and the second sample for each data item in the data item set.
  • the present embodiment determines the abnormal data item through the data fluctuation information of the first sample and the second sample, which can avoid the situation where the threshold setting is incorrect, and can more accurately determine the abnormal data item, thereby improving the accuracy of locating the root cause; further, by determining the abnormal data items in the data item set through the data fluctuation information, data items that are not related to the root cause of the abnormality are eliminated, thereby narrowing the scope of the abnormal root cause.
  • the step of determining an abnormal data item according to the data fluctuation information of each of the first samples and each of the second samples includes:
  • the average value of the data items of the first sample is calculated according to the following formula:
  • u1 is the average value of the data items of the first sample
  • n is the number of data items of the first sample
  • x1 is the i-th data item in the first sample, where i and n are positive integers and 1 ⁇ i ⁇ n;
  • the dispersion of the first sample is calculated according to the following formula:
  • ⁇ 1 is the discreteness of the first sample
  • ⁇ 2 is the discreteness of the second sample
  • u 1 is the average value of the data items of the first sample
  • xi is the i-th data item in the first sample
  • yi is the i-th data item in the first sample
  • the first sample discreteness can be used as an evaluation criterion for evaluating the second sample discreteness. When the first sample discreteness is greater than or equal to the second sample discreteness, it means that there is no abnormal data item in the second sample.
  • S324 When the first sample discreteness is smaller than the second sample discreteness, determine whether the data item is an abnormal data item according to the maximum discreteness of the first sample and the average difference of the data items of the second sample.
  • the first sample discreteness is smaller than the second sample discreteness, it indicates that there may be abnormal data items in the second sample, or the discreteness of each data item in the second sample is too large, but not too large to be abnormal. Therefore, it is necessary to further judge the data items included in the second sample according to the maximum discreteness of the first sample and the average difference of the data items of the second sample, so as to obtain the result of the above analysis. This avoids judging that the second sample includes abnormal data items when the discreteness of each data item in the second sample is too large, thereby improving the accuracy of locating the abnormal data items and thus improving the accuracy of locating the root cause of the abnormality.
  • the step of judging whether the data item is an abnormal data item according to the maximum discreteness of the first sample and the average difference of the data items of the second sample includes:
  • the data item is a non-abnormal data item
  • the discreteness of each data item in the first sample is first calculated, wherein the discreteness is the difference between the value of the data item and the average value of the data item. After obtaining the discreteness of each data item in the first sample, the discreteness with the largest value is obtained and recorded as the maximum discreteness. Then, the average difference of the data items of the second sample is calculated according to the following formula:
  • MD is the mean difference of the data items
  • yi is the i-th data item in the second sample
  • n is the number of data items in the second sample
  • yi is the i-th data item in the second sample
  • i and n are positive integers and 1 ⁇ i ⁇ n
  • the average difference of the data items of the second sample is greater than the maximum discreteness of the first sample, it indicates that there are abnormal data items in the second sample.
  • the second sample includes abnormal data items because the discreteness of each data item in the second sample is too large, thereby improving the accuracy of locating the abnormal data items, thereby improving the accuracy of locating the root cause of the abnormality.
  • the abnormal field corresponding to the abnormal data item in the database can be located according to the abnormal data item.
  • the scope of the root cause of the abnormality can be further narrowed.
  • locating the abnormal field can facilitate subsequent business personnel to analyze the root cause of the abnormality, improve the efficiency of business personnel in taking corresponding measures to resolve the abnormality according to the root cause of the abnormality, save manpower and material resources while improving the operating efficiency of the enterprise.
  • the step of acquiring, according to the abnormal data item, an abnormal field corresponding to the abnormal data item includes:
  • Reverse deduction is performed on the application layer based on the modeling of the abnormal data item to obtain the data warehouse detail table corresponding to the abnormal data item.
  • the source database of the abnormal data item can be obtained through the data warehouse detail table, thereby obtaining the original field;
  • the original field includes dimension fields and calculation fields.
  • the dimension fields do not participate in the calculation and thus cannot cause data anomalies. Therefore, in this step, the original field is disassembled according to the preset rules to obtain dimension fields and calculation fields. In the subsequent steps, only the calculation fields are judged to improve the efficiency of locating the root cause of the anomaly.
  • the preset rules are data cleaning processing rules.
  • the data cleaning processing rules are prior art.
  • the calculated field is a single field, the calculated field is an abnormal field;
  • the calculated field After obtaining the calculated field according to the original field, it is necessary to determine whether the calculated field is a single field or multiple fields. When the calculated field is a single field, the calculated field is an abnormal field.
  • the calculated field is a multi-field
  • a third sample and a fourth sample corresponding to each of the calculated fields are obtained; wherein the third sample is a set of fields corresponding to the calculated field within a second preset time period before the time node at which the abnormal indicator appears, and the third sample is a set of fields corresponding to the calculated field within the time node and the second preset time period after the time node.
  • the method for obtaining the third sample and the fourth sample is the same as that in step S32, and will not be repeated here;
  • S45 Determine an abnormal field in the calculated field according to the data fluctuation information of each of the third samples and each of the fourth samples.
  • step S33 After obtaining the third sample and the fourth sample of each sample, data fluctuation information of each third sample and each fourth sample is obtained according to the same method as in step S33, and the abnormal field in the multiple fields is determined according to the data fluctuation information, thereby realizing layer-by-layer tracing from abnormal indicators, abnormal data items to abnormal fields, gradually narrowing the scope of the root cause of the abnormality, and thus realizing accurate positioning of the root cause of the abnormality.
  • the step of locating the abnormal root cause of the target system according to the abnormal field includes:
  • the database and data table storing the exception field can be obtained.
  • the business module where the exception data comes from can be traced back, thereby locating the root cause of the exception and facilitating subsequent business personnel to carry out targeted solutions to business problems.
