Abnormal monitoring method, device, electronic device and computer readable storage medium

Abstract

The present invention provides an abnormality monitoring method, device, electronic device and computer-readable storage medium, which are applied to the field of artificial intelligence. The method comprises: extracting features from the business log data and the hardware monitoring data respectively; inputting the business log features and the hardware monitoring features into a pre-established deep learning abnormality monitoring model to obtain abnormality monitoring results; wherein the deep learning abnormality monitoring model comprises: a plurality of parallel local CNN layers, a data splicing layer connected after the plurality of local CNN layers, a global CNN layer connected after the splicing layer, an LSTM connected after the global CNN layer and an output layer connected to the output end of the LSTM, an improvement is made to the hybrid model of CNN and LSTM, and multi-dimensional feature extraction is performed on the monitoring data, thereby effectively improving the accuracy of abnormality monitoring in complex distributed scenarios.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to an abnormality monitoring method, device, electronic device and computer-readable storage medium. Background Art

[0002] Intelligent operation and maintenance technology is gradually replacing traditional operation and maintenance methods, which can replace manual operations to a greater extent and liberate traditional operation and maintenance manpower. An important part of intelligent operation and maintenance is to identify and locate system anomalies through monitoring data. The existing system anomaly monitoring technologies mainly include the following:

[0003] 1. Traditional system anomaly monitoring method based on specific indicators: The advantage of this method is that it is relatively simple to implement and implement, but its disadvantage is that it requires manual identification of abnormal phenomena and extraction of abnormal features, which is too dependent on personal professional knowledge and familiarity with the system;

[0004] 2. System anomaly monitoring method based on unsupervised learning: This method uses some unsupervised learning methods (clustering, random forest, etc.) to monitor system anomalies. Unsupervised learning has the advantage of not relying on personal professional knowledge, but the stability of unsupervised learning is not strong, and the learning results cannot adapt well to complex production systems;

[0005] 3. System anomaly monitoring method based on existing deep learning models:

[0006] The advantage of deep learning is that it can automatically extract abnormal features of data and has strong stability, such as the CNN-based system abnormality monitoring method; in actual production systems, there is more than one data source for operation and maintenance monitoring, and the data changes between different data sources may be interrelated. If CNN is simply used to extract features from each data source, the correlation features between different data sources cannot be extracted; in addition, since the operation and maintenance monitoring data has multiple formats and types (such as equipment hardware operation data, request data, call return result information, etc.), the format and sampling frequency of each data are different. If all the data are simply combined and CNN is used to extract related features, there will be inconsistencies in data format and shape. Summary of the invention

[0007] In view of the problems in the prior art, the present invention provides an abnormality monitoring method, an apparatus, an electronic device and a computer-readable storage medium, which can at least partially solve the problems in the prior art.

[0008] In order to achieve the above object, the present invention adopts the following technical solution:

[0009] In a first aspect, a method for monitoring an abnormality is provided, comprising:

[0010] Acquire operation and maintenance data, the operation and maintenance data including: business log data and hardware monitoring data;

[0011] Extracting features from the business log data and the hardware monitoring data to obtain corresponding business log features and hardware monitoring features;

[0012] Inputting the business log features and the hardware monitoring features into a pre-established deep learning anomaly monitoring model to obtain an anomaly monitoring result;

[0013] The deep learning anomaly monitoring model includes: a plurality of parallel local CNN layers, a data stitching layer connected after the plurality of local CNN layers, a global CNN layer connected after the stitching layer, an LSTM connected after the global CNN layer, and an output layer connected to the output end of the LSTM;

[0014] The business log features and the hardware monitoring features are respectively input into the corresponding CNN layers for local feature extraction, and the data stitching layer is used to stitch the local features extracted by each local CNN layer and then input them into the global CNN layer to extract global correlation features and transmit them to the LSTM;

[0015] The LSTM models the temporal relationship of the operation and maintenance data based on the global correlation features of the features extracted by the global CNN layer and obtains a feature vector;

[0016] The feature vector is input into the output layer, passes through the fully connected neural network and the softmax function to obtain the final classification result.

