CN116582417A

CN116582417A - Data processing method, device, computer equipment and storage medium

Info

Publication number: CN116582417A
Application number: CN202310863877.2A
Authority: CN
Inventors: 张晓翼; 侯锦坤; 郭润增; 王少鸣; 张志强; 郑杰夫
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2023-07-14
Filing date: 2023-07-14
Publication date: 2023-08-11
Anticipated expiration: 2043-07-14
Also published as: CN116582417B

Abstract

The application discloses a data processing method, a data processing device, computer equipment and a storage medium, and belongs to the technical field of computers. The method comprises the following steps: detecting the received data packet to obtain an abnormality detection result, wherein the abnormality detection result comprises abnormality types of a plurality of different levels to which the detected data packet belongs; starting from the abnormal type of the first level in the abnormal detection result, searching the nodes of the abnormal type in the abnormal event tree diagram; under the condition that the abnormal type node is found, the abnormal type node of the next level is found in the child nodes of the abnormal type node, and under the condition that the abnormal type node is not found, the abnormal type node is created until the abnormal type node of the last level is found or the abnormal type node of the last level is created; in the node of the anomaly type of the last hierarchy, the anomaly event information of the data packet is stored. The application realizes systematic management and induction of abnormal events.

Description

Data processing method, device, computer equipment and storage medium

Technical Field

The embodiment of the application relates to the technical field of computers, in particular to a data processing method, a data processing device, computer equipment and a storage medium.

Background

With the rapid development of computer technology, a terminal can provide various online business services for users, but various abnormal events can occur in the operation process of the terminal, so that the business services cannot be used. For example, when a user browses a web page using a browser, problems such as slow loading of the page may occur.

In the related art, in order to count abnormal events occurring on a line, an operator manually performs an abnormal analysis on reported data, and uses tools such as an Excel table (a type of electronic table software) to record the abnormal events obtained by the analysis. Since this method relies on manpower, the processing efficiency is low, and systematic management and generalization of abnormal events is lacking.

Disclosure of Invention

The embodiment of the application provides a data processing method, a data processing device, computer equipment and a storage medium, which improve the data processing efficiency and realize systematic management and induction of abnormal events. The technical scheme is as follows.

In one aspect, a data processing method is provided, the method including: detecting a received data packet to obtain an abnormality detection result, wherein the data packet is generated in the operation process of a terminal, and the abnormality detection result comprises a plurality of detected abnormality types of different levels to which the data packet belongs, and any abnormality type belongs to a subtype of an abnormality type of a previous level; starting from the abnormal type of the first level in the abnormal detection result, searching for the node of the abnormal type in an abnormal event tree diagram, wherein the abnormal event tree diagram comprises a plurality of nodes of different levels, each node corresponds to one abnormal type, and the abnormal type corresponding to the child node of any node belongs to the subtype of the abnormal type corresponding to the node; under the condition that the abnormal type node is found, searching the abnormal type node of the next level in the child nodes of the abnormal type node, and under the condition that the abnormal type node is not found, creating the abnormal type node until the abnormal type node of the last level is found or creating the abnormal type node of the last level; in the node of the anomaly type of the last hierarchy, the anomaly event information of the data packet is stored.

Optionally, the abnormal data packet includes at least one of an abnormal device identifier, abnormal business data, abnormal time, abnormal device log, or abnormal risk level; the abnormality detection result further includes abnormality analysis information including at least one of an abnormality detection basis, an abnormality cause, or an abnormality resolution.

Optionally, before storing the abnormal event information of the data packet in the node of the abnormal type of the last hierarchy, the method further includes: obtaining analysis data, wherein the analysis data is obtained by analyzing the data packet; and filling the analysis data into an information template to obtain the abnormal event information of the data packet.

In another aspect, there is provided a data processing apparatus, the apparatus comprising: the detection module is used for detecting the received data packet to obtain an abnormal detection result, wherein the data packet is generated in the operation process of the terminal, and the abnormal detection result comprises a plurality of detected abnormal types of different levels to which the data packet belongs, and any abnormal type belongs to the subtype of the abnormal type of the previous level; the node processing module is used for searching the nodes of the abnormal types in an abnormal event tree diagram from the abnormal type of the first level in the abnormal detection result, wherein the abnormal event tree diagram comprises a plurality of nodes of different levels, each node corresponds to one abnormal type, and the abnormal type corresponding to the child node of any node belongs to the subtype of the abnormal type corresponding to the node; the node processing module is further configured to, when the node of the anomaly type is found, find a node of an anomaly type of a next level in child nodes of the node of the anomaly type, and, when the node of the anomaly type is not found, create the node of the anomaly type until a node of an anomaly type of a last level is found or a node of an anomaly type of a last level is created; and the storage module is used for storing the abnormal event information of the data packet in the node of the abnormal type of the last hierarchy.

Optionally, the node processing module is configured to: and under the condition that the node of the abnormal type is not found, creating a first node based on the node of the abnormal type of the previous level, determining the first node as the node of the abnormal type, wherein the first node is a child node of the abnormal type of the previous level.

Optionally, the abnormality detection result further includes abnormality analysis information including at least one of an abnormality detection basis, an abnormality cause, or an abnormality resolution; the storage module is further configured to: in case the node of the anomaly type of the last hierarchy is a newly created node, storing in said node an identification of the anomaly type of the last hierarchy and said anomaly analysis information.

Optionally, the detection module is configured to: receiving an abnormal data packet sent by the terminal, wherein the abnormal data packet is generated when an abnormal event occurs in the operation process of the terminal; and detecting the abnormal data packet through a first abnormal detection model to obtain the abnormal detection result, wherein the first abnormal detection model is used for detecting the abnormal type of any abnormal data packet.

Optionally, the detection module is configured to: receiving the data packet periodically sent by the terminal, wherein the data packet is any data packet generated in the operation process of the terminal; and detecting the data packet through a second abnormality detection model to obtain an abnormality detection result, wherein the second abnormality detection model is used for detecting whether any data packet has an abnormality or not and the abnormality type of any data packet under the condition of the abnormality.

Optionally, the device further comprises an approval module for: the updated abnormal event tree diagram is sent to approval equipment, and the approval equipment is used for displaying the updated abnormal event tree diagram and returning approval passing information in response to the confirmation operation of the abnormal event tree diagram; and responding to the approval passing message, and storing the updated abnormal event tree graph in a database.

Optionally, the node of the anomaly type of the last hierarchy further stores anomaly analysis information, where the anomaly analysis information includes at least one of an anomaly detection basis, an anomaly cause, or an anomaly resolution measure; the apparatus further comprises a repair module for: determining an anomaly code based on the anomaly event information; and repairing the abnormal code based on the abnormal analysis information.

Optionally, the apparatus further includes an information generating module configured to: obtaining analysis data, wherein the analysis data is obtained by analyzing the data packet; and filling the analysis data into an information template to obtain the abnormal event information of the data packet.

In another aspect, a computer device is provided, the computer device comprising a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the operations performed by the data processing method as described in the above aspects.

In another aspect, there is provided a computer readable storage medium having stored therein at least one computer program loaded and executed by a processor to implement the operations performed by the data processing method as described in the above aspects.

In another aspect, a computer program product is provided, comprising a computer program loaded and executed by a processor to implement the operations performed by the data processing method as described in the above aspects.

