CN118132383B

CN118132383B - Service data monitoring method, device, electronic equipment and computer readable medium

Info

Publication number: CN118132383B
Application number: CN202410332541.8A
Authority: CN
Inventors: 吕亮; 张娅娅; 徐忆安; 吴凯
Original assignee: Beijing Hengshi Technology Co ltd
Current assignee: Beijing Hengshi Technology Co ltd
Priority date: 2024-03-22
Filing date: 2024-03-22
Publication date: 2024-09-17
Anticipated expiration: 2044-03-22
Also published as: CN118132383A

Abstract

The embodiment of the disclosure discloses a service data monitoring method, a device, an electronic device and a computer readable medium. One embodiment of the method comprises the following steps: performing feature screening processing on the operation data field information set to obtain an operation data feature information set; vectorizing the operation data of each application to obtain the characteristic vector of each operation data; clustering the operation data characteristic information groups according to the operation data characteristic vectors to obtain target characteristic information group sets; mapping each service data set to preset table structure information to obtain each target service data set; storing each target service data set into a database; and carrying out visualization processing on each target service data set stored in the database according to the selected service data monitoring template. The embodiment simplifies the monitoring flow, shortens the acquisition delay of the monitoring result and reduces the resource consumption of the server.

Description

Service data monitoring method, device, electronic equipment and computer readable medium

Technical Field

Embodiments of the present disclosure relate to the field of computer technology, and in particular, to a service data processing method, apparatus, electronic device, and computer readable medium.

Background

The service data monitoring can analyze and count data generated in the running of the target application so as to find out the details and abnormal conditions of each service in the application. At present, the main mode of monitoring service data is that a user exports a target application log to a third-party monitoring system server, the third-party monitoring system server analyzes the service data and gives feedback, or the third-party monitoring system is deployed in a target application environment, and the third-party monitoring system is directly connected with a target application to monitor the service data.

In practice, when the above manner is adopted to monitor service data, the following technical problems often exist:

The monitoring system service provider analyzes the service data and gives feedback to the service provider to be subjected to a series of processes of collecting application data, downloading and sending, receiving the data by the monitoring system service provider, analyzing and analyzing the result, and feeding back the result, wherein the process is complex, the monitoring result is obtained with larger delay, and a user is required to continuously cooperate with the exported data to a third-party monitoring system service side, so that more human resources are consumed; the third-party monitoring system is directly abutted to the target application, and the third-party monitoring system needs to be deployed to a server corresponding to the target application, so that the consumption of server resources is high, and the operation and maintenance cost is high.

The above information disclosed in this background section is only for enhancement of understanding of the background of the inventive concept and, therefore, may contain information that does not form the prior art that is already known to those of ordinary skill in the art in this country.

Disclosure of Invention

The disclosure is in part intended to introduce concepts in a simplified form that are further described below in the detailed description. The disclosure is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

Some embodiments of the present disclosure propose a business data monitoring method, apparatus, electronic device, and computer readable medium to solve one or more of the technical problems mentioned in the background section above.

In a first aspect, some embodiments of the present disclosure provide a service data monitoring method, including: acquiring an application running data set of a target application; preprocessing the application running data set to obtain a running data field information set, wherein the running data field information set in the running data field information set corresponds to the application running data in the application running data set one by one; performing feature screening processing on the running data field information set according to each piece of preset service feature information to obtain a running data feature information set, wherein the number of the pieces of preset service feature information in each piece of preset service feature information is equal to the number of the running data feature information in the running data feature information set; vectorizing each operation data characteristic information group in the operation data characteristic information group set to obtain each operation data characteristic vector; clustering each operation data characteristic information group in the operation data characteristic information group set according to each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set; mapping each service data set to preset table structure information to obtain each target service data set; storing each target service data set to an associated database; and responding to the detection of the selection operation of the service data monitoring template acting on the service data monitoring page, and carrying out visualization processing on each target service data set stored in the database according to the selected service data monitoring template so as to monitor the service data, wherein the service data monitoring page corresponds to the target application.

In a second aspect, some embodiments of the present disclosure provide a service data monitoring apparatus, the apparatus including: an acquisition unit configured to acquire an application running data set of a target application; the preprocessing unit is configured to preprocess the application running data set to obtain a running data field information set, wherein the running data field information set in the running data field information set corresponds to the application running data in the application running data set one by one; the screening processing unit is configured to perform feature screening processing on the operation data field information set according to each piece of preset service feature information to obtain an operation data feature information set, wherein the number of the preset service feature information in each piece of preset service feature information is equal to the number of the operation data feature information in the operation data feature information set; the vectorization processing unit is configured to vectorize each operation data characteristic information group in the operation data characteristic information group set to obtain each operation data characteristic vector; the clustering processing unit is configured to perform clustering processing on each operation data characteristic information group in the operation data characteristic information group set according to each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set; the mapping unit is configured to map each service data set to preset table structure information to obtain each target service data set; a storage unit configured to store the respective target service data sets to an associated database; and the visualization processing unit is configured to respond to detection of a selection operation of a service data monitoring template acting on a service data monitoring page, and perform visualization processing on each target service data set stored in the database according to the selected service data monitoring template so as to monitor service data, wherein the service data monitoring page corresponds to the target application.

In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, which when executed by one or more processors causes the one or more processors to implement the method described in any of the implementations of the first aspect above.