  • the abnormal root cause positioning method described in the present application obtains the abnormal index of the target system; obtains the data item set based on the abnormal index; determines the abnormal data item according to the data fluctuation information of the data item in the data item set; obtains the abnormal field corresponding to the abnormal data item according to the abnormal data item; and locates the abnormal root cause of the target system according to the abnormal field, so as to solve the technical problem that the existing abnormal index positioning method cannot accurately locate the abnormal index root cause.
  • the abnormal root cause positioning method of the present application locates the abnormal data item according to the data fluctuation information of the data item in the data item set obtained by the abnormal index, and can more accurately determine the abnormal data item in the data item set through the data fluctuation information, eliminate the data items that are not related to the root cause of the abnormality, narrow the scope of the abnormal root cause, and locate the abnormal field according to the abnormal data item, which can facilitate the user to analyze the cause of the abnormal root cause, take measures in time, and improve the operation efficiency of the enterprise. Finally, locate the abnormal root cause according to the abnormal field, and locate the abnormal root cause through the abnormal index layer by layer, further narrow the scope of the abnormal root cause, thereby improving the accuracy of locating the abnormal root cause.
  • the present application also proposes a device for locating the root cause of an abnormality, as shown in FIG4 , the device comprises:
  • a first acquisition module is used to acquire abnormal indicators of the target system
  • a second acquisition module used for obtaining a data item set based on the abnormal indicator
  • a determination module configured to determine abnormal data items according to data fluctuation information of data items in the data item set
  • a third acquisition module configured to acquire, according to the abnormal data item, an abnormal field corresponding to the abnormal data item
  • a positioning module is used to locate the abnormal root cause of the target system according to the abnormal field.
  • each module in the abnormal root cause locating device of this embodiment corresponds one-to-one to each step in the abnormal root cause locating method in the aforementioned embodiment. Therefore, the specific implementation method and technical effects achieved by this embodiment can refer to the implementation method of the aforementioned compilation method, which will not be repeated here.
  • Figure 5 shows a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention.
  • the electronic device may include at least one processor 301 , at least one memory 302 , and computer program instructions stored in the memory 302 .
  • the computer program instructions are executed by the processor 301 , the methods described in the above embodiments are implemented.
  • the processor 301 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present invention.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • Memory 302 may include a large capacity memory for data or instructions.
  • memory 302 may include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these.
  • HDD hard disk drive
  • floppy disk drive flash memory
  • an optical disk a magneto-optical disk
  • magnetic tape magnetic tape
  • USB Universal Serial Bus
  • USB Universal Serial Bus
  • memory 302 may include a removable or non-removable (or fixed) medium.
  • memory 302 may be inside or outside a data processing device.
  • memory 302 is a non-volatile solid-state memory.
  • memory 302 includes a read-only memory (ROM).
  • the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or a flash memory, or a combination of two or more of these.
  • PROM programmable ROM
  • EPROM erasable PROM
  • EEPROM electrically erasable PROM
  • EAROM electrically rewritable ROM
  • flash memory or a combination of two or more of these.
  • the processor 301 reads and executes computer program instructions stored in the memory 302 to implement any one of the abnormality root cause locating methods in the above embodiments.
  • the abnormal root cause location device may also include a communication interface and a bus. As shown in FIG5 , the processor 301, the memory 302, and the communication interface 303 are connected through a bus 310 and communicate with each other.
  • the communication interface is mainly used to realize the communication between the modules, devices, units and/or devices in the embodiment of the present invention.
  • Bus includes hardware, software or both, and the parts of electronic equipment are coupled to each other.
  • bus may include accelerated graphics port (AGP) or other graphics bus, enhanced industrial standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industrial standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations.
  • AGP accelerated graphics port
  • EISA enhanced industrial standard architecture
  • FAB front side bus
  • HT hypertransport
  • ISA industrial standard architecture
  • LPC low pin count
  • MCA micro channel architecture
  • PCI peripheral component interconnection
  • PCI-X PCI-Express
  • SATA serial advanced technology attachment
  • VLB video electronics standard association local
  • bus may include one or more buses.
  • the embodiment of the present invention can provide a computer-readable storage medium for implementation.
  • the computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by the processor, any abnormality root cause location method in the above embodiment is implemented. Root cause location method.
  • the functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware or a combination thereof.
  • it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc.
  • ASIC application specific integrated circuit
  • the elements of the present invention are programs or code segments that are used to perform the required tasks.
  • the program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave.
  • "Machine-readable medium" can include any medium capable of storing or transmitting information.
  • machine-readable media examples include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc.
  • the code segment can be downloaded via a computer network such as the Internet, an intranet, etc.
  • the exemplary embodiments mentioned in the present invention describe some methods or systems based on a series of steps or devices.
  • the present invention is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the embodiments, or in a different order from the embodiments, or several steps can be performed simultaneously.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Human Resources & Organizations (AREA)
  • Economics (AREA)
  • Strategic Management (AREA)
  • Development Economics (AREA)
  • Theoretical Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • Marketing (AREA)
  • Physics & Mathematics (AREA)
  • Tourism & Hospitality (AREA)
  • Finance (AREA)
  • Health & Medical Sciences (AREA)
  • Accounting & Taxation (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Educational Administration (AREA)
  • Game Theory and Decision Science (AREA)
  • Quality & Reliability (AREA)
  • Technology Law (AREA)
  • Operations Research (AREA)
  • Public Health (AREA)
  • Water Supply & Treatment (AREA)
  • General Health & Medical Sciences (AREA)
  • Primary Health Care (AREA)
  • Testing And Monitoring For Control Systems (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本申请公开了一种异常根因定位方法、装置、设备及介质，涉及数据处理领域，旨在解决现有异常指标定位方法无法准确的对异常指标根因进行定位的技术问题。所述异常根因定位方法，包括以下步骤：获取目标***的异常指标；基于所述异常指标，获得数据项集；根据所述数据项集中数据项的数据波动信息，确定异常数据项；根据所述异常数据项，获取所述异常数据项对应的异常字段；根据所述异常字段，对所述目标***的异常根因进行定位。本发明能够实现异常根因的自动定位，提高了异常根因定位的准确度和效率。