According to the scheme provided by the embodiment of the application, the data packet generated by the terminal in the operation process is detected to obtain a plurality of different levels of abnormal types to which the data packet belongs, then, according to the sequence from top to bottom of the levels, the nodes corresponding to the plurality of abnormal types are searched in the abnormal event tree diagram, if the corresponding nodes are not searched, the nodes corresponding to the abnormal types are newly created, and the abnormal event information of the data packet is stored in the nodes corresponding to the abnormal types of the last level, so that the abnormal event corresponding to the data packet is recorded in the abnormal event tree diagram, the abnormal event generated by automatically collecting and inducing the abnormal event tree diagram is realized, the manual processing is not needed, the data processing efficiency is improved, and the systematic management and induction of the abnormal event are realized.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application.

Fig. 2 is a flowchart of a data processing method according to an embodiment of the present application.

Fig. 3 is a flowchart of another data processing method according to an embodiment of the present application.

FIG. 4 is a schematic diagram of an anomaly event tree graph according to an embodiment of the present application.

Fig. 5 is a flowchart of still another data processing method according to an embodiment of the present application.

Fig. 6 is a flowchart of a data processing method provided by the related art.

Fig. 7 is a flowchart of yet another data processing method according to an embodiment of the present application.

Fig. 8 is a schematic structural diagram of a data processing apparatus according to an embodiment of the present application.

Fig. 9 is a schematic structural diagram of another data processing apparatus according to an embodiment of the present application.

Fig. 10 is a schematic structural diagram of a terminal according to an embodiment of the present application.

Fig. 11 is a schematic structural diagram of a server according to an embodiment of the present application.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more apparent, the following detailed description of the embodiments of the present application will be given with reference to the accompanying drawings.

It is to be understood that the terms "first," "second," and the like, as used herein, may be used to describe various concepts, but are not limited by these terms unless otherwise specified. These terms are only used to distinguish one concept from another. For example, a first node may be referred to as a second node, and similarly, a second node may be referred to as a first node, without departing from the scope of the application.

Wherein at least one means one or more, for example, at least one node may be any integer number of nodes greater than or equal to one, such as one node, two nodes, three nodes, and the like. The plurality means two or more, and for example, the plurality of nodes may be an integer number of two or more of any one of two nodes, three nodes, and the like. Each refers to each of at least one, for example, each node refers to each of a plurality of nodes, and if the plurality of nodes is 3 nodes, each node refers to each of the 3 nodes.

It can be appreciated that in the embodiments of the present application, related data such as data packets, detection results, abnormal event tree diagrams, etc. are related, when the above embodiments of the present application are applied to specific products or technologies, user permission or consent is required to be obtained, and the collection, use and processing of related data is required to comply with related laws and regulations and standards of related regions.

Artificial intelligence (Artificial Intelligence, AI) is the theory, method, technique and application system that uses a digital computer or a machine controlled by a digital computer to simulate, extend and extend human intelligence, sense the environment, acquire knowledge and use the knowledge to obtain optimal results. In other words, artificial intelligence is an integrated technology of computer science that attempts to understand the essence of intelligence and to produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence, i.e. research on design principles and implementation methods of various intelligent machines, enables the machines to have functions of sensing, reasoning and decision.

The artificial intelligence technology is a comprehensive subject, and relates to the technology with wide fields, namely the technology with a hardware level and the technology with a software level. Artificial intelligence infrastructure technologies generally include, for example, sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, pre-training model technologies, operation/interaction systems, mechatronics, and the like. The pre-training model is also called a large model and a basic model, and can be widely applied to all large-direction downstream tasks of artificial intelligence after fine adjustment. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and other directions.

Natural language processing (Nature Language Processing, NLP) is an important direction in the fields of computer science and artificial intelligence. It is studying various theories and methods that enable effective communication between a person and a computer in natural language. The natural language processing relates to natural language, namely the language used by people in daily life, and is closely researched with linguistics; and also to computer science and mathematics. An important technique for model training in the artificial intelligence domain, a pre-training model, is developed from a large language model (Large Language Model) in the NLP domain. Natural language processing techniques typically include text processing, semantic understanding, machine translation, robotic questions and answers, knowledge graph techniques, and the like.

The data processing method provided by the embodiment of the application is explained below based on an artificial intelligence technology and a natural language processing technology.

FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application, referring to FIG. 1, the implementation environment includes: a terminal 101 and a server 102. The terminal 101 and the server 102 may be directly or indirectly connected through wired or wireless communication, and the present application is not limited herein.

The terminal 101 generates a data packet during operation, where the data packet is a data packet generated when the terminal provides a service, and the terminal 101 reports the data packet to the server 102. The server 102 detects the data packet reported by the terminal 101 to obtain an anomaly detection result, and updates the anomaly event tree graph by using the anomaly type to which the data packet belongs in the anomaly detection result, so as to record the anomaly event information corresponding to the data packet in the anomaly event tree graph.

In one possible implementation, the terminal 101 is installed with a service application served by the server 102, through which the terminal 101 can implement a corresponding service function, for example, the target application is a content sharing application, and the content sharing application has a function of content sharing. The service application may be an application in the operating system of the terminal 101, or an application provided for a third party, etc. The terminal 101 reports the data packet generated in the service application running process to the server 102, and the server 102 updates the abnormal event tree diagram based on the abnormal detection result of the data packet. The subsequent server 102 may repair the abnormal code in the service application based on the abnormal event tree diagram, and send the repaired content to the terminal 101, so as to optimize the service application.

In one possible implementation, the server 102 may be an independent physical server, or may be a server cluster or a distributed system formed by a plurality of physical servers, or may be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network ), and basic cloud computing services such as big data and artificial intelligence platforms. The terminal 101 may be, but is not limited to, a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a vehicle-mounted terminal, etc.

The data processing method provided by the embodiment of the application can be applied to any scene for detecting the abnormal event.

For example, an electronic shopping application is taken as an example. The terminal is provided with an electronic shopping application, and when an abnormal event occurs in the running process of the electronic shopping application, the terminal reports the abnormal data packet generated currently to a background server of the electronic shopping application. The background server maintains an abnormal event tree diagram of the electronic shopping application, and after receiving an abnormal data packet reported by the terminal, the background server detects the abnormal data packet and updates the abnormal event tree diagram based on an obtained abnormal detection result, so that the abnormal type and the abnormal event information corresponding to the abnormal data packet are recorded in the abnormal event tree diagram, and systematic management and induction of the abnormal event generated in the electronic shopping application are realized.

Fig. 2 is a flowchart of a data processing method according to an embodiment of the present application, where the embodiment of the present application is implemented by a computer device, for example, the computer device may be a server in the embodiment shown in fig. 1. Referring to fig. 2, the method includes the following steps.

201. The method comprises the steps that a computer device detects a received data packet to obtain an abnormality detection result, wherein the data packet is generated in the operation process of a terminal, and the abnormality detection result comprises a plurality of abnormality types of different levels to which the detected data packet belongs, and any abnormality type belongs to a subtype of an abnormality type of a previous level.

The terminal can generate a data packet in the running process, the terminal reports the data packet to the computer equipment, the computer equipment detects the data packet, and if the data packet is abnormal, an abnormality detection result can be obtained. The abnormal existence of the data packet means that the terminal has abnormal events, such as a stuck or disconnected network, in the running process.

The exception detection result comprises a plurality of exception types of different levels to which the data packet belongs, and the exception type of each level belongs to the subtype of the exception type of the previous level except the exception type of the first level in the plurality of exception types. That is, the anomaly types of the plurality of different levels are classified from coarse granularity to fine granularity.

For example, the abnormality detection result includes 3 different levels of abnormality types, which are "traffic abnormality", "availability abnormality", and "system crash", respectively. Wherein, the "business exception" is the exception type of the first level, the "availability exception" is the exception type of the second level, and the "system crash" is the exception type of the second level. The "availability exception" belongs to the subtype of the "business exception" and the "system crash" belongs to the subtype of the "availability exception". That is, the data packet belongs to "traffic anomaly", if the division is continued, the data packet belongs to "availability anomaly" under "traffic anomaly", and if the division is continued, the data packet belongs to "system crash" under "availability anomaly".