In a fourth aspect, some embodiments of the present disclosure provide a computer readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

The above embodiments of the present disclosure have the following advantageous effects: by the service data monitoring method of some embodiments of the present disclosure, the monitoring flow is simplified, the monitoring result acquisition delay is shortened, and the server resource consumption is reduced. Specifically, the reasons for the complicated monitoring flow, the larger monitoring result acquisition delay and the more server resource consumption are as follows: the monitoring system service provider analyzes the service data and gives feedback to the service provider to be subjected to a series of processes of collecting application data, downloading and sending, receiving the data by the monitoring system service provider, analyzing and analyzing the result, and feeding back the result, wherein the process is complex, the monitoring result is obtained with larger delay, and a user is required to continuously cooperate with the exported data to a third-party monitoring system service side, so that more human resources are consumed; The third-party monitoring system is directly abutted to the target application, and the third-party monitoring system needs to be deployed to a server corresponding to the target application, so that the consumption of server resources is high, and the operation and maintenance cost is high. Based on this, the service data monitoring method of some embodiments of the present disclosure first obtains an application running data set of a target application. Thus, the application running data set generated by the target application in real time can be obtained. And then preprocessing the application running data set to obtain a running data field information set, wherein the running data field information set in the running data field information set corresponds to the application running data in the application running data set one by one. Thus, each application operation data after the preprocessing can be obtained. And then, carrying out feature screening processing on the operation data field information set according to each piece of preset service feature information to obtain an operation data feature information set, wherein the number of the preset service feature information in each piece of preset service feature information is equal to the number of the operation data feature information in the operation data feature information set. Thus, each operation data characteristic information group after the screening processing can be obtained. Unnecessary fields in the set of operational data characteristic information may be removed. And then, vectorizing each operation data characteristic information group in the operation data characteristic information group set to obtain each operation data characteristic vector. Thus, each of the operation data feature vectors corresponding to each of the operation data feature information groups can be obtained. And then, clustering each operation data characteristic information group in the operation data characteristic information group set according to each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set. Thus, individual sets of traffic data characterizing different traffic classes can be obtained. And then mapping each service data set to preset table structure information to obtain each target service data set. Thus, each target service data set consistent with the preset table structure information structure can be obtained. And then, storing the target business data sets into an associated database. Thus, each target service data set can be stored in the database corresponding to the target application. And finally, responding to the detection of the selection operation of the service data monitoring template acting on the service data monitoring page, and carrying out visualization processing on each target service data set stored in the database according to the selected service data monitoring template so as to monitor the service data, wherein the service data monitoring page corresponds to the target application. Therefore, the service data can be monitored and displayed according to the service data monitoring template. The service data monitoring method can directly butt-joint the database of the target application and the service data monitoring template, acquire each application running data of the target application from the target application and perform a series of processing to form a data table with the same table structure as the database of the target application, thereby directly adopting the service data monitoring template built in the target application to monitor the service data of the target application, omitting the step of transmitting data to a third party monitoring system for processing, reducing the delay of acquiring the monitoring result, and saving the cost of server resources and operation and maintenance of the third party monitoring system without deploying the third party monitoring system in the target application environment. and the manual participation is not needed, so that the consumption of human resources is reduced.

Drawings

The above and other features, advantages, and aspects of embodiments of the present disclosure will become more apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings. The same or similar reference numbers will be used throughout the drawings to refer to the same or like elements. It should be understood that the figures are schematic and that elements and components are not necessarily drawn to scale.

FIG. 1 is a flow chart of some embodiments of a traffic data monitoring method according to the present disclosure;

FIG. 2 is a schematic structural diagram of some embodiments of a traffic data monitoring device according to the present disclosure;

Fig. 3 is a schematic structural diagram of an electronic device suitable for use in implementing some embodiments of the present disclosure.

Detailed Description

Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete. It should be understood that the drawings and embodiments of the present disclosure are for illustration purposes only and are not intended to limit the scope of the present disclosure.

It should be noted that, for convenience of description, only the portions related to the present invention are shown in the drawings. Embodiments of the present disclosure and features of embodiments may be combined with each other without conflict.

It should be noted that the terms "first," "second," and the like in this disclosure are merely used to distinguish between different devices, modules, or units and are not used to define an order or interdependence of functions performed by the devices, modules, or units.

It should be noted that references to "one", "a plurality" and "a plurality" in this disclosure are intended to be illustrative rather than limiting, and those of ordinary skill in the art will appreciate that "one or more" is intended to be understood as "one or more" unless the context clearly indicates otherwise.

The names of messages or information interacted between the various devices in the embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

The present disclosure will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.

Fig. 1 illustrates a flow 100 of some embodiments of a traffic data monitoring method according to the present disclosure. The service data monitoring method comprises the following steps:

Step 101, acquiring an application running data set of a target application.

In some embodiments, an executing body (e.g., computing device) of the business data monitoring method may obtain an application running data set of the target application. The target application may be an application of service data to be monitored. The application running data set may be each log data generated in the target application running process. In practice, the execution body may acquire the application running data set of the target application from the log server corresponding to the target application.

And 102, preprocessing the application operation data set to obtain an operation data field information set.

In some embodiments, the execution body may preprocess the application running data set to obtain a running data field information set. The running data field information set may be obtained by preprocessing each application running data in the application running data set. The running data field information groups in the running data field information group set may correspond to the application running data in the application running data set one by one. The operation data field information group in the operation data field information group set may be each field information included in the application operation data. The above-mentioned respective field information may be respective fields and field values corresponding to the respective fields. In practice, the execution body may perform preprocessing on the application running data set according to various modes to obtain a running data field information set.

In some optional implementations of some embodiments, the executing body may preprocess the application running data set to obtain a running data field information set by:

And the first step, carrying out data segmentation processing on each application operation data in the application operation data set to obtain each operation data field information group. The running data field information groups in the running data field information groups can be in one-to-one correspondence with the application running data in the application running data. The operation data field information group in each operation data field information group may be each field information obtained by dividing the application operation data. The above-described respective field information may include, but is not limited to, a plurality of the following: user ID, timestamp, application state information, user interaction information, event ID event type, event description information, data source, business object ID, log level, exception or error code. The application state information may be state information of the target application in running. For example, the application state information may include memory usage, CPU usage, network connection state, and the like. The user interaction information can represent the interaction process of the user and the target application. For example, the user interaction information may include user operations, input content, response results, and the like. The event description information may characterize the specifics of the event. For example, the event description information may include error messages, warning information, operation records, and the like. The data sources may be sources of data for events or operations. For example, the data source may be a particular system, application, device, or interface. In practice, the execution body may perform data segmentation processing on each application running data in the application running data set according to a preset segmenter, so as to obtain each running data field information set. For example, the preset segmenter may be tab.

And secondly, filtering the operation data field information groups according to preset field values and preset field information to obtain the operation data field information groups after filtering. The preset field information may be a timestamp. Here, the specific setting of the preset field value is not limited. For example, the preset field value may be 8. In practice, the execution body may delete the running data field information sets with the number of application running data smaller than the preset field value or with the empty time stamp in the running data field information sets, so as to perform filtering processing on the running data field information sets, and obtain the running data field information sets after filtering processing.