[0017] Furthermore, the global convolution layer includes: two convolution layers and one flattening layer, the two convolution layers are used to learn the correlation relationship between different operation and maintenance data, and the global correlation features are obtained by flattening the flattening layer.

[0018] Furthermore, each local convolutional layer sets a convolution kernel of different sizes based on the sampling frequency of its input data.

[0019] Furthermore, the hardware monitoring data includes: CPU usage, CPU core occupancy, memory occupancy, network IO transmission speed, and IO response time.

[0020] Furthermore, the business log data includes: transaction success rate per second, top ten error codes and their number, and average transaction exit time for different services.

[0021] In a second aspect, an abnormality monitoring device is provided, comprising:

[0022] A data acquisition module acquires operation and maintenance data, wherein the operation and maintenance data includes: business log data and hardware monitoring data;

[0023] A feature extraction module performs feature extraction on the business log data and the hardware monitoring data to obtain corresponding business log features and hardware monitoring features;

[0024] An abnormality monitoring module, which inputs the business log features and the hardware monitoring features into a pre-established deep learning abnormality monitoring model to obtain an abnormality monitoring result;

[0025] The deep learning anomaly monitoring model includes: a plurality of parallel local CNN layers, a data stitching layer connected after the plurality of local CNN layers, a global CNN layer connected after the stitching layer, an LSTM connected after the global CNN layer, and an output layer connected to the output end of the LSTM;

[0026] The business log features and the hardware monitoring features are respectively input into the corresponding CNN layers for local feature extraction, and the data stitching layer is used to stitch the local features extracted by each local CNN layer and then input them into the global CNN layer to extract global correlation features and transmit them to the LSTM;

[0027] The LSTM models the temporal relationship of the operation and maintenance data based on the global correlation features of the features extracted by the global CNN layer and obtains a feature vector;

[0028] The feature vector is input into the output layer, passes through the fully connected neural network and the softmax function to obtain the final classification result.

[0029] Furthermore, the global convolution layer includes: two convolution layers and one flattening layer, the two convolution layers are used to learn the correlation relationship between different operation and maintenance data, and the global correlation features are flattened by the flattening layer.

[0030] Furthermore, each local convolutional layer sets a convolution kernel of different sizes based on the sampling frequency of its input data.

[0031] According to a third aspect, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned abnormality monitoring method when executing the program.

[0032] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned abnormality monitoring method are implemented.

[0033] The abnormality monitoring method, device, electronic device and computer-readable storage medium provided by the present invention are applied to the field of artificial intelligence. The method comprises: obtaining operation and maintenance data, wherein the operation and maintenance data comprises: business log data and hardware monitoring data; performing feature extraction on the business log data and the hardware monitoring data to obtain corresponding business log features and hardware monitoring features; inputting the business log features and the hardware monitoring features into a pre-established deep learning abnormality monitoring model to obtain abnormality monitoring results; wherein the deep learning abnormality monitoring model comprises: a plurality of parallel local CNN layers, a data splicing layer connected after the plurality of local CNN layers, and a global CNN splicing layer connected after the splicing layer. NN layer, LSTM connected after the global CNN layer, and output layer connected to the output end of the LSTM; the business log features and the hardware monitoring features are respectively input into the corresponding CNN layers for local feature extraction, and the data stitching layer is used to stitch the local features extracted by each local CNN layer and input them into the global CNN layer to extract global correlation features and transmit them to the LSTM; the LSTM models the temporal relationship of the operation and maintenance data based on the global correlation features of the features extracted by the global CNN layer and obtains a feature vector; the feature vector is input into the output layer, passes through the fully connected neural network and obtains the final classification result through the softmax function. By adopting the above technical solution, the hybrid model of CNN and LSTM is improved, and multi-dimensional feature extraction is performed on the monitoring data, which effectively improves the accuracy of abnormal monitoring in complex distributed scenarios.