202. The computer equipment starts from the abnormal type of the first level in the abnormal detection result, searches the abnormal type node in the abnormal event tree diagram, wherein the abnormal event tree diagram comprises a plurality of nodes of different levels, each node corresponds to one abnormal type, and the abnormal type corresponding to the child node of any node belongs to the subtype of the abnormal type corresponding to the node.

The computer equipment maintains an abnormal event tree diagram, and the abnormal event tree diagram records abnormal events and abnormal types thereof generated in the operation process of the terminal in the form of nodes. The abnormal event tree graph comprises a plurality of nodes with different levels, each node corresponds to one abnormal type, the level relation between the nodes is the same as the level relation between the abnormal types, and the abnormal type corresponding to the child node of any node belongs to the subtype of the abnormal type corresponding to the node. For example, an "availability exception" is the type of exception at the last level of a "system crash," i.e., a subtype of the "system crash" that belongs to the "availability exception. The node of "availability exception" belongs to the node of the level immediately above the node of "system crash", that is, the node of "availability exception" belongs to the parent node of the node of "system crash", and the node of "system crash" belongs to the child node of the node of "availability exception".

The abnormal event tree diagram is a graphical representation form and is used for displaying the hierarchical structure and the classification relation among various abnormal types. The abnormal event tree graph consists of a root node, a branch node and a leaf node, wherein the root node only has child nodes and does not have a father node. The branch node has both child and parent nodes. Leaf nodes have only parent nodes and no child nodes. The exception type corresponding to the root node is the most general exception type, and the exception type corresponding to the leaf node is the finest granularity exception type.

In the embodiment of the application, after obtaining the abnormality detection result of the data packet, the computer equipment determines the abnormality types of a plurality of different levels in the abnormality detection result, and then starts from the abnormality type of the first level, and searches the nodes of the abnormality type in the abnormality event tree graph.

203. The computer equipment searches for the node of the abnormal type of the next level in the child nodes of the node of the abnormal type under the condition that the node of the abnormal type is searched, and creates the node of the abnormal type under the condition that the node of the abnormal type is not searched until the node of the abnormal type of the last level is searched or the node of the abnormal type of the last level is created.

The computer device starts from the anomaly type of the first level, searches the anomaly event tree graph for a node of the anomaly type of the first level, then searches the anomaly event tree graph for a node of the anomaly type of the second level, and so on until a node of the anomaly type of the last level is determined in the anomaly event tree graph.

For any anomaly type currently being traversed, if the computer device finds a node of the anomaly type in the anomaly event tree graph, continuing to find a node of the anomaly type of the next level in the child nodes of the node of the anomaly type, and then continuing to find a node of the anomaly type of the next level in the child nodes of the node. For any anomaly type currently being traversed, if the computer equipment does not find the node of the anomaly type in the anomaly event tree graph, the node of the anomaly type needs to be created, then the node of the anomaly type of the next level is continuously found, and if the node of the anomaly type of the next level is not found, the node of the anomaly type of the next level needs to be continuously created. By the way, when traversing to the exception type of the last hierarchy, if the node of the exception type of the last hierarchy is found, the search process is stopped, if the node of the exception type of the last hierarchy is not found, the node of the exception type of the last hierarchy is created, and the search process is stopped. That is, the lookup process in this step 203 may stop at the node that found the last level of exception type or at the node that created the last level of exception type, so far the computer device has determined the node of exception type for each level in the exception event tree graph.

204. The computer device stores the anomaly event information for the data packet in the node of the anomaly type of the last hierarchy.

After the computer device determines the node of the anomaly type of the last hierarchy in the anomaly event tree graph, the anomaly event information of the data packet is obtained, and the anomaly event information indicates the anomaly event generating the data packet. The computer device stores the anomaly event information for the data packet in the node of the anomaly type of the last hierarchy.

Because the abnormal event tree diagram comprises the hierarchical relation among all the nodes, after the abnormal event information of the data packet is stored in the node of the abnormal type of the last hierarchy, the parent node of the node and the parent node of the parent node are searched upwards in the abnormal event tree diagram until the root node is searched, and the abnormal type corresponding to each searched node is the abnormal type of a plurality of different hierarchies to which the abnormal event corresponding to the data packet belongs.

According to the method provided by the embodiment of the application, the data packet generated by the terminal in the operation process is detected to obtain a plurality of different levels of abnormal types to which the data packet belongs, then, according to the sequence from top to bottom of the levels, the nodes corresponding to the plurality of abnormal types are searched in the abnormal event tree diagram, if the corresponding nodes are not searched, the nodes corresponding to the abnormal types are newly created, and the abnormal event information of the data packet is stored in the nodes corresponding to the abnormal types of the last level, so that the abnormal event corresponding to the data packet is recorded in the abnormal event tree diagram, the abnormal event generated by automatically collecting and inducing the abnormal event tree diagram is realized, the manual processing is not needed, the data processing efficiency is improved, and the systematic management and induction of the abnormal event are realized.

The embodiment shown in fig. 2 above is only a brief description of the data processing method, and the detailed procedure of the data processing method can be seen in the embodiment shown in fig. 3 below. Fig. 3 is a flowchart of another data processing method according to an embodiment of the present application, where the embodiment of the present application is performed by a computer device, for example, the computer device may be a server in the embodiment shown in fig. 1. Referring to fig. 3, the method includes the following steps.

301. The method comprises the steps that a computer device detects a received data packet to obtain an abnormality detection result, wherein the data packet is generated in the operation process of a terminal, and the abnormality detection result comprises a plurality of abnormality types of different levels to which the detected data packet belongs, and any abnormality type belongs to a subtype of an abnormality type of a previous level.

In one possible implementation, the terminal is provided with a service application, and the computer device is used for collecting abnormal events occurring in the running process of the service application. And the terminal reports the data packet generated by the service application to the computer equipment in the running process of the service application, the computer equipment detects the data packet, and a plurality of abnormal types in the abnormal detection result are abnormal types of abnormal events of the service application in the running process.

In another possible implementation manner, the data packet may be a data packet generated when an abnormal event occurs or a data packet that is reported periodically, and the process of detecting the received data packet includes the following two cases.

First case: the computer equipment receives an abnormal data packet sent by the terminal, wherein the abnormal data packet is generated when an abnormal event occurs in the operation process of the terminal. The computer equipment detects the abnormal data packet through a first abnormal detection model to obtain an abnormal detection result, wherein the first abnormal detection model is used for detecting the abnormal type of any abnormal data packet.

In this case, when the terminal determines that an abnormal event occurs during operation, the abnormal data packet generated at present is acquired, and the abnormal data packet is reported to the computer device. The first anomaly detection model is obtained through training of a sample anomaly data packet and a corresponding sample anomaly detection result, and is used for detecting the anomaly data packet. The computer device thus detects the received abnormal data packet by the first abnormality detection model. In the embodiment of the application, the abnormal data packet is only processed, and the normal data packet is not required to be processed, so that the flow consumption can be reduced, and the processing pressure of the computer equipment can be reduced.

Optionally, the abnormal data packet includes at least one of an abnormal device identification, abnormal business data, abnormal time, abnormal device log, or abnormal risk level; the abnormality detection result further includes abnormality analysis information including at least one of an abnormality detection basis, an abnormality cause, or an abnormality solving means.