And thirdly, performing de-duplication processing on each operation data field information group after filtering processing to obtain each operation data field information group after de-duplication processing. In practice, the execution body may perform deduplication on each operation data field information set after the filtering process according to the user ID and the timestamp, to obtain each operation data field information set after the deduplication process.

And step four, determining each operation data field information group after the duplication elimination processing as an operation data field information group set.

And 103, performing feature screening processing on the operation data field information set according to each piece of preset service feature information to obtain an operation data feature information set.

In some embodiments, the executing body may perform feature screening processing on the running data field information set according to each preset service feature information to obtain a running data feature information set. The number of the preset service characteristic information in each preset service characteristic information may be equal to the number of the operation data characteristic information in the operation data characteristic information group. The above-mentioned each preset service characteristic information may be each operation data field information characterizing a service data characteristic. The preset service characteristic information in the above-mentioned each preset service characteristic information may be, but is not limited to, one of the following: user ID, timestamp, event ID event type, event description information, data source, business object ID, exception or error code.

And 104, vectorizing each operation data characteristic information group in the operation data characteristic information group set to obtain each operation data characteristic vector.

In some embodiments, the execution body may perform vectorization representation on each operation data feature information group in the operation data feature information group set to obtain each operation data feature vector. Wherein each of the operational data feature vectors may characterize each of the operational data feature information sets. In practice, the execution body may perform vectorization representation on each operation data feature information group in the operation data feature information group set in various manners, so as to obtain each operation data feature vector.

In some optional implementations of some embodiments, the executing entity may vectorize each operation data feature information group in the operation data feature information group set to obtain each operation data feature vector by:

For each of the above-described respective sets of operational data characteristic information, the following steps are performed:

and firstly, performing splicing processing on the operation data characteristic information group to obtain splicing characteristic information. The splicing characteristic information may be obtained by splicing each piece of operation data characteristic information in the operation data characteristic information group. In practice, the execution body may splice each piece of the operation data characteristic information in the operation data characteristic information group into a character string. The spliced character string may then be determined as splice feature information.

And secondly, inputting the spliced characteristic information into a pre-trained operation data characteristic vector extraction model to obtain an operation data characteristic vector corresponding to the spliced characteristic information. The operation data feature vector extraction model can represent the relation between the splicing feature information and the operation data feature vector. The operation data feature vector extraction model may be a neural network model obtained by training with the spliced feature information as input and the operation data feature vector as output. For example, the neural network model may be a Sentence-BERT model.

And 105, clustering each operation data characteristic information group in the operation data characteristic information group set according to each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set.

In some embodiments, the executing body may perform clustering processing on each operation data feature information set in the operation data feature information set according to each operation data feature vector, so as to obtain each target feature information set to be used as each service data set. Wherein, each target feature information group set can represent the target feature information group set of each different service category. For example, the traffic class may be, but is not limited to, one of the following: user-related data categories, transaction-related data categories, product-related data categories, run-related data categories, and system log-related data categories. In practice, the executing body may perform clustering processing on each operation data feature information set in the operation data feature information set according to each operation data feature vector in various manners, so as to obtain each target feature information set to be used as each service data set.

Continuing, when the clustering processing is performed on each operation data characteristic information group in the operation data characteristic information group set according to each operation data characteristic vector, the following technical problem II further exists:

Since application operation data generally contains features of multiple dimensions, when a distance or density-based clustering algorithm (e.g., K-Means clustering, hierarchical clustering, DBSCAN algorithm) is adopted to cluster the application operation data, the computation complexity is high, and thus the clustering efficiency is low. And in the feature space, data points of some areas of the application running data set may be relatively dense, other areas may be sparse, the number of clusters needs to be preset by the K-Means algorithm, and incorrect selection may result in lower accuracy of clustering results. If clusters with large density differences exist in the application running data set, it may be difficult to identify the clusters with large density differences at the same time by using a DBSCAN algorithm, so that the accuracy of the clustering result is low.

In some optional implementations of some embodiments, the executing body may perform clustering processing on each operation data feature information set in the operation data feature information set according to each operation data feature vector, to obtain each target feature information set as each service data set, where each target feature information set is set to be used as each service data set:

And first, mapping each operation data characteristic vector into an initial network diagram. Wherein a node in each node of the initial network map corresponds to an operational data feature vector in each operational data feature vector. The nodes in each node of the initial network diagram are in one-to-one correspondence with the operation data feature vectors in each operation data feature vector. There may be no edges in the initial state of the initial network graph.

And secondly, clustering each operation data characteristic information group corresponding to each operation data characteristic vector based on the initial network diagram and each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set.

In some optional implementations of some embodiments, the executing body may perform clustering processing on each set of operation data feature information corresponding to each operation data feature vector based on an initial network diagram and each operation data feature vector, to obtain each set of target feature information set as each set of service data set by:

The first step, for each node in the initial network diagram, connecting the node with each node different from the node in the initial network diagram to obtain a fully connected network diagram. Wherein, a connecting edge exists between any two nodes in the fully-connected network diagram.

Second, for each node in the fully-connected network graph, the following steps are performed:

And a first sub-step, marking the nodes. In practice, the execution body may set a preset flag value corresponding to the node in the preset flag value sequence to 1, so as to perform a flag processing on the node. The preset marking values in the preset marking value sequence are in one-to-one correspondence with the nodes in the fully connected network diagram. The initial value of each preset flag value in the preset flag value sequence may be 0.

And a second sub-step of determining each node which is not marked in the nodes as each node to be processed. The nodes to be processed may be untagged and the similarity between the nodes to be determined may be nodes to be processed.

And a third sub-step of determining similarity information between the nodes and the nodes to be processed for each of the determined nodes to be processed, and obtaining each piece of similarity information. The similarity information may be a similarity between each operation data feature vector represented by the node to be processed and each operation data feature vector represented by the node. In practice, for each of the determined nodes to be processed, the execution body may input the operation data feature vector corresponding to the node and the operation data feature vector corresponding to the node to be processed into a kernel function, to obtain an output result as similarity information between the node and the node to be processed.