Description

一种异常根因定位方法、装置、设备及介质 技术领域
本申请涉及智能运维技术领域，尤其涉及一种异常根因定位方法、装置、设备及介质。
背景技术
随着数据价值的逐步体现，各行业对数据应用不断深入，将数据可视化以反映业务运行的现状、趋势等。通过指标数据变化反映当前的业务问题逐步成为了数据应用的重点之一。通过结合业务经验和历史数据可以为指标设置一个正常区间，并对指标值进行监控判断，反映指标是否有异常，或者通过统计类算法、机器学习类算法等识别异常点，针对异常数据在指标上通过颜色等方式进行标识，以提示使用者尽快发现异常指标，然而现有的异常指标定位方法无法准确的对异常指标根因进行定位，需要人工进行参与，费时费力。
发明内容
本申请的主要目的是提供一种异常根因定位方法，旨在解决现有异常指标定位方法无法准确的对异常指标根因进行定位的技术问题。
为解决上述技术问题，本申请提出了：一种异常根因定位方法，包括以下步骤：
获取目标***的异常指标；
基于所述异常指标，获得数据项集；
根据所述数据项集中数据项的数据波动信息，确定异常数据项；
根据所述异常数据项，获取所述异常数据项对应的异常字段；
根据所述异常字段，对所述目标***的异常根因进行定位。
作为本申请的一些可选实施例，所述基于所述异常指标，获得数据项集包括：
判断所述异常指标是否为衍生指标；
若所述异常指标是衍生指标，根据所述异常指标的计算规则拆解所述异常指标，得到所述数据项集；
若所述异常指标不是衍生指标，将所述异常指标作为数据项集。
作为本申请的一些可选实施例，所述根据所述数据项集中数据项的数据波动信息，确定异常数据项包括：
根据所述异常指标出现的时间节点，获取与所述数据项集中每一所述数据项对应的第一样本和第二样本；其中，所述第一样本为所述时间节点前预设时间段内与所述数据项对应的数据项集合，所述第二样本为所述时间节点以及所述时间节点后预设时间段内与所述数据项对应的数据项集合；
根据每一所述第一样本和每一所述第二样本的数据波动信息，确定异常数据项。
作为本申请的一些可选实施例，所述根据每一所述第一样本和每一所述第二样本的数据波动信息，确定异常数据项包括：
计算所述第一样本的数据项平均值；
计算所述第一样本和所述第二样本相对于所述数据项平均值的离散度，得到第一样本离散度和第二样本离散度；
当所述第一样本离散度大于等于所述第二样本离散度时，则所述数据项为非异常数据项；
当所述第一样本离散度小于所述第二样本离散度时，根据所述第一样本的最大离散度和所述第二样本的数据项平均差判断所述数据项是否为异常数据项。
作为本申请的一些可选实施例，所述当所述第一样本离散度小于所述第二样本离散度时，根据所述第一样本的最大离散度和所述第二样本的数据项平均差判断所述数据项是否为异常数据项包括：
当所述最大离散度大于等于所述数据项平均差时，所述数据项为非异常数据项；
当所述最大离散度小于所述数据项平均差时，所述数据项为异常数据项。
作为本申请的一些可选实施例，所述根据所述异常数据项，获取所述异常数据项对应的异常字段包括：
根据所述异常数据项对应的数据仓库明细表，获取所述异常数据项的原始字段；
根据预设规则分解所述原始字段，得到维度字段和计算字段；
当所述计算字段为单一字段时，则所述计算字段为异常字段；
当所述计算字段为多字段时，获取与每一所述计算字段对应的第三样本和第四样本；其中，所述第三样本为异常指标出现的时间节点前第二预设时 间段内与所述计算字段对应的字段集合，所述第三样本为所述时间节点以及所述时间节点后第二预设时间段内与所述计算字段对应的字段集合；
根据每一所述第三样本和每一所述第四样本的数据波动信息，确定所述计算字段中的异常字段。
作为本申请的一些可选实施例，所述根据所述异常字段，对所述目标***的异常根因进行定位包括：
根据所述异常字段对应的数据库与所述目标***之间的映射关系，对所述目标***的异常根因进行定位。
为解决上述技术问题，本申请还提出了：一种异常根因定位装置，所述装置包括：
第一获取模块，用于获取目标***的异常指标；
第二获取模块，用于基于所述异常指标，获得数据项集；
确定模块，用于根据所述数据项集中数据项的数据波动信息，确定异常数据项；
第三获取模块，用于根据所述异常数据项，获取所述异常数据项对应的异常字段；
定位模块，用于根据所述异常字段，对所述目标***的异常根因进行定位。
为解决上述技术问题，本申请还提出了：一种电子设备，包括：至少一个处理器、至少一个存储器以及存储在所述存储器中的计算机程序指令，当所述计算机程序指令被所述处理器执行时实现如上所述的方法。
为解决上述技术问题，本申请还提出了：一种存储介质，其上存储有计算机程序指令，当所述计算机程序指令被处理器执行时实现如上所述的方法。
综上所述，本发明的有益效果如下：
本申请所述异常根因定位方法，通过获取目标***的异常指标；基于所述异常指标，获得数据项集；根据所述数据项集中数据项的数据波动信息，确定异常数据项；根据所述异常数据项，获取所述异常数据项对应的异常字段；根据所述异常字段，对所述目标***的异常根因进行定位，解决现有异常指标定位方法无法准确的对异常指标根因进行定位的技术问题。可以看出，本申请的异常根因定位方法，根据异常指标获得的数据项集中数据项的数据波动信息，对异常数据项进行定位，通过数据波动信息能够准确的确定数据项集中的异常数据项，剔除了与导致异常的根因无关的数据项，缩小了异常根因的范围，并根据异常数据项对异常字段定位，能够方便用户对异常根因的产生原因进行分析，及时采取措施，提升企业运行效率，最后根据异常字 段对异常根因进行定位，通过异常指标层层追溯定位异常根因，进一步缩小异常根因的范围，从而提高异常根因定位的准确性。
附图说明
图1是本申请实施例所述异常根因定位方法的流程示意图。
图2是本申请实施例所述获取数据项集的流程示意图。
图3是本申请实施例所述根据数据波动信息确定异常数据项的流程示意图。
图4是本申请实施例所述异常根因定位装置的示意图。
图5是本申请实施例所述电子设备的示意图。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
