IT performance index early warning method based on time sequence analysis

Abstract

The invention belongs to the technical field of information, and discloses an IT performance index early warning method based on time sequence analysis, and the method comprises the steps: S1, inputting historical data; s2, risk detection; and S3, outputting early warning. Through fusion of statistical learning and machine learning technologies, accurate identification and early warning of three scenes of slow degradation of IT performance indexes, mode switching and capacity bottleneck are realized. The method specifically aims to improve the accuracy of performance index trend identification through a variable-point enhanced segmentation regression algorithm, and help an I T manager to more accurately evaluate the influence and trend of performance changes. Designing a cycle-adaptive double-sample hypothesis testing mechanism, and detecting and identifying switching of different load modes, especially significant changes caused by special or emergency events; and constructing a multivariable autoregressive VAR model, establishing a relation model of performance indexes and capacity indexes, evaluating capacity bottleneck conditions, and performing early warning in time.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and in particular relates to an IT performance indicator early warning method based on time series analysis. Background Art

[0002] In the operation and maintenance of modern IT systems (such as cloud computing platforms and distributed service architectures), the dynamic changes in performance indicators (including but not limited to CPU utilization, memory usage, request latency, etc.) directly determine the system's service quality and business continuity. However, current technologies for monitoring performance evolution have three core flaws:

[0003] (1) The hidden nature of slow degradation: Existing monitoring systems are inadequate in identifying slow degradation (gradual performance degradation, such as a 0.5% daily increase in response time due to a memory leak). Traditional linear trend analysis is susceptible to noise and cannot distinguish between normal fluctuations and true degradation. Complex system interactions and diverse workload patterns make simple trend detection methods susceptible to noise and short-term fluctuations, resulting in frequent false positives and missed detections.

[0004] (2) Mode switching hysteresis: Mode switching refers to the significant changes in IT system performance indicators due to special or unexpected events (such as sudden user requests, system failures, external attacks, etc.). Existing methods usually rely on fixed thresholds or simple statistical analysis, which have low accuracy and large detection delays, and cannot respond to changes in system load in real time.

[0005] (3) Capacity bottleneck prediction blind spot: In resource allocation and capacity planning, accurately predicting and warning of capacity bottlenecks is crucial. Existing technologies typically rely on empirical rules and simple statistical analysis, making it difficult to comprehensively and accurately predict when a system will reach or approach its capacity limit. Summary of the Invention

[0006] The purpose of the present invention is to provide an IT performance indicator early warning method based on time series analysis to solve the problems raised in the above background technology.

[0007] To achieve the above objectives, the present invention provides the following technical solution: an IT performance indicator early warning method based on time series analysis, the IT performance indicator early warning method comprising the following steps:

[0008] S1, historical data input: collects performance indicator data and capacity indicator data of the IT system. The performance indicator data is used for slow degradation detection and mode switching detection, and the correlation data of performance indicators and capacity indicators is used for capacity bottleneck detection;

[0009] S2, risk detection: performs the following three types of detection on the input data:

[0010] S21, slow degradation detection: identifying long-term trend changes in performance indicators through a change-point enhanced segmented regression algorithm;

[0011] S22, mode switching detection: identifying sudden changes in load patterns through a periodically adaptive two-sample hypothesis testing mechanism;

[0012] S23, capacity bottleneck detection: establishing a dynamic correlation between performance indicators and capacity indicators through a multivariate autoregressive model;

[0013] S3, warning output: Generate warning information including time, type and cause based on the detection results.

[0014] Preferably, the slow degradation detection includes:

[0015] A1,Sequence decomposition: Perform median aggregation on the performance indicator series by day to extract the trend series;

[0016] A2, change point detection: Calculate the confidence interval [mean(T)-σ·std(T),mean(T)+σ·std(T)] for the difference sequence of the trend sequence, and determine the points outside the confidence interval as change points, where σ is the sensitivity parameter;

[0017] A3, Segmented regression: Divide the difference sequence into k+1 subsequences, perform linear regression on each subsequence and calculate the goodness of fit R 2 ;

[0018] A4, judgment rule: If all subsequences R 2 If the median of exceeds the threshold θ, it is determined to be slowly deteriorating. Preferably, the linear regression equation of each subsequence Ti in the A3 segmented regression is:

[0019] T i (t) = α i +β i t+∈i

[0020] Where T i (t) is the value of the i-th subsequence at time t, α i is the intercept term, β i is the slope term, ε i is the error term;

[0021] Use the least squares method to find the optimal solution for each subsequence T i Perform linear regression parameter estimation and obtain α i and β i The estimated value of is as follows:

[0022]

[0023] where ni is a subsequence T i The length of each subsequence is used to determine the relevance of the linear regression results. 2 To assess the goodness of fit of the regression model.