[0034] In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0036] Figure 1 is a schematic diagram of the architecture between the server S1 and the client device B1 in an embodiment of the present invention;

[0037] Figure 2 Schematic diagram of the architecture between the server S1, the client device B1 and the database server S2 in an embodiment of the present invention;

[0038] Figure 3 The process diagram of the abnormal monitoring method in the embodiment of the present invention is as follows Figure 1 ;

[0039] Figure 4 The structure of the deep learning abnormal monitoring model in the embodiment of the present invention is shown;

[0040] Figure 5 The abnormality monitoring principle in the embodiment of the present invention is shown;

[0041] Figure 6 The process diagram of the abnormal monitoring method in the embodiment of the present invention is as follows Figure 2 ;

[0042] Figure 7 is a structural block diagram of an abnormality monitoring device in an embodiment of the present invention;

[0043] Figure 8 4 is a structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0045] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0046] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatuses.

[0047] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0048] The existing system anomaly monitoring technology based on deep learning models will result in inconsistent data formats and shapes if all data are simply combined and then CNN is used to extract related features.

[0049] In order to at least partially solve the above technical problems, the embodiments of the present invention provide an abnormal monitoring method, device, electronic device and computer-readable storage medium, which improve the hybrid model of CNN and LSTM, perform multi-dimensional feature extraction on monitoring data, and effectively improve the accuracy of abnormal monitoring in complex distributed scenarios.

[0050] In view of this, the present application provides an abnormal monitoring device, which can be a server S1, see Figure 1 The server S1 can be communicatively connected with at least one client device B1, the client device B1 can send operation and maintenance data to the server S1, and the server S1 can receive the operation and maintenance data online. The server S1 can pre-process the acquired operation and maintenance data online or offline, and the operation and maintenance data includes: business log data and hardware monitoring data; feature extraction is performed on the business log data and the hardware monitoring data to obtain corresponding business log features and hardware monitoring features; the business log features and the hardware monitoring features are input into a pre-established deep learning abnormal monitoring model to obtain abnormal monitoring results; wherein the deep learning abnormal monitoring model includes: multiple parallel local CNN layers, a data splicing layer connected after the multiple local CNN layers, a global CNN layer connected after the splicing layer, an LSTM connected after the global CNN layer, and an output layer connected to the output end of the LSTM; the business log features and the hardware monitoring features are respectively input into the corresponding CNN layers for local feature extraction, and the data splicing layer is used to splice the local features extracted by each local CNN layer and input them to the global CNN layer to extract global correlation features and transmit them to the LSTM; the LSTM models the temporal relationship of the operation and maintenance data based on the global correlation features of the features extracted by the global CNN layer and obtains a feature vector; the feature vector is input into the output layer, passes through a fully connected neural network and obtains the final classification result through a softmax function. Then, the server S1 may send the abnormal monitoring result to the client device B1 online. The client device B1 may receive the abnormal monitoring result online.

[0051] Also, see Figure 2The server S1 may also be connected to at least one database server S2 for communication, and the database server S2 is used to store historical operation and maintenance data. The database server S2 sends the historical operation and maintenance data to the server S1 online, and the server S1 may receive the historical operation and maintenance data online, and then obtain a training sample set of the model based on a plurality of historical operation and maintenance data, and use the training sample set to perform model training on the model.

