Predicting anomalies and incidents in a computer application
A method for predicting anomalies in a computer application includes during runtime of the computer application, detecting traffic metrics and incident tickets associated with the computer application, the incident ticket indicating an incident might occur in the computer application; calculating a threshold based on absolute values of second order differences associated with the traffic metrics, wherein the threshold is such that when the absolute value of the second order difference associated with the traffic metrics exceeds the threshold, a recall rate R recall that the computer application is recalled is maximized; obtaining predicted metrics of the computer application in a next time period based on the traffic metrics; and in response to an absolute value of a second order difference associated with the predicted metrics exceeding the threshold, predicting potential anomalies of the computer application in the next time period.
1. An apparatus for predicting anomalies in a computer application, the apparatus comprising a processor configured to execute a plurality of software modules, the modules comprising:
a detecting module configured to, during runtime of the computer application, detect traffic metrics and incident tickets associated with the computer application, the incident ticket indicating an incident might occur in the computer application;
a calculating module configured to calculate a threshold based on absolute values of second order differences associated with the traffic metrics, wherein the threshold is such that when the absolute value of the second order difference associated with the traffic metrics exceeds the threshold, a recall rate R recall that the computer application is recalled is maximized, the recall rate R recall describing a ratio of the number of incident tickets causing the computer application to be recalled to the total number of the incident tickets;
an obtaining module configured to obtain predicted metrics of the computer application in a next time period based on the traffic metrics; and
a predicting module configured to, in response to an absolute value of a second order difference associated with the predicted metrics exceeding the threshold, predict potential anomalies of the computer application in the next time period.
2. The apparatus according to claim 1 , wherein the threshold is such that when the absolute value of the second order difference associated with the traffic metrics exceeds the threshold, a precision rate R precision that the computer application is recalled is maximized, the precision rate R precision describing a ratio of the number of anomalies causing the computer application to be recalled to the number of all anomalies of the computer application.
3. The apparatus according to claim 2 , wherein the calculating module comprises:
an aggregating module configured to aggregate the traffic metrics according to a predetermined time window interval so as to form standard metrics; and
a threshold calculating module configured to calculate the threshold based on absolute values of second order differences associated with the standard metrics.
4. The apparatus according to claim 3 , wherein the traffic metrics comprise at least any one type of: CPU usage rate, memory usage rate, workload, network connection and data transmission rate.
5. The apparatus according to claim 4 , further comprising:
a normalizing module configured to, before calculating the threshold based on the absolute values of the second order differences associated with the standard metrics, normalize the standard metrics with respect to the at least any one type of the traffic metrics.
6. The apparatus according to claim 5 , wherein an absolute of a second order difference associated with the standard metrics in a time window i−1 is calculated based on an equation below: |2x i −x i−1 −x i+1 |, where x i−1 , x i , x i+1 represent standard metrics with respect to three neighboring time windows.
7. The apparatus according to claim 2 , wherein the calculating module comprises:
a F β calculating module configured to calculate
F
β
=
(
1
+
β
2
)
·
R
precision
·
R
recall
β
2
·
R
precision
+
R
recall
,
where β is a weighting factor describing a weight between the recall rate R recall and the precision rate R precision ; and
a setting module configured to set a value maximizing F β as the threshold.
8. The apparatus according to claim 6 , wherein the absolute value of the second order difference associated with the predicted metrics is calculated based on:
aggregating the predicted metrics according to the predetermined time window interval so as to form standard predicted metrics y i+1 with respect to a time window i+1; and
calculating an absolute value of a second order difference associated with the standard predicted metrics y i+1 based on |2x i −x i−1 −y i+1 |.
9. The apparatus according to claim 8 , wherein the predicting module comprises:
a first predicting module configured to, with respect to at least one predetermined type among the types, predict the potential anomalies in response to an absolute value of a second order difference associated with predicted metrics of the at least one predetermined type exceeding the threshold; and
a second predicting module configured to, with respect to at least one part of types among the plurality of types, predict the potential anomalies in response to an absolute value of a second order difference associated with predicted metrics of the at least one part of types exceeding the threshold.
10. An apparatus for predicting incidents in a computer application, comprising a processor configured to execute a plurality of software modules, the modules comprising:
a detecting module configured to, during runtime of the computer application, detect anomalies and incident tickets associated with the computer application;
a building module configured to build an incident prediction model based on the anomalies and the incident tickets, the incident prediction model describing an association rule among the anomalies and the incident tickets;
an anomaly predicting module comprising modules as recited in claim 1 and configured to predict potential anomalies of the computer application in a next time period; and
an incident predicting module configured to predict potential incidents of the computer application in the next time period based on the incident prediction model and the potential anomalies.