现有技术中，常用的异常根因定位方法为对指标设置一个正常区间，并对指标值进行监控判断，反映指标是否有异常，或者通过统计类算法、机器学习类算法等识别异常点，针对异常指标通过颜色等方式进行标识，以提示使用者尽快发现异常指标，并通过相关业务人员对异常指标进行分析讨论从而实现异常根因的定位，或者通过异常指标对应的数据项对异常根因进行定位。虽然该技术在一定程度上解决了异常根因的定位问题，但是存在以下问题：一个数据项在数据库中可能对应多个字段，包括维度字段和计算字段，维度字段不参与指标的计算，计算字段可能是单一字段或是多字段，若仅仅通过异常指标对应的数据项对异常根因进行定位，会导致异常根因的范围变大，降低异常根因的定位准确度。
基于此，如图1所示，本申请的实施例提出了为解决上述技术问题，本申请提出了：一种异常根因定位方法，包括以下步骤：
S1、获取目标***的异常指标；
首先，获取目标***的异常指标，异常指标指的是数值超过预设阈值的数据异常点，在本实施例中，通过对所述目标***中的每一指标设置对应的阈值，当指标超过对应的阈值时，目标***则发出告警信息，根据所述告警信息即可对异常指标进行定位以获取异常指标。
S2、基于所述异常指标，获得数据项集；
具体地，在目标***，一个指标可能对应一个或者多个数据项，通过所述异常指标即可获取对应的数据项集，作为本申请的一些可选实施例，参见 图2，所述基于所述异常指标，获得数据项集的步骤，包括：
S21、判断所述异常指标是否为衍生指标；
具体地，衍生指标是指在数据项的基础上进行组合运算后的指标，即一个衍生指标对应两个或两个以上的数据项，通过判断所述异常指标是否衍生指标，当所述异常指标为衍生指标时，即可对所述异常指标进行分解，以得到所述异常指标对应的数据项集，避免由于数据项缺失导致的异常根因定位出错的问题，而当异常指标不是衍生指标时，即可省略对异常指标进行分解的步骤，提升异常根因的定位效率。
S22、若所述异常指标是衍生指标，根据所述异常指标的计算规则拆解所述异常指标，得到所述数据项集；
当所述异常指标是衍生指标时，则代表所述异常指标由两个或两个以上的数据项组合运算而成，根据异常指标的计算规则即可对异常指标进行分解，得到数据项集，异常指标的异常原因可能由数据项集中的一个或多个数据项造成，通过对异常指标进行拆解得到数据项集，能够获得所有与异常指标相关的数据项，避免由于数据项缺失导致的异常根因定位出错的问题，提高定位的准确性。
S23、若所述异常指标不是衍生指标，将所述异常指标作为数据项集。
当所述异常指标不是衍生指标，即所述异常指标为原子指标时，则无需对所述异常指标进行分解，将所述异常指标作为数据项集，故所获取的数据项集中仅包括一个数据项，省略对异常指标进行分解的步骤，提升了异常根因的定位效率。
S3、根据所述数据项集中数据项的数据波动信息，确定异常数据项；
由于所述数据项集中异常数据项可能只有一个也可能有多个，故根据所述数据项集中每一数据项的数据波动信息确定异常数据项，剔除与造成异常的根因无关的数据项，进一步缩小异常根因的范围，提高异常根因定位的准确性；在一实施例中，所述数据波动信息可通过皮尔森相关系数进行计算，通过选取异常指标出现的时间节点前和时间节点后的预设数量的数据项作为数据样本，将所述数据样本中的每一数据项和异常指标代入皮尔森相关系数计算公式进行计算，以获得数据样本中每一数据项和所述异常指标的相关性，根据相关性大小对数据项进行排序，相关性最大的数据项即为异常数据项，其中，皮尔森相关系数为公知常识，在此不再赘述。
作为本申请的一些可选实施例，参见图3，所述根据所述数据项集中数据项的数据波动信息，确定异常数据项的步骤，包括：
S31、根据所述异常指标出现的时间节点，获取与所述数据项集中每一所述数据项对应的第一样本和第二样本；其中，所述第一样本为所述时间节点 前预设时间段内与所述数据项对应的数据项集合，所述第二样本为所述时间节点以及所述时间节点后预设时间段内与所述数据项对应的数据项集合；
在本实施例中，首先获取异常指标出现的时间节点，所述时间节点可通过异常指标的告警信息获取，在获取时间节点后，针对所述数据项集的每一数据项，获取对应的第一样本和第二样本，其中，所述第一样本为所述时间节点前预设时间段内与所述数据项对应的数据项集合，所述第二样本为所述时间节点以及所述时间节点后预设时间段内与所述数据项对应的数据项集合，所述预设时间段根据所述目标***确定，举例来说而非限定，所述预设时间段可以为10分钟、一小时、一天、一周等等；将第一样本记为Tn{x1，x2,...,xn}，将第二样本记为Sn{y1,y2,...,yn}，其中，y1为所述异常指标出现的时间节点对应的数据项；
由于所述预设时间段根据所述目标***确定，当目标***的为电力***、银行***或其他数据获取量较大的***，预设时间段可以分钟为单位进行设置，避免样本数量过大而导致异常根因定位效率降低的问题，当目标***为数据获取量较小的***，即可以小时或更大的时间单位设置所述预设时间段，以避免数据样本过小导致的数据波动信息不准确，从而造成异常根因定位出错的问题。
S32、根据每一所述第一样本和每一所述第二样本的数据波动信息，确定异常数据项。
具体地，分别获取第一样本和第二样本的数据波动信息，由于第二样本包括异常指标对应的数据项，若第二样本中存在异常数据项，则第二样本的数据波动信息和第一样本的数据波动信息会存在差异，通过将数据项集中每一数据项的第一样本和第二样本的数据波动信息进行对比即可确定数据项集中的异常数据项，与现有技术中，仅根据数据项和预设阈值之间的差值获取影响因子，通过影响因子确定异常数据项的方法相比，本实施例通过第一样本和第二样本的数据波动信息确定异常数据项，能够避免阈值设置出现错误的情况，能够更加准确的确定异常数据项，从而提高根因的定位准确度；进一步的，通过数据波动信息的确定数据项集中的异常数据项，剔除了与导致异常的根因无关的数据项，缩小了异常根因的范围。
作为本申请的一些可选实施例，所述根据每一所述第一样本和每一所述第二样本的数据波动信息，确定异常数据项的步骤，包括：
S321、计算所述第一样本的数据项平均值；
具体地，所述第一样本的数据项平均值根据下列公式进行计算：
式中，u1为所述第一样本的数据项平均值，n为所述第一样本的数据项的数量，xi为所述第一样本中第i个数据项，其中i和n为正整数且1≤i≤n；
S322、计算所述第一样本和所述第二样本相对于所述数据项平均值的离散度，得到第一样本离散度和第二样本离散度；