The abnormal device identifier indicates a terminal generating the abnormal data packet, and the abnormal device identifier indicates one or more terminals, for example, when a plurality of terminals have the same abnormal event in the operation process, the abnormal data packets sent by the plurality of terminals can be aggregated, and the abnormal device identifier in the aggregated abnormal data packet is the identifier of the plurality of terminals. The abnormal service data refers to service data generated when an abnormal event occurs in the operation process of the terminal. The abnormal time refers to the time when the terminal has an abnormal event in the operation process. The abnormal device log refers to a log in a terminal that generates an abnormal data packet. The abnormal risk level refers to the risk level of an abnormal event occurring in the operation process of the terminal.

The abnormality detection result includes a plurality of different levels of abnormality types and abnormality analysis information including at least one of abnormality detection basis, abnormality cause, or abnormality resolution. The anomaly detection basis refers to a basis for determining that the data packet belongs to the plurality of anomaly types, for example, the anomaly detection basis is that network delay is detected by a network detection tool. The abnormal cause is the cause of the abnormal packet. The anomaly resolution measure refers to a measure for resolving an anomaly event corresponding to the anomaly data packet, for example, the anomaly resolution measure is to optimize a network architecture, including increasing bandwidth or optimizing a network topology structure, etc.

Second case: the method comprises the steps that computer equipment receives a data packet periodically sent by a terminal, wherein the data packet is any data packet generated in the operation process of the terminal; and detecting the data packets through a second abnormality detection model to obtain an abnormality detection result, wherein the second abnormality detection model is used for detecting whether any data packet has an abnormality or not and the abnormality type of any data packet under the condition of the abnormality.

In this case, the terminal generates a data packet during operation, and the terminal reports the generated data packet to the computer device without distinction, regardless of whether the data packet is generated when an abnormal event occurs. The second anomaly detection model is trained by the sample data packet and the corresponding sample anomaly detection result, and is used for detecting any data packet without considering whether the data packet is generated when an anomaly occurs. Thus, the computer device detects the periodically received data packet by the second abnormality detection model. In the embodiment of the application, the data packet generated in the running process of the terminal is processed indiscriminately without considering whether the data packet is the data packet generated when the abnormal event occurs, so that the potential abnormal event can be mined and analyzed, and the accuracy of detecting the abnormal event is improved.

Alternatively, the first abnormality detection model and the second abnormality detection model in the above two cases may be models trained using NLP (Natural Language Processing ) technology, which is an interdisciplinary in the fields of computer science and artificial intelligence, intended to enable a computer device to understand, interpret, and generate natural language. The first anomaly detection model and the second anomaly detection model have sufficient semantic understanding capabilities and text generation capabilities to enable understanding of a provided data packet to determine which anomaly type the data packet belongs to.

Alternatively, expert rules, which may specify input rules, output rules, and the like of the models, are taken as constraint rules in the process of training the above-described first abnormality detection model and second abnormality detection model. For example, the input of the two anomaly detection models is data in a Prompt form, and the output of the anomaly detection models is a data packet in JSON (JavaScript Object Notation, JS object profile) format. The output of the abnormality detection model needs to include abnormality types, abnormality detection bases, abnormality causes, abnormality solving measures, and the like of a plurality of different levels, and the abnormality types of the plurality of different levels need to be output in order of coarse granularity to fine granularity, and the abnormality types of the plurality of different levels need to be output in list form, and the like.

302. The computer equipment starts from the abnormal type of the first level in the abnormal detection result, searches the abnormal type node in the abnormal event tree diagram, wherein the abnormal event tree diagram comprises a plurality of nodes of different levels, each node corresponds to one abnormal type, and the abnormal type corresponding to the child node of any node belongs to the subtype of the abnormal type corresponding to the node.

The computer equipment maintains an abnormal event tree diagram, and the abnormal event tree diagram records abnormal events and abnormal types thereof generated in the operation process of the terminal in the form of nodes. The abnormal event tree graph comprises a plurality of nodes of different levels, each node corresponds to one abnormal type, and the level relation among the nodes is the same as the level relation among the abnormal types. After obtaining the abnormality detection result of the data packet, the computer equipment determines abnormality types of a plurality of different levels in the abnormality detection result, and then searches nodes of the abnormality type in the abnormality event tree diagram from the abnormality type of the first level.

303. The computer equipment searches for the node of the abnormal type of the next level in the child nodes of the node of the abnormal type under the condition that the node of the abnormal type is searched, and creates the node of the abnormal type under the condition that the node of the abnormal type is not searched until the node of the abnormal type of the last level is searched or the node of the abnormal type of the last level is created.

For any anomaly type currently being traversed, if the computer device finds a node of the anomaly type in the anomaly event tree graph, continuing to find a node of the anomaly type of the next level in the child nodes of the node of the anomaly type. For any anomaly type currently being traversed, if the computer device does not find a node of that anomaly type in the anomaly event tree graph, then the node of that anomaly type needs to be created.

In one possible implementation, the computer device creates a first node based on the node of the anomaly type of the previous hierarchy, determines the first node as the node of the anomaly type, and the first node is a child node of the anomaly type of the previous hierarchy, if no node of the anomaly type is found.

In addition, since the node of the anomaly type of the next level is necessarily a child node of the anomaly type, and the node of the anomaly type is a newly created node, there is no node of the anomaly type of the next level in the anomaly event tree graph, and therefore the computer device continues to create a second node based on the first node after creating the first node as the node of the anomaly type, the second node being a child node of the first node, determining the second node as the anomaly type of the next level, and continuing to create the node of the anomaly type of the next level again if the anomaly type of the next level is not the anomaly type of the last level, and so on until the node of the anomaly type of the last level is created.

Fig. 4 is a schematic diagram of an abnormal event tree diagram provided by an embodiment of the present application, where, as shown in fig. 4, node 1 (service abnormality) in the abnormal event tree diagram is a root node, and nodes 12-30 are leaf nodes.

Node 1 (traffic anomaly) includes 2 sub-nodes, namely node 2 (experience anomaly) and node 3 (availability anomaly), and the anomaly type corresponding to node 2-node 3 belongs to the 2 sub-types of the anomaly type corresponding to node 1. Node 2 (experience anomaly) includes 3 child nodes, node 4 (slow), node 5 (interface confusion) and node 6 (cumbersome operation), respectively. The exception type corresponding to node 4-node 6 belongs to the 3 sub-types of the exception type corresponding to node 2. Node 3 (availability exception) includes 4 child nodes, node 7 (system crash), node 8 (service unavailable), node 9 (data loss), node 10 (security problem), respectively. The exception type corresponding to node 7-node 10 belongs to the 4 sub-types of the exception type corresponding to node 3. Node 4 (slow) includes 4 child nodes, node 11 (slow page load), node 12 (slow button click response), node 13 (slow swipe), node 14 (slow picture load), respectively. The exception type corresponding to node 11-node 14 belongs to the 4 sub-types of the exception type corresponding to node 4. Node 5 (interface disorder) includes 4 child nodes, namely node 15 (page layout disorder), node 16 (picture not shown), node 17 (white screen), node 18 (black screen). The exception type corresponding to node 15-node 18 belongs to the 4 sub-types of the exception type corresponding to node 5. The node 6 (complex operation) includes 1 sub-node, which is the node 19 (registration procedure is lengthy), and the exception type corresponding to the node 19 belongs to 1 sub-type of the exception type corresponding to the node 6. Node 7 (system crash) includes 2 child nodes, node 20 (system no response) and node 21 (system error hint), respectively. The exception type corresponding to node 20-node 21 belongs to 2 sub-types of the exception type corresponding to node 7. Node 8 (service unavailable) includes 2 sub-nodes, node 22 (button click failure) and node 23 (turn-on failure), respectively, and the exception type corresponding to node 22-node 23 belongs to the 2 sub-types of the exception type corresponding to node 8. Node 9 (data loss) includes 2 sub-nodes, node 24 (data acquisition failure) and node 25 (user identification failure), respectively, and the exception type corresponding to node 24-node 25 belongs to 2 sub-types of the exception type corresponding to node 9. Node 10 (security issue) includes 1 child node, which is node 26 (account swiped), and the anomaly type corresponding to node 26 belongs to 1 child type of anomaly type corresponding to node 10. Node 11 (slow page load) includes 4 child nodes, node 27 (network delay), node 28 (server load too high), node 29 (front end code error), node 30 (compatibility problem), respectively. The exception type corresponding to node 27-node 30 belongs to the 4 sub-types of the exception type corresponding to node 11.