[0052] Based on the above content, the database server S2 can also be used to store historical operation and maintenance data for testing. The database server S2 sends the historical operation and maintenance data for testing to the server S1 online, and the server S1 can receive the historical operation and maintenance data for testing online, and then obtain a test sample based on at least one historical operation and maintenance data for testing, and apply the test sample to perform model testing on the model, and use the output of the model as the test result, and then based on the test result and the known evaluation result of at least one historical operation and maintenance data for testing, judge whether the current deep learning anomaly monitoring model meets the preset requirements, and if so, use the current deep learning anomaly monitoring model as the target deep learning anomaly monitoring model for anomaly monitoring; if the current deep learning anomaly monitoring model does not meet the preset requirements, optimize the current deep learning anomaly monitoring model and / or apply the updated training sample set to retrain the deep learning anomaly monitoring model.

[0053] Based on the above content, the client device B1 may have a display interface, so that the user can view the abnormal monitoring result sent by the server S1 according to the interface.

[0054] It is understandable that the client device B1 may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0055] In practical applications, the abnormality monitoring part can be executed on the server S1 side as described above, that is, Figure 1 The architecture shown in the figure can also be that all operations are completed in the client device B1, and the client device B1 can directly communicate with the database server S2. The specific selection can be based on the processing capability of the client device B1 and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device B1, the client device B1 can also include a processor for specific processing of abnormal monitoring.

[0056] The server and the client device may communicate using any suitable network protocol, including network protocols that have not yet been developed on the date of filing this application. The network protocol may include, for example, TCP / IP protocol, UDP / IP protocol, HTTP protocol, HTTPS protocol, etc. Of course, the network protocol may also include, for example, RPC protocol (Remote Procedure Call Protocol) and REST protocol (Representational State Transfer) used on top of the above protocols.

[0057] In one or more embodiments of the present application, the historical operation and maintenance data for testing is not included in the historical operation and maintenance data used for model training, and known evaluation results of the historical operation and maintenance data for testing need to be obtained.

[0058] Figure 3 The process diagram of the abnormal monitoring method in the embodiment of the present invention is as follows Figure 1 ;like Figure 3 As shown, the abnormal monitoring method may include the following contents:

[0059] Step S100: Acquire operation and maintenance data, the operation and maintenance data including: business log data and hardware monitoring data;

[0060] Specifically, the operation and maintenance data can be the log, CPU, IO and other monitoring data of each container.

[0061] Step S200: extracting features from the business log data and the hardware monitoring data to obtain corresponding business log features and hardware monitoring features;

[0062] Specifically, different types of data features are extracted.

[0063] Step S300: inputting the business log features and the hardware monitoring features into a pre-established deep learning anomaly monitoring model to obtain an anomaly monitoring result;

[0064] Among them, see Figure 4 , the deep learning anomaly monitoring model includes: a plurality of parallel local CNN layers, a data stitching layer connected after the plurality of local CNN layers, a global CNN layer connected after the stitching layer, an LSTM connected after the global CNN layer, and an output layer connected to the output end of the LSTM;

[0065] The principle is shown in Figure 5The business log features and the hardware monitoring features are respectively input into the corresponding CNN layers for local feature extraction to obtain L1 and L2. The data stitching layer is used to stitch the local features L1 and L2 extracted by each local CNN layer and then input them into the global CNN layer to extract global correlation features and transmit them to the LSTM.

[0066] The LSTM models the temporal relationship of the operation and maintenance data based on the global correlation features of the features extracted by the global CNN layer and obtains a feature vector;

[0067] The feature vector is input into the output layer, passes through the fully connected neural network and the softmax function to obtain the final classification result.

[0068] By adopting the above technical solution, the hybrid model of CNN and LSTM was improved, and multi-dimensional feature extraction was performed on the monitoring data, which effectively improved the accuracy of abnormal monitoring in complex distributed scenarios.

[0069] In an optional embodiment, the global convolution layer includes: two convolution layers and one flattening layer, the two convolution layers are used to learn the correlation relationship between different operation and maintenance data, and the global correlation features are obtained by flattening the flattening layer.

[0070] In an optional embodiment, each local convolution layer sets a convolution kernel of a different size based on the sampling frequency of its input data.