具体地，在获得第一样本的数据项平均值后，根据下列公式计算第一样本的离散度：
同时根据下列公式计算第二样本的离散度：
式中，σ1为所述第一样本的离散度，σ2为所述第二样本的离散度，u1为所述第一样本的数据项平均值，xi为所述第一样本中第i个数据项，yi为所述第一样本中第i个数据项；
S323、当所述第一样本离散度大于等于所述第二样本离散度时，则所述数据项为非异常数据项；
由于所述第一样本的数据项不包括所述异常指标出现的时间节点对应的数据项，而第二样本包括异常指标出现的时间节点对应的数据项，故第一样本离散度可作为评价第二样本离散度的评价标准，当所述第一样本离散度大于等于所述第二样本离散度时，说明第二样本中不存在异常数据项；
S324、当所述第一样本离散度小于所述第二样本离散度时，根据所述第一样本的最大离散度和所述第二样本的数据项平均差判断所述数据项是否为异常数据项。
当所述第一样本离散度小于所述第二样本离散度时，说明所述第二样本中可能存在异常数据项，也可能是第二样本中每一数据项的离散度都偏大，但是没有大到异常的情况，故需要根据所述第一样本的最大离散度和所述第二样本的数据项平均差对所述第二样本中包括的数据项进行进一步判断，以 避免将第二样本中每一数据项的离散度都偏大的情况判断为第二样本包括异常数据项，提高了异常数据项的定位准确度，从而提高了异常根因的定位准确度。
作为本申请的一些可选实施例，所述当所述第一样本离散度小于所述第二样本离散度时，根据所述第一样本的最大离散度和所述第二样本的数据项平均差判断所述数据项是否为异常数据项的步骤，包括：
S3241、当所述最大离散度大于等于所述数据项平均差时，所述数据项为非异常数据项；
具体地，首先计算所述第一样本中每一数据项的离散度，其中，所述离散度为所述数据项的数值与所述数据项平均值的差值，在获取第一样本中每一数据项的离散度后，从中获取数值最大的离散度，记为最大离散度，随后根据下列公式计算所述第二样本的数据项平均差：
式中，MD为所述数据项平均差，yi为所述第二样本中的第i数据项，n为所述第二样本的数据项的数量，yi为所述第二样本中第i个数据项，其中i和n为正整数且1≤i≤n；
将第一样本的最大离散度与第二样本的数据项平均差进行对比，因为第一样本中每一数据项都是非异常数据项，如果第二样本的数据项平均差小于等于样第一样本的最大离散度，则表明第二样本中的数据项为非异常数据项；
S3242、当所述最大离散度小于所述数据项平均差时，所述数据项为异常数据项。
当第二样的数据项平均差大于第一样本的最大离散度，则表明第二样本中存在异常数据项，通过根据所述第一样本的最大离散度和所述第二样本的数据项平均差对所述第二样本中包括的数据项进行进一步判断，避免了将第二样本中每一数据项的离散度都偏大的情况判断为第二样本包括异常数据项，提高了异常数据项的定位准确度，从而提高了异常根因的定位准确度。
S4、根据所述异常数据项，获取所述异常数据项对应的异常字段；
具体地，在完成异常数据项的定位后，根据异常数据项即可对数据库中异常数据项对应的异常字段进行定位，通过对异常字段进行定位，能够进一步缩小异常根因的范围，相比于根据数据项对异常根因进行定位，对异常字段进行定位的方式能够方便后续业务人员对异常根因进行分析，提高业务人员针对异常根因采取相应措施解决异常的效率，节省了人力物力的同时提高了企业运行效率。
作为本申请的一些可选实施例，所述根据所述异常数据项，获取所述异常数据项对应的异常字段的步骤，包括：
S41、根据所述异常数据项对应的数据仓库明细表，获取所述异常数据项的原始字段；
基于异常数据项建模的应用层进行逆向推导，以得到异常数据项对应的数据仓库明细表，通过所述数据仓库明细表即可得到异常数据项的来源数据库，从而获得原始字段；
S42、根据预设规则分解所述原始字段，得到维度字段和计算字段；
原始字段包括维度字段和计算字段，维度字段并不参与计算从而无法引起数据的异常，故在本步骤中，根据预设规则对所述原始字段进行拆解，得到维度字段和计算字段，在后续步骤中仅对计算字段进行判断，以提升异常根因的定位效率；在本实施例中，所述预设规则为数据清洗处理规则，数据清洗处理规则为现有技术，通过将原始字段拆分为维度字段和计算字段，不仅能够提高根因定位的效率，还能够进一步缩小异常根因的范围，提高异常根因定位的准确度。
S43、当所述计算字段为单一字段时，则所述计算字段为异常字段；
在根据原始字段获得计算字段后，需要判断所述计算字段是单一字段还是多字段，当所述计算字段为单一字段时，则所述计算字段为异常字段；
S44、当所述计算字段为多字段时，获取与每一所述计算字段对应的第三样本和第四样本；其中，所述第三样本为异常指标出现的时间节点前第二预设时间段内与所述计算字段对应的字段集合，所述第三样本为所述时间节点以及所述时间节点后第二预设时间段内与所述计算字段对应的字段集合；
当所述计算字段为多字段时，则获取与每一所述计算字段对应的第三样本和第四样本；其中，所述第三样本为异常指标出现的时间节点前第二预设时间段内与所述计算字段对应的字段集合，所述第三样本为所述时间节点以及所述时间节点后第二预设时间段内与所述计算字段对应的字段集合，第三样本和第四样本的获取方法与步骤S32中相同，在此不再赘述；
S45、根据每一所述第三样本和每一所述第四样本的数据波动信息，确定所述计算字段中的异常字段。
在获取每一样本所述第三样本和第四样本和，根据与步骤S33中一样的方法，获取每一第三样本和每一第四样本的数据波动信息，根据所述数据波动信息确定所述多字段中的异常字段，实现了从异常指标、异常数据项到异常字段的层层追溯，逐渐缩小异常根因的范围，从而实现异常根因的准确定位。
S5、根据所述异常字段，对所述目标***的异常根因进行定位。
作为本申请的一些可选实施例，所述根据所述异常字段，对所述目标***的异常根因进行定位的步骤，包括：
S51、根据所述异常字段对应的数据库与所述目标***之间的映射关系，对所述目标***的异常根因进行定位。
具体地，基于异常字段可获取存储所述异常字段的数据库和数据表格，基于目标***中对应的数据库和数据表格与业务模块之间的映射关系，即可追溯到异常数据来源的业务模块，从而实现异常根因的定位，方便后续业务员人进行业务问题的针对性解决。
综上所述，本发明的有益效果如下：