And thirdly, constructing an adjacent matrix corresponding to each node according to each similarity information corresponding to each node in the full-connection network diagram. In practice, first, the execution body may determine the number of nodes in the fully-connected graph as the number of rows and columns. The determined number of rows and columns may then be determined as the number of rows and columns of the preset initial adjacency matrix. The nodes in the nodes can be in one-to-one correspondence with the row labels in the row labels of the preset initial adjacent matrix. The nodes in the nodes may correspond to the column labels in the column labels of the preset matrix one by one. And then, for each node in the fully-connected network graph, filling each piece of similarity information corresponding to the node into a target row corresponding to the node. The target row may be a row corresponding to the node in the preset initial adjacency matrix.

And fourthly, constructing a degree matrix corresponding to the fully-connected network diagram. In practice, first, the execution body may determine the number of nodes in the fully-connected graph as the number of rows and columns. Then, the determined number of rows and columns may be determined as the number of rows and columns of the preset initial matrix. Then, each element of the preset initialization matrix is set to 0. And then, filling the degree of each node in the full-connection network graph into a target position corresponding to the node to obtain a degree matrix corresponding to the full-connection network graph. The target position may be a position represented by a row label and a column label corresponding to the node in the preset initial matrix.

And fifthly, constructing a target difference matrix according to the adjacency matrix and the degree matrix. In practice, the execution body may determine a difference between the degree matrix and the adjacency matrix as a target difference matrix.

And sixthly, carrying out standardization processing on the target difference matrix to obtain a standardized target difference matrix. The normalized target difference matrix may be a normalized target difference matrix. In practice, first, the execution body may determine the negative power of each element on the degree matrix principal diagonal as each target element. Then, each element on the main diagonal of the preset diagonal matrix can be replaced by each target element, so that a target diagonal matrix is obtained. Then, the result of multiplying the target diagonal matrix by the target difference matrix by the target diagonal matrix may be determined as a normalized target difference matrix. The order of the predetermined diagonal matrix may be equal to the order of the degree matrix. The predetermined diagonal matrix may be a negative power of one-half of the degree matrix.

And seventh, determining each characteristic value of the standardized target difference matrix. In practice, the executing entity may determine each eigenvalue of the normalized target difference matrix through an eigenvalue solution algorithm.

And eighth, determining each characteristic value meeting the preset characteristic value condition in the characteristic values as each target characteristic value. The preset feature value condition may be that the feature values are arranged in the preset numerical values before the feature values in ascending order. Here, the specific setting of the preset numerical values is not limited.

And ninth, carrying out standardization processing on each feature vector corresponding to each target feature value to obtain each standard feature vector. The standard feature vectors may be normalized feature vectors. In practice, for each of the respective feature vectors, the execution body may divide the feature vector by a modulus of the feature vector to obtain a standard feature vector.

And tenth, combining the standard feature vectors into a target feature matrix. The number of rows of the target feature matrix may be equal to the number of the nodes. The number of columns of the target feature matrix may be equal to the number of the respective standard feature vectors. In practice, the execution body may combine the transpose vectors of the standard feature vectors as column vectors to obtain a matrix having the number of columns of the transpose vectors as the target feature matrix.

And eleventh step, determining the vector corresponding to each row in the target feature matrix as a sample vector, and obtaining each sample vector.

And twelfth, inputting each sample vector into a preset clustering model to obtain each clustering sample vector set. The preset clustering model may be, but not limited to, one of the following: K-Means clustering, hierarchical clustering and DBSCAN algorithm.

Thirteenth, for each of the above-mentioned clustered sample vector sets, determining each of the operation data feature information sets corresponding to each of the clustered sample vectors in the above-mentioned clustered sample vector set as a target feature information set, and obtaining each of the target feature information sets as each of the service data sets.

The related content of the first step to the thirteenth step of the above technical solution is taken as an invention point of the embodiments of the present disclosure, which solves the second technical problem that the efficiency of clustering and the accuracy of the clustering result are lower. Factors that lead to lower clustering efficiency and accuracy of the clustering result tend to be as follows: since application operation data generally contains features of multiple dimensions, when a distance or density-based clustering algorithm (e.g., K-Means clustering, hierarchical clustering, DBSCAN algorithm) is adopted to cluster the application operation data, the computation complexity is high, and thus the clustering efficiency is low. And in the feature space, data points of some areas of the application running data set may be relatively dense, other areas may be sparse, the number of clusters needs to be preset by the K-Means algorithm, and incorrect selection may result in lower accuracy of clustering results. If clusters with large density differences exist in the application running data set, it may be difficult to identify the clusters with large density differences at the same time by using a DBSCAN algorithm, so that the accuracy of the clustering result is low. If the factors are solved, the effects of improving the clustering efficiency and the accuracy of the clustering result can be achieved. In order to achieve the effect, the method introduces a clustering method based on graph theory, maps application operation data to nodes in a network graph, solves optimal clustering by converting a clustering problem into an optimal partitioning problem of the graph, can map the application operation data in a multidimensional space to a low-dimensional space, and then performs clustering in the low-dimensional space, so that the calculation complexity is reduced, and the clustering efficiency is improved. And the weight of the edges connecting different clusters is as low as possible, and the weight of the edges of the nodes in the clusters is as high as possible by the method for solving the optimal partition of the graph, so that the complex structure of the data can be captured, and the accuracy of the application operation data clustering is improved.

And 106, mapping each service data set to preset table structure information to obtain each target service data set.

In some embodiments, the executing body may map the respective service data sets to preset table structure information to obtain respective target service data sets. The target service data sets may represent application running data corresponding to different service classes. In practice, the executing body may map the service data sets to preset table structure information in various manners to obtain each target service data set.

In some optional implementations of some embodiments, the executing body may map the respective service data sets to preset table structure information to obtain respective target service data sets by:

For each of the respective sets of business data, the following steps are performed:

the first step, for each service data in the service data set, performs the following steps:

And a first sub-step of determining each field information corresponding to each target feature information in the service data according to a preset mapping relation information set. Wherein, the service data can comprise each target characteristic information. The respective field information may be included in the preset table structure information. The target feature information in the respective target feature information may correspond to field information in the respective field information. The preset mapping relation information set can represent the corresponding relation between the target characteristic information and the field information in the preset table structure information. The preset mapping relationship information in the preset mapping relationship information set may include target feature information and field information corresponding to the target feature information. In practice, for each piece of target feature information in the service data, the executing body may determine, as field information corresponding to the target feature information, field information included in preset mapping relationship information corresponding to the target feature information in the preset mapping relationship information set, to obtain each piece of field information.

