CN-121984888-A - API interface data monitoring method and device and electronic equipment

CN121984888ACN 121984888 ACN121984888 ACN 121984888ACN-121984888-A

Abstract

The application discloses a monitoring method, a device and electronic equipment of API interface data, and relates to the technical field of data security, wherein the method comprises the steps of obtaining a corresponding historical time sequence data stream based on a pre-collected historical operation index of a target API interface; and comparing the running index of the target API interface at the prediction moment with the prediction interval, and executing the abnormality judgment operation according to the comparison result. By the mode, the history sequence training-dynamic prediction interval-real-time comparison is used for replacing the one-time static threshold, so that the alarm boundary automatically stretches and contracts along with the service period, the burst flow and the system evolution, and false alarm are obviously reduced.

Inventors

HUANG TAO
ZHU XU
YIN DESHUAI
YIN FEI

Assignees

青岛海尔科技有限公司
海尔优家智能科技（北京）有限公司
青岛海尔智能家电科技有限公司

Dates

Publication Date: 20260505
Application Date: 20251229

Claims (10)

1. A method for monitoring API interface data, comprising: acquiring a corresponding historical time sequence data stream based on a pre-acquired historical operation index of a target API interface; model training is carried out on the historical time sequence data stream based on a time sequence detection algorithm, so that a prediction interval at a prediction moment is obtained; comparing the running index of the target API interface at the prediction time with the prediction interval, and executing an abnormality judgment operation according to a comparison result.
2. The method according to claim 1, wherein the performing an anomaly determination operation based on the comparison result includes: When the comparison result indicates that the abnormal operation index deviates from the corresponding prediction interval in the operation indexes, inquiring a pre-obtained abnormal judgment rule according to the abnormal operation index to obtain an abnormal root cause; Generating alarm information according to the abnormal operation index and the abnormal root cause, and outputting the alarm information.
3. The method according to claim 2, wherein before the querying of the pre-acquired abnormality determination rule according to the abnormal operation index, the method further comprises: forming a multi-index joint data set according to a plurality of collected operation indexes of the target API interface at the prediction time, wherein the plurality of operation indexes at least comprise two of QPS, response time and error rate; carrying out relevance analysis on the multi-index combined data set to obtain relevance characteristics among all operation indexes in the multi-index combined data set; And determining an abnormality judgment rule based on the association characteristic, wherein the abnormality judgment rule is used for acquiring a corresponding abnormality root cause when determining that an abnormal operation index deviates from a corresponding prediction interval.
4. A method according to claim 3, wherein said generating alert information based on said abnormal operation index and said abnormal root cause comprises: when the number of the abnormal operation indexes is a plurality, determining whether a correlation exists between the abnormal operation indexes based on the correlation characteristics; if so, determining the deviation contribution degree of each abnormal operation index, and determining the root cause type of each abnormal root cause according to the deviation contribution degree, wherein the root cause type comprises a main root cause and a secondary root cause; And generating alarm information according to the abnormal operation indexes, the abnormal root cause corresponding to each abnormal operation index and the root cause type of the abnormal root cause.
5. The method of claim 1, wherein model training the time-series data stream based on the time-series detection algorithm to obtain a prediction interval at a predicted time comprises: Based on the historical time sequence data stream, performing iterative training on a prediction model adopting the time sequence detection algorithm to optimize parameters of the prediction model, so that the prediction model learns a time evolution rule of an operation index of the target API interface in a normal service mode; obtaining a prediction interval of the prediction moment through the prediction model after iterative training; the prediction interval is used for defining an expected fluctuation range of the operation index in a normal operation state.
6. The method according to claim 5, wherein the obtaining the prediction interval of the prediction time through the iteratively trained prediction model further comprises: Obtaining a target confidence coefficient; Inputting the prediction time into the prediction model after iterative training to obtain a target predicted value; And obtaining a prediction interval based on the target prediction value, the target confidence coefficient and a preset standard prediction error.
7. The method of claim 6, wherein the obtaining the target confidence coefficient comprises: in the iterative training process, obtaining a predicted value output by the predicted model, and obtaining a model predicted error according to the predicted value and a corresponding actual value; comparing the model prediction error with a preset error fluctuation threshold to obtain a corresponding error fluctuation trend; and carrying out self-adaptive scaling on the standard confidence coefficient based on the error fluctuation trend to obtain a target confidence coefficient, wherein the standard confidence coefficient is amplified when the error fluctuation trend is in an expanded state so as to expand the width of the prediction interval, and the standard confidence coefficient is contracted when the error fluctuation trend is in a converged state so as to contract the width of the prediction interval.
8. The method of claim 6, wherein the obtaining the target confidence coefficient further comprises: Determining a target service type to which the target API interface currently belongs; Invoking a pre-established confidence coefficient mapping relation, wherein the confidence coefficient mapping relation is used for indicating the corresponding relation between the service type and the confidence coefficient; inquiring the confidence coefficient mapping relation based on the target service type to obtain a target confidence coefficient.
9. The monitoring device for the API interface data is characterized by comprising a processing module, a prediction module and a judgment module, wherein: the processing module is used for obtaining a corresponding historical time sequence data stream based on a pre-collected historical operation index of the target API interface; The prediction module is used for carrying out model training on the historical time sequence data stream based on a time sequence detection algorithm to obtain a prediction interval at a prediction moment; and the judging module is used for comparing the running index of the target API interface at the prediction time with the prediction interval and executing abnormal judging operation according to the comparison result.
10. An electronic device comprising a processor and a memory communicatively coupled to the processor; the memory stores computer-executable instructions; the processor executes computer-executable instructions stored in the memory to implement the method of any one of claims 1 to 8.