[0071] In an optional embodiment, the hardware monitoring data includes: CPU usage, CPU core occupancy, memory occupancy, network IO transmission speed, IO response time. The business log data includes: transaction success rate per second, the first ten error codes and number, and the average time consumed for transaction exits of different services.

[0072] In order to enable those skilled in the art to better understand the present application, the following examples are given to supplement the present application:

[0073] In an actual application scenario, the business log data of the in-bank application COSS and its corresponding Promethus system hardware monitoring data were collected and trained. The transaction success rate per second, the top 10 error codes and their number, and the average transaction export time of different services were extracted from the business log data (since there are 7 services in the screened coss log data, the time consumption data of 7 types of services can be screened); 5 indicators including CPU usage, CPU core occupancy, memory occupancy, network IO transmission speed, and IO response time were extracted from Promethus. Since the business log data is refreshed once per second, and the Promethus monitoring data is refreshed twice per second. Therefore, taking 120 seconds as a sample unit, 120*9-dimensional business log data can be extracted from the business log every minute, and 240*5-dimensional hardware data can be extracted from Promethus. Then, the time dimension is extracted from the data vector, and the data vector of the business log can be transformed into 10*12*9, and the vector of the hardware information can be transformed into 10*24*5. The first dimension is the time dimension, which is used for subsequent LSTM to extract time series features, and the second and third dimensions are used for CNN to extract spatial features. We put the business log data into a 3DCNN with a 1*3*3 convolution kernel and a step size of 1*3*3, and after extracting local spatial features, we can obtain a 10*4*3 feature vector; then put the hardware data into a CNN with a 1*6*2 convolution kernel and a step size of 6*1, and we can obtain a 10*4*4 feature vector. We merge the two local CNN output vectors according to the second dimension to obtain a 10*4*7 feature vector, put the vector into the global CNN with a convolution kernel size of 2*2 and a step size of 2*2, output a 10*2*4 spatial feature vector, and then flatten the spatial dimension of the vector to obtain a 10*8 vector. Finally, the 10*8 vector is input into LSTM to extract the time series features, and finally the output of the output layer is mapped to the final label, and the final model is trained.

[0074] Among them, the Promethus system monitors CPU usage, CPU core usage, memory usage, network IO transmission speed, IO response time, transaction success rate per second, top ten error codes and quantity and other business data

[0075] To sum up, the abnormal monitoring technology provided by the embodiment of the present invention has a fine monitoring granularity and is suitable for the abnormal identification of multimodal monitoring data in complex distributed scenarios. In practical applications, a model is obtained by training existing data, and then the model is used to predict whether the operation and maintenance data has abnormalities and the type of abnormalities.

[0076] It is worth mentioning that:

[0077] 1. Local convolution layer:

[0078] Since different operation and maintenance data usually have different sampling frequencies, the sizes of the various types of operation and maintenance data obtained are different. In order to ensure that different types of operation and maintenance data can be merged with the same size, convolution kernels of different sizes are set in the local convolution layer according to the sampling frequency of specific operation and maintenance data. Therefore, after passing through the local convolution layer, different types of operation and maintenance data will have the same size.

[0079] 2. Global Convolutional Layer

[0080] The global convolution layer consists of two convolution layers and one flattening layer. It first uses two convolution layers to learn the correlation between different operation and maintenance data, and finally flattens the tensor to make it suitable for the next LSTM input;

[0081] 3. LSTM Layer

[0082] The LSTM layer models the temporal relationship of the operation and maintenance data based on the features extracted by the convolution layer. LSTM is a neural network structure in which nodes of the same level are interconnected, and its previous unit output is part of the current unit input. This mechanism allows the neuron node to retain a part of the previously input information, so LSTM is suitable for processing time series data. Therefore, the feature vector extracted by the convolution layer is input to the LSTM layer, and the connection between the LSTM layers is regularized using dropout. Finally, the LSTM layer will output a feature vector z1,z2,...,z T .