[0024] Preferably, the mode switching detection includes:

[0025] B1, sample division: the data of the current period [t-Δt, t] is used as the detection sample X1, and the historical data of the same period is obtained at intervals of period T as the baseline sample X2;

[0026] B2, two-sample test: perform a t-test on X1 and X2 and calculate the p-value of the significant difference;

[0027] B3, judgment rule: If the p-value is less than the significance level α, it is judged as mode switching.

[0028] Preferably, the default value of the Δt is 30 minutes, the period T is a day or a week, and the default value of the significance level α is 0.05.

[0029] Preferably, the capacity bottleneck detection includes:

[0030] C1, multidimensional correlation analysis: The correlation between performance indicators and capacity indicators is quantified by a weighted scoring mechanism of Spearman coefficient (ρ), maximum mutual information (MIC), and dynamic time warping (DTW), with weights α = 0.4, β = 0.3, and γ = 0.3, respectively;

[0031] C2, VAR model construction: perform stationarity test, lag order selection and parameter estimation on indicator series with correlation exceeding the threshold;

[0032] C3, judgment rule: If the rolling forecast result meets the double alarm condition, it is determined to be a capacity bottleneck.

[0033] Preferably, the double alarm condition is:

[0034] (a) The correlation score between the capacity index and the performance index exceeds 0.8;

[0035] (b) The forecast error of the VAR model exceeds the preset threshold or the forecast trend continues to deteriorate.

[0036] Preferably, the determination coefficient R 2 The formula is:

[0037]

[0038] R 2The value range is between 0 and 1. The closer the value is to 1, the stronger the regression model's ability to explain the data, that is, the more obvious the trend is.

[0039] Preferably, the T-test mutation detection of the mode switching detection in S22 is to perform a two-sample hypothesis test (t-test) on the test sample and the baseline sample as follows:

[0040]

[0041] Where X1 and X2 represent the test sample and baseline sample respectively, S1 and S2 represent the standard deviation of the test sample and baseline sample respectively, and n1 and n2 represent the length of the test data and baseline data respectively.

[0042] The beneficial effects of the present invention are as follows:

[0043] 1. This invention innovatively integrates statistical learning techniques with machine learning techniques to build a comprehensive and efficient IT performance monitoring system. This system aims to accurately identify and provide timely warnings for IT performance indicators in three typical scenarios: slow degradation, mode switching, and capacity bottlenecks. Specifically, this invention aims to achieve the following key objectives:

[0044] (1) Achieve high-precision slow degradation detection: During the operation of IT systems, the slow degradation of performance indicators is often difficult to detect in a timely manner, but may gradually accumulate and cause serious problems. To this end, the present invention introduces a change point enhanced segmented regression algorithm. This algorithm can keenly capture subtle changes in performance indicators in time series. Through precise identification of change points and segmented regression analysis, it significantly improves the accuracy of performance indicator trend identification. With the help of this algorithm, IT managers can more clearly understand the trends and potential impacts of performance changes, thereby formulating targeted optimization strategies in advance to ensure stable system operation.

[0045] (2) Enhanced recognition accuracy of mode switching: IT systems can exhibit multiple operating modes under different load conditions, and mode switching, especially significant changes caused by special or sudden events, may have a significant impact on system performance. In order to accurately detect and identify these mode switches, the present invention designs a set of periodic adaptive double-sample hypothesis testing mechanisms. This mechanism can automatically adjust the test parameters according to the periodic changes in the system load to ensure that the occurrence of mode switching can be effectively detected under different load modes. Through this mechanism, operation and maintenance personnel can promptly understand the changes in the system's operating status and take corresponding measures to make adjustments to ensure the efficient operation of the system.