Description

API interface data monitoring method and device and electronic equipment Technical Field The present application relates to the field of interface monitoring technologies, and in particular, to a method and an apparatus for monitoring API interface data, and an electronic device. Background Under the micro-service architecture, the API is used as the only channel for data exchange between services, and the performance and availability of the API directly determine the continuity and user experience of the service system. The large promotion of the e-commerce platform, the centralized account opening of the financial transaction, the live broadcast give a course of the online education platform and other scenes all require the API to keep steady output under the environments of high concurrency, flow sudden increase and changeable modes. At present, a static threshold mechanism is commonly adopted in the industry to monitor the API in real time, namely, a fixed upper limit or a fixed lower limit is preset for core indexes such as QPS, response time, error rate and the like, and an alarm is triggered once a real-time sampling value passes through the threshold. The scheme is simple to implement and low in calculation cost, and is widely integrated in various infrastructure monitoring platforms. However, the static threshold value is configured at one time by using historical experience or manual experience, and cannot be adaptively adjusted along with the periodic variation, sudden fluctuation or system evolution of the service mode, so that the probability of early warning false alarm is improved. Disclosure of Invention The application provides a monitoring method, a device and electronic equipment of API interface data, which are used for solving the problem that static thresholds can not be adaptively adjusted along with periodic changes of service modes, sudden fluctuation or system progression and the probability of early warning false alarm is improved when the static thresholds are configured at one time through historical experience or manual experience. In a first aspect, the present application provides a method for monitoring API interface data, including: acquiring a corresponding historical time sequence data stream based on a pre-acquired historical operation index of a target API interface; Model training is carried out on the historical time sequence data stream based on a time sequence detection algorithm, so that a prediction interval of a prediction moment is obtained; comparing the running index of the target API interface at the prediction time with the prediction interval, and executing an abnormality judgment operation according to a comparison result. In one possible implementation manner, the performing an anomaly determination operation according to the comparison result includes: When the comparison result indicates that the abnormal operation index deviates from the corresponding prediction interval in the operation indexes, inquiring a pre-obtained abnormal judgment rule according to the abnormal operation index to obtain an abnormal root cause; Generating alarm information according to the abnormal operation index and the abnormal root cause, and outputting the alarm information. In a possible implementation manner, before the querying the pre-acquired abnormal judgment rule according to the abnormal operation index, the method further includes: forming a multi-index joint data set according to a plurality of collected operation indexes of the target API interface at the prediction time, wherein the plurality of operation indexes at least comprise two of QPS, response time and error rate; carrying out relevance analysis on the multi-index combined data set to obtain relevance characteristics among all operation indexes in the multi-index combined data set; And determining an abnormality judgment rule based on the association characteristic, wherein the abnormality judgment rule is used for acquiring a corresponding abnormality root cause when determining that an abnormal operation index deviates from a corresponding prediction interval. In one possible implementation manner, the generating the alarm information according to the abnormal operation index and the abnormal root cause includes: when the number of the abnormal operation indexes is a plurality, determining whether a correlation exists between the abnormal operation indexes based on the correlation characteristics; if so, determining the deviation contribution degree of each abnormal operation index, and determining the root cause type of each abnormal root cause according to the deviation contribution degree, wherein the root cause type comprises a main root cause and a secondary root cause; And generating alarm information according to the abnormal operation indexes, the abnormal root cause corresponding to each abnormal operation index and the root cause type of the abnormal root cause. In a possible implementation m