本申请所述异常根因定位方法，通过获取目标***的异常指标；基于所述异常指标，获得数据项集；根据所述数据项集中数据项的数据波动信息，确定异常数据项；根据所述异常数据项，获取所述异常数据项对应的异常字段；根据所述异常字段，对所述目标***的异常根因进行定位，解决现有异常指标定位方法无法准确的对异常指标根因进行定位的技术问题。可以看出，本申请的异常根因定位方法，根据异常指标获得的数据项集中数据项的数据波动信息，对异常数据项进行定位，通过数据波动信息能够更加准确的确定数据项集中的异常数据项，剔除了与导致异常的根因无关的数据项，缩小了异常根因的范围，并根据异常数据项对异常字段定位，能够方便用户对异常根因的产生原因进行分析，及时采取措施，提升企业运行效率，最后根据异常字段对异常根因进行定位，通过异常指标层层追溯定位异常根因，进一步缩小异常根因的范围，从而提高异常根因定位的准确性。
为解决上述技术问题，本申请还提出了一种异常根因定位装置，参见图4，所述装置包括：
第一获取模块，用于获取目标***的异常指标；
第二获取模块，用于基于所述异常指标，获得数据项集；
确定模块，用于根据所述数据项集中数据项的数据波动信息，确定异常数据项；
第三获取模块，用于根据所述异常数据项，获取所述异常数据项对应的异常字段；
定位模块，用于根据所述异常字段，对所述目标***的异常根因进行定位。
需要说明的是，本实施例异常根因定位装置中各模块是与前述实施例中异常根因定位方法中的各步骤一一对应，因此，本实施例的具体实施方式和达到的技术效果可参照前述编制方法的实施方式，这里不再赘述。
另外，结合图1描述的本发明实施例的一种异常根因定位方法可以由电子设备来实现。图5示出了本发明实施例提供的电子设备的硬件结构示意图。
电子设备可以包括至少一个处理器301、至少一个存储器302以及存储在所示存储器302中的计算机程序指令，当所述计算机程序指令被所述处理器301执行时实现上述实施例所述的方法。
具体地，上述处理器301可以包括中央处理器(CPU)，或者特定集成电路(Application Specific Integrated Circuit，ASIC)，或者可以被配置成实施本发明实施例的一个或多个集成电路。
存储器302可以包括用于数据或指令的大容量存储器。举例来说而非限制，存储器302可包括硬盘驱动器(Hard Disk Drive，HDD)、软盘驱动器、闪存、光盘、磁光盘、磁带或通用串行总线(Universal Serial Bus，USB)驱动器或者两个或更多个以上这些的组合。在合适的情况下，存储器302可包括可移除或不可移除(或固定)的介质。在合适的情况下，存储器302可在数据处理装置的内部或外部。在特定实施例中，存储器302是非易失性固态存储器。在特定实施例中，存储器302包括只读存储器(ROM)。在合适的情况下，该ROM可以是掩模编程的ROM、可编程ROM(PROM)、可擦除PROM(EPROM)、电可擦除PROM(EEPROM)、电可改写ROM(EAROM)或闪存或者两个或更多个以上这些的组合。
处理器301通过读取并执行存储器302中存储的计算机程序指令，以实现上述实施例中的任意一种异常根因定位方法。
在一个示例中，基于异常根因定位设备还可包括通信接口和总线。其中，如图5所示，处理器301、存储器302、通信接口303通过总线310连接并完成相互间的通信。通信接口，主要用于实现本发明实施例中各模块、装置、单元和/或设备之间的通信。
总线包括硬件、软件或两者，将电子设备的部件彼此耦接在一起。举例来说而非限制，总线可包括加速图形端口(AGP)或其他图形总线、增强工业标准架构(EISA)总线、前端总线(FSB)、超传输(HT)互连、工业标准架构(ISA)总线、无限带宽互连、低引脚数(LPC)总线、存储器总线、微信道架构(MCA)总线、***组件互连(PCI)总线、PCI-Express(PCI-X)总线、串行高级技术附件(SATA)总线、视频电子标准协会局部(VLB)总线或其他合适的总线或者两个或更多个以上这些的组合。在合适的情况下，总线可包括一个或多个总线。尽管本发明实施例描述和示出了特定的总线，但本发明考虑任何合适的总线或互连。
另外，结合上述实施例中的异常根因定位方法，本发明实施例可提供一种计算机可读存储介质来实现。该计算机可读存储介质上存储有计算机程序指令；该计算机程序指令被处理器执行时实现上述实施例中的任意一种异常 根因定位方法。
需要明确的是，本发明并不局限于上文所描述并在图中示出的特定配置和处理。为了简明起见，这里省略了对已知方法的详细描述。在上述实施例中，描述和示出了若干具体的步骤作为示例。但是，本发明的方法过程并不限于所描述和示出的具体步骤，本领域的技术人员可以在领会本发明的精神后，作出各种改变、修改和添加，或者改变步骤之间的顺序。
以上所述的结构框图中所示的功能块可以实现为硬件、软件、固件或者它们的组合。当以硬件方式实现时，其可以例如是电子电路、专用集成电路(ASIC)、适当的固件、插件、功能卡等等。当以软件方式实现时，本发明的元素是被用于执行所需任务的程序或者代码段。程序或者代码段可以存储在机器可读介质中，或者通过载波中携带的数据信号在传输介质或者通信链路上传送。“机器可读介质”可以包括能够存储或传输信息的任何介质。机器可读介质的例子包括电子电路、半导体存储器设备、ROM、闪存、可擦除ROM(EROM)、软盘、CD-ROM、光盘、硬盘、光纤介质、射频(RF)链路，等等。代码段可以经由诸如因特网、内联网等的计算机网络被下载。
还需要说明的是，本发明中提及的示例性实施例，基于一系列的步骤或者装置描述一些方法或***。但是，本发明不局限于上述步骤的顺序，也就是说，可以按照实施例中提及的顺序执行步骤，也可以不同于实施例中的顺序，或者若干步骤同时执行。
以上所述，仅为本发明的具体实施方式，所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的***、模块和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。应理解，本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本发明的保护范围之内。