[0046] (3) Accurately warn of capacity bottlenecks: With the development of business and the growth of data volume, IT systems may face the challenge of capacity bottlenecks. In order to detect and warn of capacity bottlenecks in advance, the present invention constructs a multivariate autoregressive (VAR) model. This model can comprehensively consider the relationship between multiple performance indicators and capacity indicators and establish a dynamic relationship model between them. Through analysis and prediction of the model, the capacity bottleneck conditions of the system under different load conditions can be accurately evaluated, and a warning can be issued in time before the bottleneck is reached. This helps operation and maintenance personnel plan expansion plans in advance to avoid system performance degradation or business interruption due to insufficient capacity.

[0047] 2. The technical solution of the present invention is significantly innovative. For the first time, it organically integrates the three advanced technologies of change point detection, statistical hypothesis testing, and multivariate time series prediction into a unified time series analysis framework. Traditional methods often have monitoring blind spots when faced with the three different scenarios of "slow-fast-changing", and it is difficult to fully and accurately capture changes in system performance. The technical solution of the present invention effectively solves these problems by integrating a variety of technical means, and can achieve all-round and real-time monitoring of IT system performance. At the same time, the solution also provides a quantifiable and explainable decision support tool for intelligent operation and maintenance (AIOps). Based on the analysis results of the present invention, operation and maintenance personnel can formulate more scientific and reasonable operation and maintenance strategies, improve operation and maintenance efficiency and quality, reduce operation and maintenance costs, and provide strong guarantees for the digital transformation of enterprises. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a slow degradation determination diagram of the present invention;

[0049] Figure 2 This is a mode switching decision diagram of the present invention;

[0050] Figure 3 This is the capacity bottleneck determination diagram of the present invention;

[0051] Figure 4 This is the indicator warning output flow chart of the present invention. DETAILED DESCRIPTION

[0052] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0053] like Figures 1 to 4 As shown, an embodiment of the present invention provides an IT performance indicator early warning method based on time series analysis. The method includes the following steps:

[0054] (1) Historical indicator data input: Collect IT system performance indicator data such as CPU utilization and capacity indicator data such as TPS. Performance indicator data is used for slow degradation detection and mode switching detection; performance indicators and capacity indicators are used for capacity bottleneck detection.

[0055] (2) Indicator risk detection: including slow degradation detection, mode switching detection and capacity bottleneck detection.

[0056] ① Slow degradation detection

[0057] [Step 1.1] Sequence decomposition: Aggregate the input performance indicator sequence by median on a daily basis to extract the trend sequence.

[0058] [Step 1.2] Change point detection: First, perform a difference on the trend sequence to obtain the difference sequence T. Calculate the confidence interval for T [mean(T)-sigma*std(T), mean(T)+sigma*std(T)]. Points that are not within the confidence interval will be identified as change points. Where mean(T) is the mean of the difference sequence T, std(T) is the standard deviation of the difference sequence T, and sigma is the sensitivity parameter (default is 3).

[0059] [Step 1.3] Segmented regression: Assuming the number of change points is k, split the difference sequence T into k+1 subsequences {T1, T2, ..., Tk+1}, perform linear regression analysis on each subsequence Ti, and calculate the regression equation for each subsequence.

[0060] T i (t) = α i +α i t+∈i

[0061] Where T i (t) is the value of the i-th subsequence at time t, α i is the intercept term, β i is the slope term, ε i is the error term;

[0062] Use the least squares method to find the optimal solution for each subsequence T i Perform linear regression parameter estimation and obtain α i and β i The estimated value of is as follows:

[0063]

[0064] where n i is a subsequence T i The length of each subsequence is used to determine the relevance of the linear regression results. 2 To assess the goodness of fit of the regression model.

[0065]

[0066] R 2 The value range is between 0 and 1. The closer the value is to 1, the stronger the regression model's ability to explain the data, that is, the more obvious the trend is.

[0067] [Step 1.4] Slow degradation determination: The slow degradation score of the sequence is the median of R2 of all subsequences. If the median is greater than a threshold (usually 0.8), it will be determined to be slowly degrading.

[0068] ②Mode switching detection

[0069] [Step 2.1] Sample division: The data of the current time period [t-△t, t] (generally △t = 30 minutes) of the input performance indicator sequence is used as the detection sample X1; with T as the period (T is day or week), the data of the time periods before T, 2T, 3T, ..., nT (generally n = 4) [t-△t, t] are obtained as the baseline sample X2.