And a second sub-step, for each piece of target feature information in the service data, performing data conversion processing on the target feature information according to the field information corresponding to the target feature information, and obtaining the target feature information after the data conversion processing. In practice, for each target feature information in the service data, in response to determining that the data type of the target feature information is different from the data type of the field information, the execution body may convert the data type of the target feature information into the data type of the field information corresponding to the target feature information. For example, the data type may be, but is not limited to, one of the following: int type, string type, char type.

And a third sub-step, determining each piece of target characteristic information after the obtained data conversion processing as target service data.

And a second step of determining each determined target service data as a target service data set.

Step 107, each set of target business data is stored to an associated database.

In some embodiments, the executing entity may store the respective target business data sets to an associated database. The associated database may be a database corresponding to the target application. In practice, the executing entity may store the respective target service data sets to the associated databases in various manners.

And step 108, in response to detecting the selection operation of the service data monitoring template acting on the service data monitoring page, performing visualization processing on each target service data set stored in the database according to the selected service data monitoring template so as to monitor the service data.

In some embodiments, in response to detecting a selection operation of the service data monitoring template acting on the service data monitoring page, the executing body may perform a visualization process on each target service data set stored in the database according to the selected service data monitoring template, so as to monitor service data. The service data monitoring page may correspond to the target application. And displaying a data monitoring control in an application page of the target application. In some embodiments, the business data monitor page may be displayed in response to detecting a selection operation of the data monitor control acting on the application page. And each selection control corresponding to each business data monitoring template is displayed in the business data monitoring page. The service data monitoring template may be a template for performing visual monitoring on service data. The traffic data monitoring template may include, but is not limited to, a plurality of the following: at least one database query statement, a visual chart type, a visual chart style, various field information, various data normalization functions, data aggregation information. For example, the visualization chart type may be, but is not limited to, one of the following: bar graph, line graph, scatter graph, thermodynamic diagram, instrument panel. The visual chart style may be a style of displaying a visual chart corresponding to the visual chart type. The visual chart style may include display colors, display fonts, display font sizes, etc. of the various portions of the visual chart. The field information in the above-mentioned respective field information may include a field name, a field data type, a field data range. The data normalization function of each data normalization function corresponds to the field information of each field information. The data aggregation information may characterize a method of performing an aggregation operation on the preset field value at a time interval. The data aggregation information may include each field, an aggregation operation corresponding to each field, and an aggregation time window. For example, the polymerization operation may be, but is not limited to, one of the following: summing, averaging, maximum, minimum.

In some optional implementations of some embodiments, in response to detecting a selection operation of a service data monitoring template acting on a service data monitoring page, the executing entity may perform a visualization process 6 on each target service data set stored in the database according to the selected service data monitoring template by:

for each of the respective target service data sets, performing the steps of:

And the first step is to query the target business data set stored in the database according to at least one database query statement included in the business data monitoring template to obtain at least one query result information. The query result information may represent a result obtained by querying the target service data set in the database. The query result information may include individual query field information. The query field information in the respective query field information may include a field name and a field value corresponding to the field name.

And secondly, carrying out missing value filling processing on the at least one piece of query result information to obtain at least one piece of filled query result information. The filling query result information may be query result information after filling the missing value. In practice, first, the executing body may predict each missing value in the query result information by adopting a regression method to obtain each predicted value. Then, the predicted values may be filled into the query result information to obtain filled query result information.

And thirdly, carrying out data normalization processing on the at least one filling query result information according to the field information included in the service data monitoring template to obtain at least one filling query result information after data normalization processing. Wherein, the field information in each field information corresponds to the query field information in each query field information in the filling query result information one by one. In practice, first, for each query field information in the respective query field information in the filled query result information, the execution body may input the query field information into a data normalization function corresponding to the query field information, to obtain query field information after normalization processing. Then, the obtained query field information after each normalization process may be determined as the filled query result information after the data normalization process.

And fourthly, carrying out aggregation processing on at least one piece of filling query result information subjected to data normalization processing according to the service data monitoring template to obtain at least one piece of filling query result information subjected to aggregation processing. In practice, the execution body may perform aggregation processing on each target field value included in the filled query result information after the data normalization processing according to the aggregation time window and the aggregation operation included in the data aggregation information, so as to obtain the filled query result information after the aggregation processing.

And fifthly, carrying out visual display on at least one aggregated filling query result information according to the visual chart type and the visual chart style included in the service data monitoring template.

Optionally, first, the executing body may further perform anomaly detection processing on the service data sets to obtain anomaly detection result information. The anomaly detection result information can represent anomaly probability of each target feature information set. In practice, the executing body may adopt various modes to perform abnormality detection processing on the target feature information set to obtain abnormality detection result information.

And then, determining each service data set corresponding to each abnormal detection result information meeting the preset abnormal condition in the abnormal detection result information as each abnormal service data set. The preset abnormal condition may be that the information of the abnormal detection result is greater than a preset abnormal value. Here, the specific setting of the preset abnormal value is not limited. The abnormal service data sets may be service data sets with abnormal detection result information greater than a preset abnormal value.

And finally, sending the abnormal early warning information corresponding to the abnormal service data sets to the associated terminal equipment. The abnormal early warning information in the abnormal early warning information may be a prompt information for prompting that the abnormal business data set has abnormal data. The terminal device may be, but is not limited to: a mobile phone and a computer. In practice, the executing body may send, by means of wired connection or wireless connection, each anomaly early warning information corresponding to each anomaly service data set to an associated terminal device.

It should be noted that the wireless connection may include, but is not limited to, 3G/4G connection, wiFi connection, bluetooth connection, wiMAX connection, zigbee connection, UWB (ultra wideband) connection, and other now known or later developed wireless connection.

Continuing, when the abnormality detection processing is performed on each target feature information set by adopting the present disclosure, the following technical problem three further exists:

Because the application running dataset is in the feature space, data points of certain areas can be relatively dense, other areas can be sparse, and for each cluster with larger data density difference, a traditional abnormal cluster detection method based on statistics or distance is adopted, so that clusters with lower data density are identified as abnormal clusters, and the detection accuracy of the abnormal clusters is lower.