Claims (10)

  1. 一种异常根因定位方法，其特征在于，包括以下步骤：
    获取目标***的异常指标；
    基于所述异常指标，获得数据项集；
    根据所述数据项集中数据项的数据波动信息，确定异常数据项；
    根据所述异常数据项，获取所述异常数据项对应的异常字段；
    根据所述异常字段，对所述目标***的异常根因进行定位。
  2. 根据权利要求1所述的异常根因定位方法，其特征在于，所述基于所述异常指标，获得数据项集包括：
    判断所述异常指标是否为衍生指标；
    若所述异常指标是衍生指标，根据所述异常指标的计算规则拆解所述异常指标，得到所述数据项集；
    若所述异常指标不是衍生指标，将所述异常指标作为数据项集。
  3. 根据权利要求1所述的异常根因定位方法，其特征在于，所述根据所述数据项集中数据项的数据波动信息，确定异常数据项包括：
    根据所述异常指标出现的时间节点，获取与所述数据项集中每一所述数据项对应的第一样本和第二样本；其中，所述第一样本为所述时间节点前预设时间段内与所述数据项对应的数据项集合，所述第二样本为所述时间节点以及所述时间节点后预设时间段内与所述数据项对应的数据项集合；
    根据每一所述第一样本和每一所述第二样本的数据波动信息，确定异常数据项。
  4. 根据权利要求3所述的异常根因定位方法，其特征在于，所述根据每一所述第一样本和每一所述第二样本的数据波动信息，确定异常数据项包括：
    计算所述第一样本的数据项平均值；
    计算所述第一样本和所述第二样本相对于所述数据项平均值的离散度，得到第一样本离散度和第二样本离散度；
    当所述第一样本离散度大于等于所述第二样本离散度时，则所述数据项为非异常数据项；
    当所述第一样本离散度小于所述第二样本离散度时，根据所述第一样本 的最大离散度和所述第二样本的数据项平均差判断所述数据项是否为异常数据项。
  5. 根据权利要求4所述的异常根因定位方法，其特征在于，所述当所述第一样本离散度小于所述第二样本离散度时，根据所述第一样本的最大离散度和所述第二样本的数据项平均差判断所述数据项是否为异常数据项包括：
    当所述最大离散度大于等于所述数据项平均差时，所述数据项为非异常数据项；
    当所述最大离散度小于所述数据项平均差时，所述数据项为异常数据项。
  6. 根据权利要求1所述的异常根因定位方法，其特征在于，所述根据所述异常数据项，获取所述异常数据项对应的异常字段包括：
    根据所述异常数据项对应的数据仓库明细表，获取所述异常数据项的原始字段；
    根据预设规则分解所述原始字段，得到维度字段和计算字段；
    当所述计算字段为单一字段时，则所述计算字段为异常字段；
    当所述计算字段为多字段时，获取与每一所述计算字段对应的第三样本和第四样本；其中，所述第三样本为异常指标出现的时间节点前第二预设时间段内与所述计算字段对应的字段集合，所述第三样本为所述时间节点以及所述时间节点后第二预设时间段内与所述计算字段对应的字段集合；
    根据每一所述第三样本和每一所述第四样本的数据波动信息，确定所述计算字段中的异常字段。
  7. 根据权利要求1所述的异常根因定位方法，其特征在于，所述根据所述异常字段，对所述目标***的异常根因进行定位包括：
    根据所述异常字段对应的数据库与所述目标***之间的映射关系，对所述目标***的异常根因进行定位。
  8. 一种异常根因定位装置，其特征在于，所述装置包括：
    第一获取模块，用于获取目标***的异常指标；
    第二获取模块，用于基于所述异常指标，获得数据项集；
    确定模块，用于根据所述数据项集中数据项的数据波动信息，确定异常数据项；
    第三获取模块，用于根据所述异常数据项，获取所述异常数据项对应的异常字段；
    定位模块，用于根据所述异常字段，对所述目标***的异常根因进行定位。
  9. 一种电子设备，其特征在于，包括：至少一个处理器、至少一个存储器以及存储在所述存储器中的计算机程序指令，当所述计算机程序指令被所述处理器执行时实现如权利要求1-7中任一项所述的方法。
  10. 一种存储介质，其上存储有计算机程序指令，其特征在于，当所述计算机程序指令被处理器执行时实现如权利要求1-7中任一项所述的方法。
PCT/CN2023/101083 2022-10-31 2023-06-19 一种异常根因定位方法、装置、设备及介质 WO2024093256A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211343420.0 2022-10-31
CN202211343420.0A CN115392812B (zh) 2022-10-31 2022-10-31 一种异常根因定位方法、装置、设备及介质

Publications (1)

Publication Number Publication Date
WO2024093256A1 true WO2024093256A1 (zh) 2024-05-10

Family

ID=84115065

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/101083 WO2024093256A1 (zh) 2022-10-31 2023-06-19 一种异常根因定位方法、装置、设备及介质

Country Status (2)