The abnormality types of the different levels in the abnormality detection result obtained by the computer equipment are a path from the abnormality type corresponding to the root node to the abnormality type corresponding to one of the leaf nodes.

It should be noted that, the abnormal event tree diagrams of different service types are also different, the abnormal event tree diagram shown in fig. 4 is only a simple example, the actual abnormal event tree diagram may be more complex than the abnormal event tree diagram shown in fig. 4, and the classification and hierarchy between the abnormal types may have more cases. The core function of the abnormal event tree diagram is to describe the relationship between the abnormal type and the abnormal subtype of the abnormal event, and for each abnormal event, the abnormal type corresponding to the leaf node at the lowest layer can be searched downwards from the root node in the abnormal event tree diagram, and the process can be called as drill-down, wherein the drill-down is used for automatically and rapidly analyzing the abnormal event, and finally, the abnormal type with the finest granularity of the abnormal event is found.

304. The computer equipment acquires analysis data, fills the analysis data into the information template to obtain abnormal event information of the data packet, and the analysis data is obtained by analyzing the data packet.

The information template is a template of abnormal event information, for example, the information template is a structured template. The data packet is a data packet corresponding to an abnormal event, the computer equipment analyzes the data packet to obtain analysis data such as abnormal time, abnormal service data or abnormal equipment identification, and then the analysis data is filled into an information template according to a preset rule to obtain abnormal event information corresponding to the data packet, wherein the abnormal event information indicates an abnormal event generating the data packet.

305. The computer device stores the anomaly event information for the data packet in the node of the anomaly type of the last hierarchy.

After determining the node of the abnormal type of the last hierarchy in the abnormal event tree diagram, obtaining abnormal event information of the data packet, wherein the abnormal event information indicates an abnormal event generating the data packet. The computer equipment stores the abnormal event information of the data packet in the node of the abnormal type of the last hierarchy, wherein the abnormal event information indicates the abnormal event of the terminal in operation, so that the abnormal event is recorded in an abnormal event tree graph according to the abnormal type.

306. The computer device stores the identification of the anomaly type of the last hierarchy and anomaly analysis information in the node in the case where the node of the anomaly type of the last hierarchy is a newly created node.

The abnormality detection result further includes abnormality analysis information including at least one of an abnormality detection basis, an abnormality cause, or an abnormality solving means. If the computer apparatus does not find a node of the abnormality type for the last hierarchy in the abnormality event tree diagram, but newly creates a node as the node of the abnormality type of the last hierarchy, the computer apparatus stores the identification of the abnormality type of the last hierarchy and the abnormality analysis information in the node in addition to the abnormality event information in the node.

In the embodiment of the application, the leaf nodes in the abnormal event tree graph refer to nodes without child nodes, and the abnormal type corresponding to the leaf nodes in the abnormal event tree graph is the abnormal type with the finest granularity. Each leaf node also stores attribute information with the finest granularity, the attribute information of the leaf node comprises an identification of an abnormal type, an abnormal judgment basis, an abnormal reason, an abnormal solving measure and abnormal event information, the abnormal event information is a historical example, namely, a generated historical abnormal event, each time a data packet belonging to the abnormal type corresponding to the leaf node is detected, the abnormal event information corresponding to the data packet is stored in the leaf node, and one leaf node can store a plurality of abnormal event information.

In addition, it should be noted that, besides the leaf node, other nodes in the abnormal event tree graph may also store the identifier of the abnormal type corresponding to the node, and if a new node is created as a node of a certain abnormal type in the process of searching for the node of the abnormal type by the computer device, the identifier of the abnormal type is stored in the node to indicate that the node corresponds to the abnormal type.

In the embodiment of the application, the abnormal event tree diagram shows the hierarchical structure and the classification relation among the abnormal types in a graphical form, and the leaf node at the lowest layer also stores attribute information about the finest granularity of the abnormal type. On the one hand, the abnormal event tree diagram is used for fast drilling down, so that the abnormal event can be automatically and fast analyzed, the abnormal type with the finest granularity of the abnormal event is found, and the abnormal event can be subsequently transferred to the self-repairing system for fast repairing. On the other hand, the abnormal event tree diagram clearly and intuitively shows the abnormal types of each level and the historical abnormal events of each abnormal type, so that a service quality index system can be created based on the abnormal event tree diagram, service abnormality can be managed conveniently based on the abnormal event tree diagram, training samples can be provided for an abnormality detection model, the safety reinforcement property of a mobile application program of the service is ensured to a certain extent, and updating iteration is assisted to service application. In still another aspect, the abnormal event tree diagram graphically displays the hierarchical structure and the classification relation among the abnormal types, so that the visual characteristic of the abnormal event tree diagram can assist operators to have clear knowledge of the abnormal field of the service.

307. The computer equipment sends the updated abnormal event tree diagram to the approval equipment, and the updated abnormal event tree diagram is stored in the database in response to the approval passing message returned by the approval equipment.

The computer device stores the abnormal event information in the node of the abnormal type of the last hierarchy of the abnormal event tree diagram, and may also create a new node in the abnormal event tree diagram, which is equivalent to updating the abnormal event tree diagram based on the abnormal detection result. In order to ensure the updating accuracy of the abnormal event tree diagram, the computer equipment also sends the abnormal event tree diagram to the approval equipment for approval after updating the abnormal event tree diagram. After the approval device receives the updated abnormal event tree diagram, displaying the updated abnormal event tree diagram, if the user determines that the updated abnormal event tree diagram is not wrong, executing the confirmation operation of the abnormal event tree diagram, and returning an approval passing message to the computer device by responding to the confirmation operation of the abnormal event tree diagram. The computer device stores the updated abnormal event tree graph in the database upon receipt of the returned approval passing message.

The database is a software system for storing and managing data, and can help users organize, store, access and manage data, and is a core component of many application programs. For example, the database may be a relational database management system or the like.

In the embodiment of the application, after the computer equipment updates the abnormal event tree diagram, the manual approval process is added, and after the manual approval is passed, the abnormal event tree diagram is stored, so that the automatic updating process of the abnormal event tree diagram is performed, and the accuracy and the reliability of the abnormal event tree diagram are ensured under the condition of saving manpower as much as possible.

In one possible implementation manner, the approval device refers to a device logged in with an approval account, the computer device sends the updated abnormal event tree diagram to the approval account, the approval device receives the updated abnormal event tree diagram based on the approval account, and after a confirmation operation on the abnormal event tree diagram is detected based on the approval account, an approval passing message is returned to the computer device.

In another possible implementation, the approval device displays the updated abnormal event tree graph, and if the user considers that the abnormal event tree graph has an error, an editing operation on the abnormal event tree graph may be performed to correct the error. The examination and approval equipment responds to the editing operation of the abnormal event tree diagram, obtains the edited abnormal event tree diagram based on the editing operation of the abnormal event tree diagram, returns the edited abnormal event tree diagram to the computer equipment, and the computer equipment stores the edited abnormal event tree diagram in the database.