[0070] [Step 2.2] T-test mutation detection: Perform a two-sample hypothesis test (t-test) on the test sample and the baseline sample:

[0071]

[0072] Where X1 and X2 represent the test sample and baseline sample respectively, S1 and S2 represent the standard deviation of the test sample and baseline sample respectively, and n1 and n2 represent the length of the test data and baseline data respectively.

[0073] [Step 2.3] Mode switch determination: Obtain the difference significance p between the test sample and the baseline sample based on the test statistic t (the p-value is equal to the probability of the distribution on both sides of the t-statistic). If the p-value is less than the specified threshold (usually 0.05), it means that the test sample and the baseline sample are likely to not belong to the same data distribution, which means that the indicator has changed significantly and will be determined as a mode switch.

[0074] ③Capacity bottleneck detection

[0075]

Step 3.1

[0076] Input: Capacity indicator sequence X = {x1, x2, ..., xn}, performance indicator sequence Y = {y1, y2, ..., yn}.

[0077] Correlation calculation: The linear, nonlinear, and temporal correlations between capacity and performance indicators are comprehensively quantified using a weighted scoring mechanism using the Spearman coefficient, maximum mutual information (MIC), and dynamic time warping (DTW).

[0078] Spearman coefficient: quantifies linear correlation, with a weight of α (α = 0.4 is recommended);

[0079]

[0080] where d i is x i and y i rank difference.

[0081] Maximum Mutual Information (MIC): quantifies nonlinear correlation, with a weight of β (β = 0.3 is recommended);

[0082]

[0083] where G is a grid partitioning scheme, |G| is the number of grid partitions, B(n) is the maximum allowed number of grid partitions, I(X,Y)G is the mutual information under the grid G, and |XG| and |YG| are the number of partitions of the grid G ​​on X and Y, that is, the number of rows and columns of the grid.

[0084] Dynamic Time Warping (DTW): quantifies morphological similarity with a weight of γ (γ = 0.3 is recommended);

[0085]

[0086] where π is the alignment path for X and Y.

[0087] Comprehensive scoring and screening: Calculate the Spearman coefficient ρ, maximum mutual information MIC, and dynamic time warping (DTW) similarity of the input performance indicator sequence and capacity indicator sequence. The correlation score (Score) of the capacity indicator and performance indicator is the weighted average of the three. If the score exceeds the correlation threshold (recommended 0.8), proceed to step 2. Otherwise, it is determined that there is no capacity bottleneck.

[0088]

[0089]

Step 3.2

[0090] Data preparation: Represent the performance indicators and capacity indicators as a 2*N matrix Z, where the first row represents the capacity indicator sequence X, the second row represents the performance indicator sequence Y, and each column represents a time point t.

[0091] Stationary test: Use the ADF test (Augmented Dickey-Fuller test) to test the stationaryness of each row of the series in Z. If the series is not stationary, convert it into a difference series and repeat the test until it is stationary.

[0092] Lag order selection: Use the AIC criterion to determine the optimal lag order. Select the p-value with the smallest AIC as the optimal p-value and the optimal lag order.

[0093]

[0094] Where k = 2 (number of variables), T is the sequence length, and Σ^p is the estimate of the residual covariance matrix.

[0095] The p-value with the smallest AIC is selected as the optimal p-value, that is, the optimal lag order.

[0096] Model training: Parameters are estimated using the least squares method;

[0097]

[0098] where Z t It is the value of the tth column of the 2*N matrix, and the intercept parameter c and coefficient matrix A of the model are fitted by the least squares method. i and error vector u t .

[0099]

Step 3.3

[0100] Dynamic prediction mechanism: Rolling prediction based on the latest p-period observations.

[0101]

[0102] Comply with alarm rules: Design dual judgment conditions and determine that a capacity bottleneck exists when the rules are met.

[0103]

[0104] Among them, θ = 10% and τ = 3 are empirical parameters that can be optimized through machine learning.