In some optional implementations of some embodiments, the executing body may perform anomaly detection processing on each service data set to obtain each anomaly detection result information through the following steps:

The first step, for each of the respective service data sets, performs the steps of:

And a first sub-step of generating a center feature vector corresponding to the service data set according to the operation data feature vector corresponding to each service data in the service data set. The center feature vector may represent a cluster center of the service data set. In practice, the executing body may determine an average vector of the operation data feature vectors corresponding to the respective service data in the service data set as a center feature vector corresponding to the service data set.

And a second sub-step of determining, for each service data in the service data set, a first deviation vector between the operation data feature vector corresponding to the service data and the center feature vector, and obtaining each first deviation vector. The first deviation vectors may be vector differences between operation data feature vectors corresponding to the service data in the service data set and the center feature vector. In practice, the executing body may determine, as each first deviation vector, an absolute value of a vector difference between each operation data feature vector corresponding to each service data in the service data set and the center feature vector.

A third sub-step of, for each of the above-described respective first deviation vectors, performing the steps of:

and a first determining step of determining, as each target first deviation vector, each first deviation vector different from the first deviation vector among the first deviation vectors.

And a second determining step of determining a first deviation value of each target first deviation vector in the first deviation vector and each target first deviation vector to obtain each first deviation value. Wherein each of the first deviation values may be a result of each dot product between the first deviation vector and each of the target first deviation vectors. In practice, the execution body may determine, as the first deviation value, a result of a dot product of each of the target first deviation vectors and the first deviation vector, to obtain each first deviation value.

And a fourth sub-step, carrying out averaging treatment on each obtained first deviation value to obtain each averaged first deviation value. In practice, first, the execution body may determine the sum of the respective first deviation values as a first total deviation value. Then, each of the first deviation values may be divided by the first total deviation value to obtain the averaged first deviation values.

And a fifth sub-step, constructing an intra-class difference matrix corresponding to the service data set according to each first deviation value after the averaging treatment. The intra-class difference matrix may represent a distribution condition of operation data feature vectors corresponding to each service data in the service data set around a central feature vector. The operation data feature vector corresponding to each service data in the service data set corresponds to each first deviation value. In practice, first, the execution body may use each first offset value corresponding to the operation data feature vector corresponding to each operation data in the operation data set as a row vector to obtain each row vector. The various row vectors may then be combined into an intra-class difference matrix corresponding to the set of business data.

And secondly, determining the trace of each intra-class difference matrix in the obtained intra-class difference matrices as a first target difference value, and obtaining each first target difference value.

Third, for each of the obtained respective center feature vectors, the following steps are performed:

a first sub-step of determining each of the center feature vectors different from the center feature vector as each of the target center feature vectors.

And a second sub-step of determining, for each of the target center feature vectors, a second deviation vector between the center feature vector and the target center feature vector, and obtaining each second deviation vector. Wherein, each second deviation vector may be each difference vector between each central feature vector. In practice, for each of the target center feature vectors, the execution body may determine an absolute value of a vector difference between the target center feature vector and the center feature vector as a second deviation vector, to obtain each second deviation vector.

A third sub-step of, for each of the above-described respective second deviation vectors, performing the following steps:

The first determining step determines each of the second deviation vectors different from the second deviation vector as a target second deviation vector.

And a second determining step of determining a second deviation value of each target second deviation vector in the second deviation vector and each target second deviation vector to obtain each second deviation value. In practice, the execution body may determine, as the second deviation value, a result of a dot product of each of the target second deviation vectors and the second deviation vector, to obtain each second deviation value.

And step four, carrying out averaging treatment on each obtained second deviation value to obtain each second deviation value after the averaging treatment. In practice, first, the execution body may determine the sum of the respective second deviation values as the second total deviation value. Then, each of the second deviation values may be divided by the second total deviation value to obtain a averaged second deviation value.

Fifthly, constructing an inter-class difference matrix corresponding to each target characteristic information set according to each second deviation value after the averaging treatment. The inter-class difference matrix may represent a data distribution condition between the service data sets. Each of the service data sets corresponds to a respective second deviation value. In practice, first, the execution body may use each second deviation value corresponding to each service data set in each service data set as a row vector to obtain each row vector. The respective row vectors may then be combined into an inter-class difference matrix corresponding to the respective traffic data sets.

And sixthly, taking the sum of all elements in each row in the obtained inter-class difference matrix as a second target difference value to obtain all second target difference values. The second target difference value in the obtained second target difference values may correspond to the first target difference value in the obtained first target difference values. The second target difference value of the obtained second target difference values may correspond to the first target difference value of the obtained first target difference values one by one. The second target difference value of the obtained second target difference values may correspond to the service data set of the service data sets. The second target difference value in each obtained second target difference value may correspond to one of the service data sets.

And seventh, for each second target difference value in the obtained second target difference values, determining the average value of the second target difference value and the first target difference value corresponding to the second target difference value as abnormal detection result information, and obtaining the abnormal detection result information.

The related content of the first step to the seventh step of the above technical solution is taken as an invention point of the embodiment of the present disclosure, which solves the third technical problem that the accuracy of abnormal cluster detection is low. Factors that lead to lower accuracy of outlier cluster detection tend to be as follows: because the application running dataset is in the feature space, data points of certain areas can be relatively dense, other areas can be sparse, and for each cluster with larger data density difference, a traditional abnormal cluster detection method based on statistics or distance is adopted, so that clusters with lower data density are identified as abnormal clusters, and the detection accuracy of the abnormal clusters is lower. If the above factors are solved, the effect of improving the accuracy of abnormal cluster detection can be achieved. In order to achieve the effect, the method for combining the intra-class difference matrix and the inter-class difference matrix of each cluster is introduced to identify abnormal clusters, the average value of the sum of the trace of each intra-class difference matrix in each intra-class difference matrix and each element in each line in the inter-class difference matrix is used as the abnormal detection result information of each cluster, the clustering effect inside the clusters is considered, the clustering effect among the clusters is considered, the situation that clusters with low data density are identified as abnormal clusters is reduced, and therefore the accuracy of abnormal cluster detection is improved.