In another possible implementation, after updating the abnormal event tree graph, the computer device marks an updated node in the updated abnormal event tree graph, where the updated node is at least one of a new node created at the time or a node storing new abnormal event information. The computer equipment sends the marked abnormal event tree diagram to the approval equipment, the approval equipment displays the marked abnormal event tree diagram, and a user can quickly determine which nodes are updated according to the marks in the abnormal event tree diagram, so that whether the updated nodes have errors or not is judged.

308. The computer device determines an abnormal code based on the abnormal event information in the abnormal event tree diagram, and repairs the abnormal code based on the abnormal analysis information in the abnormal event tree diagram.

The data packet is a data packet generated in the running process of the business application in the terminal, the abnormal event is an abnormal event occurring in the business application, and the computer equipment is a background server of the business application. After the computer equipment stores the abnormal event tree diagram, determining the abnormal event information newly stored in the node of the abnormal type of the last hierarchy in the abnormal event tree diagram, positioning the abnormal code causing the abnormal event in service application based on the abnormal event information, and repairing the abnormal code based on the abnormal analysis information stored in the node. The subsequent computer equipment can also send the repaired code to the terminal provided with the business application, and the terminal updates the installed business application based on the repaired code, thereby realizing automatic repair of the abnormal event.

Fig. 5 is a flowchart of still another data processing method according to an embodiment of the present application, and as shown in fig. 5, a computer device is a server cluster formed by a plurality of physical servers, where the plurality of physical servers includes a server in an anomaly management system and a server in an anomaly repair system. When an abnormal event occurs in the running process of the terminal, the abnormal data packet generated at present is sent to an abnormal management system, the abnormal management system inputs the abnormal data packet into an abnormal detection model, and the abnormal detection model is trained by taking expert rules as constraint rules. The abnormality detection model outputs an abnormality detection result, and then the abnormality management system updates an abnormality event tree diagram based on the abnormality detection result, sends the abnormality event tree diagram to the abnormality repair system, and the abnormality repair system automatically repairs the abnormality event. As shown in fig. 5, the abnormal data packet includes an abnormal device identification, abnormal traffic data, an abnormal event, an abnormal picture/video, an abnormal device log, and an abnormal risk level. The abnormality detection result includes abnormality type, abnormality judgment basis, abnormality cause and abnormality solving means.

And an abnormal event tree diagram facing the service field is established, and the abnormal event tree diagram can automatically collect and sort abnormal events generated in the service field and abnormal types of all levels, so that the abnormal types of the generated abnormal events are abstracted out to form a comprehensive tree view from top to bottom, the abnormal conditions of the service field are clearly displayed, and a user can intuitively recognize the abnormal conditions of the service field.

And moreover, the detection of the abnormal event can be finished by using the trained abnormal detection model, and then the abnormal event tree diagram is manually examined and approved after being updated based on the abnormal detection result, so that the accuracy and the reliability of the abnormal event tree diagram are ensured under the condition of saving manpower as much as possible, the recorded abnormal event and the type of the abnormal event are further improved, and the data processing efficiency is improved.

And the abnormal event tree diagram is used for fast tripping, so that the abnormal event is automatically and fast analyzed, the abnormal type with the finest granularity of the abnormal event is found, and the abnormal event can be subsequently transferred to a self-repairing system for fast repairing, thereby realizing automatic detection of the abnormal event and repairing of the abnormal event, improving the efficiency of the abnormal detection and realizing the automatic repairing function with strong robustness.

In the related art, detection, recording and repair of an abnormal event are all realized manually, as shown in fig. 6, when the abnormal event occurs in the operation process of the terminal, the terminal feeds back the abnormal event to a research and development personnel, and the feedback means comprise two types, namely automatic pushing capability realized based on the reporting metadata and customer complaint feedback channel created based on the terminal. After receiving the abnormal event, the research personnel analyze the abnormal event according to own experience to obtain an abnormal analysis result and store the abnormal analysis result. The abnormal analysis result is sent to operation and maintenance personnel in the form of a problem sheet, and the operation and maintenance personnel repair the abnormal event based on the contents of the abnormal analysis result, such as the reasons of the abnormality, the solving measures and the like. In the above method, the whole process depends on personal experience of the user, so that there is a great impediment to processing efficiency, and systematic management and induction of abnormal events are lacking.

In the embodiment of the application, the abnormal event tree diagram facing the service field is established, the abnormal event tree diagram can automatically collect and arrange the abnormal events generated in the service field and the abnormal types of all the levels, the abnormal events generated by automatically collecting and inducing the abnormal events by updating the abnormal event tree diagram are realized, the manual processing is not needed, the processing efficiency is improved, and the systematic management and the induction of the abnormal events are realized. As shown in fig. 7, for ease of understanding, the process of the computer device is abstracted into the process of the abnormality management system and the process of the abnormality repair system. The abnormality management system comprises a semantic understanding module, an abnormality analysis module, an abnormality classification module and an abnormality storage module, and the abnormality repair system comprises a front-end display module, an approval process module and an automatic repair module. When an abnormal event occurs in the operation process of the terminal, the terminal reports the current generated abnormal data packet to an abnormal management system, the abnormal management system detects the abnormal data packet through a semantic understanding module to obtain an abnormal detection result, and an abnormal event tree diagram is updated based on the abnormal detection result through an abnormal analysis module and an abnormal classification module and is sent to an abnormal repair system. The abnormal repairing system displays the abnormal event tree diagram through the front end display module, the abnormal event tree diagram is approved through the approval flow module, and the abnormal management system stores the abnormal event tree diagram through the abnormal storage module after approval is passed. And the abnormal repairing system repairs the abnormal events recorded in the abnormal event tree diagram through an automatic repairing module. Therefore, the method provided by the embodiment of the application efficiently and accurately completes the closed loop of the whole abnormal data processing flow under the condition of reducing the dependence on manpower as much as possible.

Fig. 8 is a schematic structural diagram of a data processing apparatus according to an embodiment of the present application. Referring to fig. 8, the apparatus includes: the detection module 801 is configured to detect a received data packet to obtain an anomaly detection result, where the data packet is a data packet generated in an operation process of the terminal, and the anomaly detection result includes a plurality of anomaly types of different levels to which the detected data packet belongs, where any anomaly type belongs to a subtype of an anomaly type of a previous level; the node processing module 802 is configured to, starting from an anomaly type of a first level in the anomaly detection result, search for a node of an anomaly type in an anomaly event tree graph, where the anomaly event tree graph includes a plurality of nodes of different levels, each node corresponds to an anomaly type, and an anomaly type corresponding to a child node of any node belongs to a subtype of the anomaly type corresponding to the node; the node processing module 802 is further configured to, when the node of the anomaly type is found, find a node of the anomaly type of the next level in the child nodes of the node of the anomaly type, and, when the node of the anomaly type is not found, create the node of the anomaly type until a node of the anomaly type of the last level is found or create the node of the anomaly type of the last level; a storage module 803, configured to store the abnormal event information of the data packet in the node of the abnormal type of the last hierarchy.

According to the data processing device provided by the embodiment of the application, the data packet generated by the terminal in the operation process is detected to obtain a plurality of different levels of abnormal types to which the data packet belongs, then the nodes corresponding to the plurality of abnormal types are searched in the abnormal event tree diagram according to the sequence from top to bottom of the levels, if the corresponding nodes are not searched, the nodes corresponding to the abnormal types are newly created, and the abnormal event information of the data packet is stored in the nodes corresponding to the abnormal types of the last level, so that the abnormal event corresponding to the data packet is recorded in the abnormal event tree diagram, the abnormal event generated by automatically collecting and inducing the abnormal event tree diagram through updating the abnormal event tree diagram is realized, the manual processing is not needed, the data processing efficiency is improved, and the systematic management and induction of the abnormal event are realized.

