Clustering-based anomaly detection method for a large-scale irregular KPI time sequence

Abstract

The invention discloses a clustering-based anomaly detection method for a large-scale irregular KPI (Key Performance Indicator) time sequence, which comprises the following steps of: preprocessing a large-scale irregular KPI, forming a regular KPI filling matrix containing all KPI elements by using a plurality of KPIs with different lengths, and clustering the regular KPI filling matrix to obtain a plurality of sub-clusters; if the distance between the clustering center points is not smaller than a preset threshold value and the number of iterations is not larger than a preset threshold value, carrying out iteration, carrying out MF filling on the KPI in each sub-cluster to generate a sub-rule KPI filling matrix, using all the sub-rule KPI filling matrixes to synthesize a rule KPI filling matrix to serve as input of next clustering, achieving a circulation system of clustering, filling, clustering and filling; and if the distance between the clustering center points is smaller than a preset threshold value or the number of iterations is larger than a preset threshold value, considering that the whole loop iteration is completed. The large-scale irregular KPI is divided into a plurality of clustering clusters, and the same anomaly detection model is applied to each clustering cluster, so that the overhead can be effectively reduced, and high-efficiency anomaly detection is realized.

Description

technical field [0001] The invention relates to the technical field of computer network operation and maintenance, in particular to a cluster-based large-scale irregular KPI time series anomaly detection method. Background technique [0002] In the environment of large-scale computers and communication networks, in order to ensure reliable and efficient services to a large number of users, the operation and maintenance personnel of Internet services usually use some key performance indicators to monitor the service performance of these applications. For example, the number of times an application service is accessed per unit time, the transaction volume per unit time, flashbacks, network bandwidth, memory capacity, etc. These indicators are called KPI indicators (key performance indicator, KPI). [0003] KPI can be divided into two categories: regular KPI and irregular KPI. Among them, for regular KPIs, existing anomaly detection models have good detection results, but for ...

AI Technical Summary

Problems solved by technology

However, truncation or interpolation greatly affects the clustering effect

Although MF (matrices fraction, matrix decomposition) can be used to align irregular KPIs, MF confuses all KPI information, reduces the differences between classes in KPI, and the clustering error rate is higher than truncation, resulting in the final The accuracy of anomaly detection results is very low

Images