[0083] 4. Output Layer

[0084] Since the output of the LSTM layer is a sequence of feature vectors z1,z2,...,z T ,Finally, the feature vector is input into the fully connected neural network and the final classification result is obtained through the softmax function.

[0085] Based on the above scheme, a system operation and maintenance anomaly monitoring model based on multimodal neural network is implemented. The model integrates multiple layers of CNN and LSTM to utilize different types of spatiotemporal relationships in multimodal operation and maintenance data to identify and monitor complex system operation and maintenance anomalies.

[0086] In an alternative embodiment, see Figure 6 , the abnormal monitoring method may also include the following contents:

[0087] Step S400: Model establishment;

[0088] Specifically, by calling the corresponding model code in Python, etc., establish Figure 4 The model structure shown.

[0089] Step S500: model training;

[0090] Specifically, the stored historical operation and maintenance data may be used as sample data, a training sample set of the model may be obtained based on the historical operation and maintenance data, and the model may be trained by applying the training sample set.

[0091] Among them, the training samples are sample data with known labels. After the samples are input into the model, the output of the model is compared with the known labels, and the model parameters are adjusted based on the comparison results to realize model training.

[0092] Step S600: model testing;

[0093] Specifically, test data is selected to test the model, wherein the test data has a known label. The test data is input into the trained model, and the model output result is compared with the known label. According to the comparison result, it is judged whether the model accuracy meets the requirements. If not, the model parameters are adjusted and the model training is continued with a new training sample set until the model accuracy meets the preset requirements. Then, the model that meets the accuracy requirements is used to perform anomaly monitoring in actual application scenarios.

[0094] Based on the same inventive concept, the embodiments of the present application also provide an abnormality monitoring device, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of solving the problem by the abnormality monitoring device is similar to that of the above method, the implementation of the abnormality monitoring device can refer to the implementation of the above method, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0095] Figure 7 is a structural block diagram of an abnormality monitoring device in an embodiment of the present invention. Figure 7 As shown, the abnormality monitoring device specifically includes: a data acquisition module 1, a feature extraction module 20 and an abnormality monitoring module 30.

[0096] The data acquisition module 10 acquires operation and maintenance data, and the operation and maintenance data includes: business log data and hardware monitoring data;

[0097] The feature extraction module 20 extracts features from the business log data and the hardware monitoring data to obtain corresponding business log features and hardware monitoring features;

[0098] The abnormality monitoring module 30 inputs the business log features and the hardware monitoring features into a pre-established deep learning abnormality monitoring model to obtain abnormality monitoring results;

[0099] The deep learning anomaly monitoring model includes: a plurality of parallel local CNN layers, a data stitching layer connected after the plurality of local CNN layers, a global CNN layer connected after the stitching layer, an LSTM connected after the global CNN layer, and an output layer connected to the output end of the LSTM;

[0100] The business log features and the hardware monitoring features are respectively input into the corresponding CNN layers for local feature extraction, and the data stitching layer is used to stitch the local features extracted by each local CNN layer and then input them into the global CNN layer to extract global correlation features and transmit them to the LSTM;

[0101] The LSTM models the temporal relationship of the operation and maintenance data based on the global correlation features of the features extracted by the global CNN layer and obtains a feature vector;

[0102] The feature vector is input into the output layer, passes through the fully connected neural network and the softmax function to obtain the final classification result.

[0103] By adopting the above technical solution, the hybrid model of CNN and LSTM was improved, and multi-dimensional feature extraction was performed on the monitoring data, which effectively improved the accuracy of abnormal monitoring in complex distributed scenarios.

[0104] The devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is an electronic device, and the electronic device may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0105] In a typical example, the electronic device specifically includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the above-mentioned abnormality monitoring method when executing the program.

[0106] Reference below Figure 8 , which shows a schematic structural diagram of an electronic device 600 suitable for implementing an embodiment of the present application.