Country Link
CN (1) CN115392812B (zh)
WO (1) WO2024093256A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115392812B (zh) * 2022-10-31 2023-03-24 成都飞机工业（集团）有限责任公司 一种异常根因定位方法、装置、设备及介质
CN117389230B (zh) * 2023-11-16 2024-06-07 广州中健中医药科技有限公司 抗高血压中药提取液生产控制方法及***

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210216386A1 (en) * 2018-07-23 2021-07-15 Mitsubishi Electric Corporation Time-sequential data diagnosis device, additional learning method, and recording medium
CN113835947A (zh) * 2020-06-08 2021-12-24 支付宝(杭州)信息技术有限公司 一种基于异常识别结果确定异常原因的方法和***
CN114048055A (zh) * 2021-11-09 2022-02-15 上海哔哩哔哩科技有限公司 时序数据异常根因分析方法及***
CN115018106A (zh) * 2021-03-04 2022-09-06 腾讯科技（深圳）有限公司 异常分析方法、装置、设备及计算机可读存储介质
CN115392812A (zh) * 2022-10-31 2022-11-25 成都飞机工业（集团）有限责任公司 一种异常根因定位方法、装置、设备及介质

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180191766A1 (en) * 2017-01-04 2018-07-05 Ziften Technologies, Inc. Dynamic assessment and control of system activity
JP6935551B2 (ja) * 2019-07-18 2021-09-15 株式会社日立製作所 データセットにおける異常の根本原因を検出する方法およびシステム
CN110851338B (zh) * 2019-09-23 2022-06-24 平安科技（深圳）有限公司 异常检测方法、电子设备及存储介质
CN111880959A (zh) * 2020-06-24 2020-11-03 汉海信息技术(上海)有限公司 一种异常检测方法、装置及电子设备
CN111597070B (zh) * 2020-07-27 2020-11-27 北京必示科技有限公司 一种故障定位方法、装置、电子设备及存储介质
CN111984503B (zh) * 2020-08-17 2023-12-01 网宿科技股份有限公司 一种监控指标数据异常数据识别的方法及装置
CN114528175A (zh) * 2020-10-30 2022-05-24 亚信科技（中国）有限公司 一种微服务应用***根因定位方法、装置、介质及设备
CN115204436A (zh) * 2021-04-14 2022-10-18 腾讯科技（深圳）有限公司 检测业务指标异常原因的方法、装置、设备及介质
CN113037575B (zh) * 2021-05-28 2021-09-10 北京宝兰德软件股份有限公司 网元异常的根因定位方法、装置、电子设备及存储介质
CN113568950A (zh) * 2021-07-29 2021-10-29 北京字节跳动网络技术有限公司 一种指标检测方法、装置、设备及介质
CN113723555A (zh) * 2021-09-07 2021-11-30 上海观安信息技术股份有限公司 异常数据的检测方法及装置、存储介质、终端
CN114048365B (zh) * 2021-11-15 2022-10-21 江苏鼎驰电子科技有限公司 一种基于大数据流处理技术的运维监控治理方法
CN114116397A (zh) * 2021-11-29 2022-03-01 深圳壹账通智能科技有限公司 一种监控指标的预警归因方法、装置、设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20210216386A1 (en) * 2018-07-23 2021-07-15 Mitsubishi Electric Corporation Time-sequential data diagnosis device, additional learning method, and recording medium
CN113835947A (zh) * 2020-06-08 2021-12-24 支付宝(杭州)信息技术有限公司 一种基于异常识别结果确定异常原因的方法和***
CN115018106A (zh) * 2021-03-04 2022-09-06 腾讯科技（深圳）有限公司 异常分析方法、装置、设备及计算机可读存储介质
CN114048055A (zh) * 2021-11-09 2022-02-15 上海哔哩哔哩科技有限公司 时序数据异常根因分析方法及***
CN115392812A (zh) * 2022-10-31 2022-11-25 成都飞机工业（集团）有限责任公司 一种异常根因定位方法、装置、设备及介质

Also Published As

Publication number Publication date
CN115392812A (zh) 2022-11-25
CN115392812B (zh) 2023-03-24

Similar Documents

Publication Publication Date Title
WO2024093256A1 (zh) 一种异常根因定位方法、装置、设备及介质
CN111126824B (zh) 多指标关联模型训练方法及多指标异常分析方法
CN109034244B (zh) 基于电量曲线特征模型的线损异常诊断方法及装置
CN109977535B (zh) 一种线损异常诊断方法、装置、设备及可读存储介质
CN113918376B (zh) 故障检测方法、装置、设备及计算机可读存储介质
CN111199018B (zh) 异常数据检测方法、装置、存储介质及电子设备
CN111143102A (zh) 异常数据检测方法、装置、存储介质及电子设备
CA2931624A1 (en) Systems and methods for event detection and diagnosis
CN113488414B (zh) 晶圆生产监控方法、***与电子设备
WO2018184304A1 (zh) 一种网元健康状态的检测方法及设备
US20210006481A1 (en) Method and Apparatus for Determining Status of Network Device
EP3667952A1 (en) Method, device, and storage medium for locating failure cause
CN111143101B (zh) 用于确定故障根源的方法、装置、存储介质及电子设备
CN111371647A (zh) 数据中心监控数据预处理方法及装置
CN113360359B (zh) 指标异常数据溯源方法、装置、设备及存储介质
CN109960626B (zh) 端口异常的识别方法、装置、设备及介质
CN117235460A (zh) 一种基于电力时序数据的数据传输处理方法及***
CN110532122B (zh) 故障分析方法及***、电子设备、存储介质
CN114037010A (zh) 一种电量数据异常的识别方法及装置
CN112398706B (zh) 数据评估标准确定方法、装置及存储介质、电子设备
CN110099440B (zh) 定位延时校准方法及装置
CN115001997B (zh) 基于极值理论的智慧城市网络设备性能异常阈值评估方法
CN111176931A (zh) 一种运营监控方法、装置、服务器及存储介质
US20230409421A1 (en) Anomaly detection in computer systems
CN116663875B (zh) 一种基于大数据的智能化安装工程监测***及方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23884195

Country of ref document: EP

Kind code of ref document: A1