With further reference to fig. 2, as an implementation of the method shown in the foregoing figures, the present disclosure provides some embodiments of a traffic data monitoring apparatus, which apparatus embodiments correspond to those method embodiments shown in fig. 1, and the apparatus is particularly applicable to various electronic devices.

As shown in fig. 2, the traffic data monitoring device 200 of some embodiments includes: an acquisition unit 201, a preprocessing unit 202, a screening unit 203, a vectorization processing unit 204, a clustering processing unit 205, a mapping unit 206, a storage unit 207, and a visualization processing unit 208. Wherein the acquiring unit 201 is configured to acquire an application running data set of the target application; the preprocessing unit 202 is configured to preprocess the application running data set to obtain a running data field information set, where the running data field information set in the running data field information set corresponds to the application running data in the application running data set one by one; the filtering unit 203 is configured to perform feature filtering processing on the running data field information set according to each preset service feature information to obtain a running data feature information set, where the number of preset service feature information in each preset service feature information is equal to the number of running data feature information in the running data feature information set; the vectorization processing unit 204 is configured to vectorize each operation data feature information group in the operation data feature information group set to obtain each operation data feature vector; the clustering unit 205 is configured to perform clustering processing on each operation data feature information set in the operation data feature information set according to each operation data feature vector, so as to obtain each target feature information set to be used as each service data set; the mapping unit 206 is configured to map the service data sets to preset table structure information to obtain target service data sets; the storage unit 207 is configured to store the respective target service data sets described above to an associated database; the visualization processing unit 208 is configured to perform visualization processing on each target service data set stored in the database according to the selected service data monitoring template in response to detecting a selection operation of the service data monitoring template acting on a service data monitoring page, where the service data monitoring page corresponds to the target application.

It will be appreciated that the elements described in the traffic data monitoring device 200 correspond to the various steps in the method described with reference to fig. 1. Thus, the operations, features and resulting benefits described above for the method are equally applicable to the apparatus 200 and the units contained therein, and are not described in detail herein.

Referring now to FIG. 3, a schematic diagram of an electronic device (e.g., computing device) 300 suitable for use in implementing some embodiments of the present disclosure is shown. The electronic device shown in fig. 3 is merely an example and should not impose any limitations on the functionality and scope of use of embodiments of the present disclosure.

As shown in fig. 3, the electronic device 300 may include a processing means (e.g., a central processing unit, a graphics processor, etc.) 301 that may perform various suitable actions and processes in accordance with a program stored in a Read Only Memory (ROM) 302 or a program loaded from a storage means 308 into a Random Access Memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic apparatus 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input/output (I/O) interface 305 is also connected to bus 304.

In general, the following devices may be connected to the I/O interface 305: input devices 306 including, for example, a touch screen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; an output device 307 including, for example, a Liquid Crystal Display (LCD), a speaker, a vibrator, and the like; storage 308 including, for example, magnetic tape, hard disk, etc.; and communication means 309. The communication means 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. While fig. 3 shows an electronic device 300 having various means, it is to be understood that not all of the illustrated means are required to be implemented or provided. More or fewer devices may be implemented or provided instead. Each block shown in fig. 3 may represent one device or a plurality of devices as needed.

In particular, according to some embodiments of the present disclosure, the processes described above with reference to flowcharts may be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program embodied on a computer readable medium, the computer program comprising program code for performing the method shown in the flow chart. In such embodiments, the computer program may be downloaded and installed from a network via communications device 309, or from storage device 308, or from ROM 302. The above-described functions defined in the methods of some embodiments of the present disclosure are performed when the computer program is executed by the processing means 301.

It should be noted that, the computer readable medium described in some embodiments of the present disclosure may be a computer readable signal medium or a computer readable storage medium, or any combination of the two. The computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples of the computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In some embodiments of the present disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In some embodiments of the present disclosure, however, the computer-readable signal medium may comprise a data signal propagated in baseband or as part of a carrier wave, with the computer-readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to: electrical wires, fiber optic cables, RF (radio frequency), and the like, or any suitable combination of the foregoing.

In some embodiments, the clients, servers may communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol ), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the internet (e.g., the internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future developed networks.

The computer readable medium may be contained in the electronic device; or may exist alone without being incorporated into the electronic device. The computer readable medium carries one or more programs which, when executed by the electronic device, cause the electronic device to: acquiring an application running data set of a target application; preprocessing the application running data set to obtain a running data field information set, wherein the running data field information set in the running data field information set corresponds to the application running data in the application running data set one by one; performing feature screening processing on the running data field information set according to each piece of preset service feature information to obtain a running data feature information set, wherein the number of the pieces of preset service feature information in each piece of preset service feature information is equal to the number of the running data feature information in the running data feature information set; vectorizing each operation data characteristic information group in the operation data characteristic information group set to obtain each operation data characteristic vector; clustering each operation data characteristic information group in the operation data characteristic information group set according to each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set; mapping each service data set to preset table structure information to obtain each target service data set; storing each target service data set to an associated database; and responding to the detection of the selection operation of the service data monitoring template acting on the service data monitoring page, and carrying out visualization processing on each target service data set stored in the database according to the selected service data monitoring template so as to monitor the service data, wherein the service data monitoring page corresponds to the target application.

Computer program code for carrying out operations for some embodiments of the present disclosure may be written in one or more programming languages, including an object oriented programming language such as Java, smalltalk, C ++ and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units described in some embodiments of the present disclosure may be implemented by means of software, or may be implemented by means of hardware. The described units may also be provided in a processor, for example, described as: a processor includes an acquisition unit, a preprocessing unit, a screening unit, a vectorization processing unit, a clustering processing unit, a mapping unit, a storage unit, and a visualization processing unit. The names of these units do not constitute a limitation on the unit itself in some cases, and for example, the acquisition unit may also be described as "a unit that acquires an application running data set of a target application".

The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), an Application Specific Standard Product (ASSP), a system on a chip (SOC), a Complex Programmable Logic Device (CPLD), and the like.

