System and method for detecting abnormal behavior of virtual machine in cloud environment

Abstract

The invention discloses a virtual machine abnormal behavior detection system and method in a cloud environment. The detection system includes a physical server cluster, a model training server and several abnormal detection node servers; the physical server cluster includes several physical servers, and each physical server is equipped with At least one virtual machine server and physical servers are connected in a certain way to form a local area network system; the simulation training server is connected to the physical server cluster and the anomaly detection node server respectively, and several physical servers correspond to and are connected to an anomaly detection node server. The detection method includes an offline training phase of the model and an online anomaly detection phase. By adopting the present invention to detect the abnormality of the virtual machine, there is no need to assume the probability distribution and dependency relationship of the data, the online abnormality detection can be realized, and the accuracy rate of the abnormality detection of the virtual machine can be improved.

Description

technical field [0001] The invention relates to a virtual machine management technology in a cloud platform, in particular to a detection of abnormal behavior of a virtual machine. Background technique [0002] Through virtualization technology, cloud computing can integrate thousands of hardware servers into a shared resource pool, and configure computing resources of virtual machines on demand. A cloud platform can manage tens of thousands of virtual machines. It is an important task in virtual machine management to timely and accurately discover abnormalities and failures that occur during virtual machine operation. [0003] Traditional anomaly detection methods can be mainly divided into two categories, supervised methods and unsupervised methods. The main difficulties currently facing include massive unlabeled high-dimensional monitoring data and the timing of data. For supervised methods, such as classification methods, although enough virtual machine data can be co...

AI Technical Summary

Problems solved by technology

Traditional statistics-based methods, such as the CUSUM method, accumulate changes in a single attribute value sequence and judge whether it is abnormal according to a preset threshold value, and cannot simultaneously deal with timing anomalies comprehensively manifested by multiple attributes

Generally, Markov model or hidden Markov model is used for time series modeling, but this type of model assumes that the current state only depends on the state of the previous time point. When the actual problem does not meet this assumption, especially the combination of multiple attributes When considered, there is a long-term dependency, which makes it difficult for this type of model to achieve satisfactory results

Images