Optionally, the node processing module 802 is configured to, in a case where no node of an anomaly type is found, create a first node based on a node of an anomaly type of a previous level, determine the first node as a node of an anomaly type, and the first node is a child node of the anomaly type of the previous level.

Optionally, the abnormality detection result further includes abnormality analysis information including at least one of an abnormality detection basis, an abnormality cause, or an abnormality resolution; the storage module 803 is further configured to store, in the case where the node of the anomaly type of the last hierarchy is a newly created node, an identification of the anomaly type of the last hierarchy and anomaly analysis information in the node.

Optionally, the detection module 801 is configured to: receiving an abnormal data packet sent by a terminal, wherein the abnormal data packet is generated when an abnormal event occurs in the operation process of the terminal; and detecting the abnormal data packet through a first abnormal detection model to obtain an abnormal detection result, wherein the first abnormal detection model is used for detecting the abnormal type of any abnormal data packet.

Optionally, the detection module 801 is configured to: receiving a data packet periodically transmitted by a terminal, wherein the data packet is any data packet generated in the operation process of the terminal; and detecting the data packets through a second abnormality detection model to obtain an abnormality detection result, wherein the second abnormality detection model is used for detecting whether any data packet has an abnormality or not and the abnormality type of any data packet under the condition of the abnormality.

Optionally, referring to fig. 9, the apparatus further includes an approval module 804 for: the updated abnormal event tree diagram is sent to approval equipment, the approval equipment is used for displaying the updated abnormal event tree diagram, and an approval passing message is returned in response to the confirmation operation of the abnormal event tree diagram; and storing the updated abnormal event tree graph in a database in response to the approval passing message.

Optionally, referring to fig. 9, in the node of the anomaly type of the last hierarchy, anomaly analysis information is also stored, where the anomaly analysis information includes at least one of an anomaly detection basis, an anomaly cause, or an anomaly resolution measure; the apparatus further comprises a repair module 805 for: determining an anomaly code based on the anomaly event information; and repairing the abnormal code based on the abnormal analysis information.

Optionally, referring to fig. 9, the apparatus further includes an information generating module 806 configured to: the method comprises the steps of obtaining analysis data, wherein the analysis data are obtained by analyzing a data packet; and filling the analysis data into an information template to obtain the abnormal event information of the data packet.

It should be noted that: the data processing apparatus provided in the above embodiment is only exemplified by the division of the above functional modules, and in practical application, the above functional allocation may be performed by different functional modules according to needs, that is, the internal structure of the computer device is divided into different functional modules, so as to perform all or part of the functions described above. In addition, the data processing apparatus and the data processing method embodiment provided in the foregoing embodiments belong to the same concept, and specific implementation processes of the data processing apparatus and the data processing method embodiment are detailed in the method embodiment, which is not described herein again.

The embodiment of the application also provides a computer device, which comprises a processor and a memory, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor to realize the operations executed in the data processing method of the embodiment.

Optionally, the computer device is provided as a terminal. Fig. 10 shows a schematic structural diagram of a terminal 1000 according to an exemplary embodiment of the present application.

Terminal 1000 includes: a processor 1001 and a memory 1002.

The processor 1001 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and so on. The processor 1001 may be implemented in at least one hardware form of DSP (Digital Signal Processing ), FPGA (Field Programmable Gate Array, field programmable gate array), PLA (Programmable Logic Array ). The processor 1001 may also include a main processor, which is a processor for processing data in an awake state, also referred to as a CPU (Central Processing Unit ), and a coprocessor; a coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 1001 may integrate a GPU (Graphics Processing Unit, image processing interactor) for taking care of rendering and drawing of the content that the display screen needs to display. In some embodiments, the processor 1001 may also include an AI (Artificial Intelligence ) processor for processing computing operations related to machine learning.

Memory 1002 may include one or more computer-readable storage media, which may be non-transitory. Memory 1002 may also include high-speed random access memory, as well as non-volatile memory, such as one or more magnetic disk storage devices, flash memory storage devices. In some embodiments, a non-transitory computer readable storage medium in memory 1002 is used to store at least one computer program for being possessed by processor 1001 to implement the data processing methods provided by the method embodiments of the present application.

In some embodiments, terminal 1000 can optionally further include: a peripheral interface 1003, and at least one peripheral. The processor 1001, the memory 1002, and the peripheral interface 1003 may be connected by a bus or signal line. The various peripheral devices may be connected to the peripheral device interface 1003 via a bus, signal wire, or circuit board. Optionally, the peripheral device comprises: at least one of radio frequency circuitry 1004, a display 1005, a camera assembly 1006, audio circuitry 1007, and a power supply 1008.

Peripheral interface 1003 may be used to connect I/O (Input/Output) related at least one peripheral to processor 1001 and memory 1002. In some embodiments, processor 1001, memory 1002, and peripheral interface 1003 are integrated on the same chip or circuit board; in some other embodiments, either or both of the processor 1001, memory 1002, and peripheral interface 1003 may be implemented on a separate chip or circuit board, which is not limited in this embodiment.

Radio Frequency circuit 1004 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. Radio frequency circuitry 1004 communicates with a communication network and other communication devices via electromagnetic signals. The radio frequency circuit 1004 converts an electrical signal into an electromagnetic signal for transmission, or converts a received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1004 includes: antenna systems, RF transceivers, one or more amplifiers, tuners, oscillators, digital signal processors, codec chipsets, subscriber identity module cards, and so forth. Radio frequency circuitry 1004 may communicate with other devices via at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: metropolitan area networks, various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks, and/or WiFi (Wireless Fidelity ) networks. In some embodiments, the radio frequency circuitry 1004 may also include NFC (Near Field Communication ) related circuitry, which is not limiting of the application.

The display screen 1005 is used to display a UI (User Interface). The UI may include graphics, text, icons, video, and any combination thereof. When the display 1005 is a touch screen, the display 1005 also has the ability to capture touch signals at or above the surface of the display 1005. The touch signal may be input to the processor 1001 as a control signal for processing. At this time, the display 1005 may also be used to provide virtual buttons and/or virtual keyboards, also referred to as soft buttons and/or soft keyboards. In some embodiments, display 1005 may be one, disposed on the front panel of terminal 1000; in other embodiments, display 1005 may be provided in at least two, separately provided on different surfaces of terminal 1000 or in a folded configuration; in other embodiments, display 1005 may be a flexible display disposed on a curved surface or a folded surface of terminal 1000. Even more, the display 1005 may be arranged in a non-rectangular irregular pattern, i.e., a shaped screen. The display 1005 may be made of LCD (Liquid Crystal Display ), OLED (Organic Light-Emitting Diode) or other materials.

The camera assembly 1006 is used to capture images or video. Optionally, camera assembly 1006 includes a front camera and a rear camera. The front camera is disposed on the front panel of terminal 1000, and the rear camera is disposed on the rear surface of terminal 1000. In some embodiments, the at least two rear cameras are any one of a main camera, a depth camera, a wide-angle camera and a tele camera, so as to realize that the main camera and the depth camera are fused to realize a background blurring function, and the main camera and the wide-angle camera are fused to realize a panoramic shooting and Virtual Reality (VR) shooting function or other fusion shooting functions. In some embodiments, camera assembly 1006 may also include a flash. The flash lamp can be a single-color temperature flash lamp or a double-color temperature flash lamp. The dual-color temperature flash lamp refers to a combination of a warm light flash lamp and a cold light flash lamp, and can be used for light compensation under different color temperatures.