The foregoing description is only of the preferred embodiments of the present disclosure and description of the principles of the technology being employed. It will be appreciated by those skilled in the art that the scope of the invention in the embodiments of the present disclosure is not limited to the specific combination of the above technical features, but encompasses other technical features formed by any combination of the above technical features or their equivalents without departing from the spirit of the invention. Such as the above-described features, are mutually substituted with (but not limited to) the features having similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A method for traffic data monitoring, comprising:

acquiring an application running data set of a target application;

Preprocessing the application running data set to obtain a running data field information set, wherein the running data field information set in the running data field information set corresponds to the application running data in the application running data set one by one;

performing feature screening processing on the running data field information set according to each piece of preset service feature information to obtain a running data feature information set, wherein the number of the pieces of preset service feature information in each piece of preset service feature information is equal to the number of the running data feature information in the running data feature information set;

vectorizing each operation data characteristic information group in the operation data characteristic information group set to obtain each operation data characteristic vector;

clustering each operation data characteristic information group in the operation data characteristic information group set according to each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set;

mapping each service data set to preset table structure information to obtain each target service data set;

Storing the respective target business data sets to an associated database;

And responding to the detection of the selection operation of the service data monitoring template acting on the service data monitoring page, and carrying out visualization processing on each target service data set stored in the database according to the selected service data monitoring template so as to monitor the service data, wherein the service data monitoring page corresponds to the target application.

2. The method of claim 1, wherein the method further comprises:

Performing anomaly detection processing on each service data set to obtain each anomaly detection result information;

Determining each service data set corresponding to each abnormal detection result information meeting preset abnormal conditions in the abnormal detection result information as each abnormal service data set;

and sending the abnormal early warning information corresponding to the abnormal service data sets to the associated terminal equipment.

3. The method of claim 1, wherein the preprocessing the application running data set to obtain a running data field information set includes:

performing data segmentation processing on each application operation data in the application operation data set to obtain each operation data field information group, wherein the operation data field information groups in each operation data field information group are in one-to-one correspondence with the application operation data in each application operation data;

according to the preset field value and the preset field information, filtering the operation data field information groups to obtain filtered operation data field information groups;

Performing de-duplication treatment on each operation data field information group after filtering treatment to obtain each operation data field information group after de-duplication treatment;

And determining each operation data field information group after the duplication elimination processing as an operation data field information group set.

4. The method of claim 1, wherein the vectorizing each operational data feature information group in the set of operational data feature information groups to obtain each operational data feature vector comprises:

for each of the respective sets of operational data characteristic information, performing the steps of:

Performing splicing processing on the operation data characteristic information group to obtain splicing characteristic information;

and inputting the spliced characteristic information into a pre-trained operation data characteristic vector extraction model to obtain an operation data characteristic vector corresponding to the spliced characteristic information.

5. The method of claim 1, wherein the clustering each operational data feature information group in the operational data feature information group set according to the operational data feature vector to obtain each target feature information group set to be served as each service data set, includes:

Mapping each operation data feature vector into an initial network diagram, wherein nodes in each node of the initial network diagram correspond to operation data feature vectors in each operation data feature vector;

And clustering each operation data characteristic information group corresponding to each operation data characteristic vector based on an initial network diagram and each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set.

6. The method of claim 5, wherein the preset table structure information includes respective field information therein; mapping the service data sets to preset table structure information to obtain target service data sets, including:

For each of the respective sets of business data, performing the steps of:

for each service data in the set of service data, performing the steps of:

Determining each field information corresponding to each piece of target feature information in the service data according to a preset mapping relation information set, wherein the service data comprises each piece of target feature information, each piece of field information is included in the preset table structure information, and the target feature information in each piece of target feature information corresponds to the field information in each piece of field information;

for each piece of target feature information in the service data, carrying out data conversion processing on the target feature information according to the field information corresponding to the target feature information to obtain target feature information after the data conversion processing;

each piece of target characteristic information after the obtained data conversion processing is determined as target business data;

and determining each determined target service data as a target service data set.

7. The method of claim 1, wherein the selected business data monitoring template comprises at least one database query statement, visual chart type, visual chart style; and in response to detecting a selection operation of the service data monitoring template acting on the service data monitoring page, performing a visualization process on each target service data set stored in the database according to the selected service data monitoring template, including:

For each of the respective sets of target traffic data, performing the steps of:

according to at least one database query statement included in the service data monitoring template, query processing is carried out on the target service data set stored in the database, and at least one query result information is obtained;

performing missing value filling processing on the at least one query result information to obtain at least one filled query result information;

Performing data normalization processing on the at least one filling query result information according to each field information included in the service data monitoring template to obtain at least one filling query result information after data normalization processing;

according to the business data monitoring template, carrying out aggregation processing on at least one piece of filling query result information subjected to data normalization processing to obtain at least one piece of filling query result information subjected to aggregation processing;

and visually displaying at least one piece of aggregated filling query result information according to the visual chart type and the visual chart style included in the business data monitoring template.

8. A traffic data monitoring device comprising:

An acquisition unit configured to acquire an application running data set of a target application;

The preprocessing unit is configured to preprocess the application running data set to obtain a running data field information set, wherein the running data field information set in the running data field information set corresponds to the application running data in the application running data set one by one;

The screening processing unit is configured to perform feature screening processing on the operation data field information set according to each piece of preset service feature information to obtain an operation data feature information set, wherein the number of the preset service feature information in each piece of preset service feature information is equal to the number of the operation data feature information in the operation data feature information set;

The vectorization processing unit is configured to vectorize each operation data characteristic information group in the operation data characteristic information group set to obtain each operation data characteristic vector;

The clustering processing unit is configured to perform clustering processing on each operation data characteristic information group in the operation data characteristic information group set according to each operation data characteristic vector to obtain each target characteristic information group set to be used as each service data set;

the mapping unit is configured to map each service data set to preset table structure information to obtain each target service data set;

a storage unit configured to store the respective target service data sets to an associated database;

And the visualization processing unit is configured to respond to detection of a selection operation of a service data monitoring template acting on a service data monitoring page, and perform visualization processing on each target service data set stored in the database according to the selected service data monitoring template so as to monitor service data, wherein the service data monitoring page corresponds to the target application.

9. An electronic device, comprising:

One or more processors;

A storage means for storing one or more programs;

When executed by the one or more processors, causes the one or more processors to implement the method of any of claims 1-7.

10. A computer readable storage medium having stored thereon a computer program, wherein the computer program when executed by a processor implements the method of any of claims 1-7.