[0107] like Figure 8As shown, electronic device 600 includes a central processing unit (CPU) 601, which can perform various appropriate operations and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. In RAM 603, various programs and data required for the operation of system 600 are also stored. CPU 601, ROM 602, and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to bus 604.

[0108] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed as needed as the storage section 608.

[0109] In particular, according to an embodiment of the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer-readable storage medium having a computer program stored thereon, which implements the steps of the above-mentioned abnormality monitoring method when executed by a processor.

[0110] In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 609 , and / or installed from the removable medium 611 .

[0111] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0112] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0113] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0114] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0115] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0116] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0118] The present application may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0119] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0120] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. An abnormality monitoring method, characterized in that: include: Acquire operation and maintenance data, the operation and maintenance data including: business log data and hardware monitoring data; Performing feature extraction on the business log data and the hardware monitoring data to obtain corresponding business log feature vectors and hardware monitoring feature vectors; Inputting the business log feature vector and the hardware monitoring feature vector into a pre-established deep learning anomaly monitoring model to obtain an anomaly monitoring result; The deep learning anomaly monitoring model includes: a plurality of parallel local CNN layers, a data stitching layer connected after the plurality of local CNN layers, a global CNN layer connected after the stitching layer, an LSTM connected after the global CNN layer, and an output layer connected to the output end of the LSTM; The first dimension of the business log feature vector and the hardware monitoring feature vector is the time dimension, the first dimension is used by the LSTM to extract time series features, and the second and third dimensions are used by the local CNN layer to extract spatial features; The data stitching layer merges the output vectors of the multiple local CNN layers according to the second dimension; The global CNN layer includes: two convolutional layers and one flattening layer. The two convolutional layers are used to learn the correlation relationship between different operation and maintenance data, and the global correlation features are obtained by flattening the flattening layer.

2. The abnormality monitoring method according to claim 1, characterized in that: Each local convolution layer sets a convolution kernel of different sizes based on the sampling frequency of its input data.

3. The abnormality monitoring method according to claim 1, characterized in that: The hardware monitoring data includes: CPU usage, CPU core occupancy, memory occupancy, network IO transmission speed, and IO response time.

4. The abnormality monitoring method according to claim 1, characterized in that: The business log data includes: transaction success rate per second, top ten error codes and their number, and average transaction exit time for different services.

5. An abnormality monitoring device, characterized in that: include: A data acquisition module acquires operation and maintenance data, wherein the operation and maintenance data includes: business log data and hardware monitoring data; A feature extraction module performs feature extraction on the business log data and the hardware monitoring data to obtain corresponding business log feature vectors and hardware monitoring feature vectors; An abnormality monitoring module, inputting the business log feature vector and the hardware monitoring feature vector into a pre-established deep learning abnormality monitoring model to obtain an abnormality monitoring result; The deep learning anomaly monitoring model includes: a plurality of parallel local CNN layers, a data stitching layer connected after the plurality of local CNN layers, a global CNN layer connected after the stitching layer, an LSTM connected after the global CNN layer, and an output layer connected to the output end of the LSTM; The first dimension of the business log feature vector and the hardware monitoring feature vector is the time dimension, the first dimension is used by the LSTM to extract time series features, and the second and third dimensions are used by the local CNN layer to extract spatial features; The data stitching layer merges the output vectors of the multiple local CNN layers according to the second dimension; The global CNN layer includes: two convolutional layers and one flattening layer. The two convolutional layers are used to learn the correlation relationship between different operation and maintenance data, and the global correlation features are obtained by flattening the flattening layer.

6. The abnormality monitoring device according to claim 5, characterized in that: Each local convolution layer sets a convolution kernel of different sizes based on the sampling frequency of its input data.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the abnormality monitoring method according to any one of claims 1 to 4 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the abnormality monitoring method according to any one of claims 1 to 4 are implemented.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the abnormality monitoring method according to any one of claims 1 to 4 are implemented.

Images