[0105] (3) Indicator warning output: the time of warning output, the type of warning (including slow degradation, mode switching and capacity bottleneck) and the reason for the warning (including the score of slow degradation, the p-value of mode switching and the condition of capacity bottleneck)

[0106] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0107] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. An IT performance indicator early warning method based on time series analysis, characterized by: The steps of the IT performance indicator early warning method include: S1, historical data input: collects performance indicator data and capacity indicator data of the IT system. The performance indicator data is used for slow degradation detection and mode switching detection, and the correlation data of performance indicators and capacity indicators is used for capacity bottleneck detection; S2, risk detection: performs the following three types of detection on the input data: S21, slow degradation detection: identifying long-term trend changes in performance indicators through a change-point enhanced segmented regression algorithm; S22, mode switching detection: identifying sudden changes in load patterns through a periodically adaptive two-sample hypothesis testing mechanism; S23, capacity bottleneck detection: establishing a dynamic correlation between performance indicators and capacity indicators through a multivariate autoregressive model; S3, warning output: Generate warning information including time, type and cause based on the detection results.

2. The IT performance indicator early warning method based on time series analysis according to claim 1 is characterized by: The slow degradation detection includes: A1,Sequence decomposition: Perform median aggregation on the performance indicator series by day to extract the trend series; A2, change point detection: Calculate the confidence interval [mean(T)-σ·std(T),mean(T)+σ·std(T)] for the difference sequence of the trend sequence, and determine the points outside the confidence interval as change points, where σ is the sensitivity parameter; A3, Segmented regression: Divide the difference sequence into k+1 subsequences, perform linear regression on each subsequence and calculate the goodness of fit R 2 ; A4, judgment rule: If all subsequences R 2 If the median of exceeds the threshold θ, it is judged to be slowly degrading.

3. The IT performance indicator early warning method based on time series analysis according to claim 1 is characterized by: The linear regression equation of each subsequence Ti in the A3 segmented regression is: T i (t)=a i +b i t+∈i Where T i (t) is the value of the i-th subsequence at time t, α i is the intercept term, β i is the slope term, ε i is the error term; Use the least squares method to find the optimal solution for each subsequence T i Perform linear regression parameter estimation and obtain α i and β i The estimated value of is as follows: where n i is a subsequence T i The length of each subsequence is used to determine the relevance of the linear regression results. 2 To assess the goodness of fit of the regression model.

4. The IT performance indicator early warning method based on time series analysis according to claim 1 is characterized by: The mode switching detection includes: B1, sample division: the data of the current period [t-Δt, t] is used as the detection sample X1, and the historical data of the same period is obtained at intervals of period T as the baseline sample X2; B2, two-sample test: perform a t-test on X1 and X2 and calculate the p-value of the significant difference; B3, judgment rule: If the p-value is less than the significance level α, it is judged as mode switching.

5. The IT performance indicator early warning method based on time series analysis according to claim 1 is characterized by: The default value of Δt is 30 minutes, the period T is days or weeks, and the default value of the significance level α is 0.

05.

6. The IT performance indicator early warning method based on time series analysis according to claim 1 is characterized by: The capacity bottleneck detection includes: C1, multidimensional correlation analysis: The correlation between performance indicators and capacity indicators is quantified by a weighted scoring mechanism of Spearman coefficient (ρ), maximum mutual information (MIC), and dynamic time warping (DTW), with weights α = 0.4, β = 0.3, and γ = 0.3, respectively; C2, VAR model construction: perform stationarity test, lag order selection and parameter estimation on indicator series with correlation exceeding the threshold; C3, judgment rule: If the rolling forecast result meets the double alarm condition, it is determined to be a capacity bottleneck.

7. The IT performance indicator early warning method based on time series analysis according to claim 1 is characterized by: The dual alarm conditions are: (a) The correlation score between the capacity index and the performance index exceeds 0.8; (b) The forecast error of the VAR model exceeds the preset threshold or the forecast trend continues to deteriorate.

8. The IT performance indicator early warning method based on time series analysis according to claim 1 is characterized by: The coefficient of determination R 2 The formula is: R 2 The value range is between 0 and 1. The closer the value is to 1, the stronger the regression model's ability to explain the data, that is, the more obvious the trend is.

9. The IT performance indicator early warning method based on time series analysis according to claim 1 is characterized by: The T-test mutation detection of the mode switching detection in S22 is to perform a two-sample hypothesis test (t-test) on the test sample and the baseline sample as follows: Where X1 and X2 represent the test sample and baseline sample respectively, S1 and S2 represent the standard deviation of the test sample and baseline sample respectively, and n1 and n2 represent the length of the test data and baseline data respectively.

Images