The audio circuit 1007 may include a microphone and a speaker. The microphone is used for collecting sound waves of users and environments, converting the sound waves into electric signals, and inputting the electric signals to the processor 1001 for processing, or inputting the electric signals to the radio frequency circuit 1004 for voice communication. For purposes of stereo acquisition or noise reduction, the microphone may be multiple, each located at a different portion of terminal 1000. The microphone may also be an array microphone or an omni-directional pickup microphone. The speaker is used to convert electrical signals from the processor 1001 or the radio frequency circuit 1004 into sound waves. The speaker may be a conventional thin film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, not only the electric signal can be converted into a sound wave audible to humans, but also the electric signal can be converted into a sound wave inaudible to humans for ranging and other purposes. In some embodiments, audio circuit 1007 may also include a headphone jack.

Power supply 1008 is used to power the various components in terminal 1000. The power supply 1008 may be an alternating current, a direct current, a disposable battery, or a rechargeable battery. When the power supply 1008 includes a rechargeable battery, the rechargeable battery may support wired or wireless charging. The rechargeable battery may also be used to support fast charge technology.

Those skilled in the art will appreciate that the structure shown in fig. 10 is not limiting and that terminal 1000 can include more or fewer components than shown, or certain components can be combined, or a different arrangement of components can be employed.

Optionally, the computer device is provided as a server. Fig. 11 is a schematic structural diagram of a server according to an embodiment of the present application, where the server 1100 may have a relatively large difference due to different configurations or performances, and may include one or more processors (Central Processing Units, CPU) 1101 and one or more memories 1102, where at least one computer program is stored in the memories 1102, and the at least one computer program is loaded and executed by the processors 1101 to implement the methods provided in the foregoing method embodiments. Of course, the server may also have a wired or wireless network interface, a keyboard, an input/output interface, and other components for implementing the functions of the device, which are not described herein.

The embodiment of the application also provides a computer readable storage medium, in which at least one computer program is stored, the at least one computer program being loaded and executed by a processor to implement the operations performed by the data processing method of the above embodiment.

The embodiment of the present application also provides a computer program product, including a computer program, which is loaded and executed by a processor to implement the operations performed by the data processing method of the above embodiment. In some embodiments, a computer program according to an embodiment of the present application may be deployed to be executed on one computer device or on multiple computer devices located at one site, or on multiple computer devices distributed across multiple sites and interconnected by a communication network, where the multiple computer devices distributed across multiple sites and interconnected by a communication network may constitute a blockchain system.

It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program for instructing relevant hardware, where the program may be stored in a computer readable storage medium, and the storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.

The foregoing description of the embodiments of the application is merely illustrative of the principles of the embodiments of the present application, and various modifications, equivalents, improvements, etc. may be made without departing from the spirit and principles of the embodiments of the application.

Claims

1. A method of data processing, the method comprising:

detecting a received data packet to obtain an abnormality detection result, wherein the data packet is generated in the operation process of a terminal, and the abnormality detection result comprises a plurality of detected abnormality types of different levels to which the data packet belongs, and any abnormality type belongs to a subtype of an abnormality type of a previous level;

starting from the abnormal type of the first level in the abnormal detection result, searching for the node of the abnormal type in an abnormal event tree diagram, wherein the abnormal event tree diagram comprises a plurality of nodes of different levels, each node corresponds to one abnormal type, and the abnormal type corresponding to the child node of any node belongs to the subtype of the abnormal type corresponding to the node;

under the condition that the abnormal type node is found, searching the abnormal type node of the next level in the child nodes of the abnormal type node, and under the condition that the abnormal type node is not found, creating the abnormal type node until the abnormal type node of the last level is found or creating the abnormal type node of the last level;

In the node of the anomaly type of the last hierarchy, the anomaly event information of the data packet is stored.

2. The method of claim 1, wherein creating the node of the anomaly type without finding the node of the anomaly type comprises:

and under the condition that the node of the abnormal type is not found, creating a first node based on the node of the abnormal type of the previous level, determining the first node as the node of the abnormal type, wherein the first node is a child node of the abnormal type of the previous level.

3. The method of claim 1, wherein the anomaly detection result further comprises anomaly analysis information including at least one of anomaly detection basis, anomaly cause, or anomaly resolution; the method further comprises the steps of:

in case the node of the anomaly type of the last hierarchy is a newly created node, storing in said node an identification of the anomaly type of the last hierarchy and said anomaly analysis information.

4. The method of claim 1, wherein detecting the received data packet to obtain the anomaly detection result comprises:

Receiving an abnormal data packet sent by the terminal, wherein the abnormal data packet is generated when an abnormal event occurs in the operation process of the terminal;

and detecting the abnormal data packet through a first abnormal detection model to obtain the abnormal detection result, wherein the first abnormal detection model is used for detecting the abnormal type of any abnormal data packet.

5. The method of claim 1, wherein detecting the received data packet to obtain the anomaly detection result comprises:

receiving the data packet periodically sent by the terminal, wherein the data packet is any data packet generated in the operation process of the terminal;

and detecting the data packet through a second abnormality detection model to obtain an abnormality detection result, wherein the second abnormality detection model is used for detecting whether any data packet has an abnormality or not and the abnormality type of any data packet under the condition of the abnormality.

6. The method according to claim 1, wherein after storing the abnormal event information of the data packet in the node of the abnormal type of the last hierarchy, the method further comprises:

the updated abnormal event tree diagram is sent to approval equipment, and the approval equipment is used for displaying the updated abnormal event tree diagram and returning approval passing information in response to the confirmation operation of the abnormal event tree diagram;

And responding to the approval passing message, and storing the updated abnormal event tree graph in a database.

7. The method of claim 1, wherein the last level of nodes of the anomaly type further stores anomaly analysis information including at least one of anomaly detection basis, anomaly cause, or anomaly resolution; after storing the abnormal event information of the data packet in the node of the abnormal type of the last hierarchy, the method further comprises:

determining an anomaly code based on the anomaly event information;

and repairing the abnormal code based on the abnormal analysis information.

8. A data processing apparatus, the apparatus comprising:

the detection module is used for detecting the received data packet to obtain an abnormal detection result, wherein the data packet is generated in the operation process of the terminal, and the abnormal detection result comprises a plurality of detected abnormal types of different levels to which the data packet belongs, and any abnormal type belongs to the subtype of the abnormal type of the previous level;

the node processing module is used for searching the nodes of the abnormal types in an abnormal event tree diagram from the abnormal type of the first level in the abnormal detection result, wherein the abnormal event tree diagram comprises a plurality of nodes of different levels, each node corresponds to one abnormal type, and the abnormal type corresponding to the child node of any node belongs to the subtype of the abnormal type corresponding to the node;

The node processing module is further configured to, when the node of the anomaly type is found, find a node of an anomaly type of a next level in child nodes of the node of the anomaly type, and, when the node of the anomaly type is not found, create the node of the anomaly type until a node of an anomaly type of a last level is found or a node of an anomaly type of a last level is created;

and the storage module is used for storing the abnormal event information of the data packet in the node of the abnormal type of the last hierarchy.

9. A computer device comprising a processor and a memory, wherein the memory has stored therein at least one computer program that is loaded and executed by the processor to implement the operations performed by the data processing method of any of claims 1 to 7.

10. A computer readable storage medium having stored therein at least one computer program loaded and executed by a processor to implement operations performed by a data processing method as claimed in any one of claims 1 to 7.