Method and apparatus for detecting software performance anomaly

Abstract

The application discloses a software performance anomaly detection method and device. The software performance anomaly detection method comprises the following steps: collecting data of attributes representing the running state of a target software, and obtaining a first data set; screening out elements not meeting a preset multicollinearity condition in the first data set according to a multicollinearity test standard, and obtaining a second data set; performing noise reduction processing on the second data set by using an adaptive discrete wavelet decomposition method according to the waveform characteristics of key performance elements, and obtaining a third data set; training an anomaly detection model by using the third data set, and obtaining a software performance anomaly detection model; and detecting the target software to be detected by using the software performance anomaly detection model, and obtaining a detection result. By combining the multicollinearity test standard, the adaptive discrete wavelet decomposition method and the anomaly detection model, the problem of excessive noise and unobvious software performance failure characteristics is effectively solved, and the accuracy of software detection is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of software detection, and in particular to a software performance anomaly detection method and device. BACKGROUND

[0002] At present, with the rapid development of computer technology and Internet technology, the functional and performance requirements of software are gradually increasing, and the complexity of software is also increasing. How to ensure the reliability of complex software during operation is a hot research field. Due to the defects in the software itself that are not suitable for detection and the introduction of new defects in version updates, these defects will be activated during long-term software operation. Activated defects will cause software faults to accumulate continuously. At the same time, unreasonable resource scheduling mechanisms will also cause system resources to be consumed continuously or even exhausted. Software will inevitably exhibit abnormal phenomena such as performance degradation, failure rate increase, and even system crash. In order to ensure the normal operation of business, large Internet companies need to closely monitor software performance indicators, accurately detect software performance failure anomalies in a timely manner, and timely trigger software fault elimination and mitigation mechanisms. Software is a complex product with software control logic and close contact with the running environment, users and other systems. Therefore, the performance state of software is affected by multiple factors during software runtime, including randomness and strong time dependence. Due to the large scale of complex software, the causes of failure come from internal factors (resource management mechanism) and external changes (such as workload), etc. from various aspects, and multiple monitoring performance characterization elements are needed for failure detection. Due to the long-time running state of software, noise will inevitably be introduced during monitoring, and noise in the data set will reduce model accuracy. However, how to obtain and reduce noise interference in the performance failure characterization element data set, and predict performance failure based on multiple modes of performance characterization elements, is an important challenge. Existing technologies usually monitor the memory and CPU performance indicators of software runtime, and use difference integrated moving average autoregressive models, long short-term memory networks and other time series analysis models to predict software performance trends.

[0003] In the implementation of the prior art, the inventors have found that:

[0004] The existing technology for software performance failure has the following problems: the performance failure characterization elements are relatively single, the existing research usually only takes the system level CPU usage, memory usage, etc. as performance failure characterization elements, and lacks a multi-level performance characterization element selection method; there is multiple collinearity in the selected performance characterization elements; and the performance characterization elements contain noise interference. The existence of these problems ultimately reduces the accuracy of the anomaly detection model.

[0005] Therefore, it is necessary to provide a related technical solution for improving the detection accuracy of software performance anomalies. SUMMARY

[0006] Embodiments of the present application provide a related technical solution to improve the detection accuracy of software performance anomaly conditions, to solve the technical problems of excessive noise in software performance failure feature data and unobvious software performance failure features.

[0007] The present application provides a software performance anomaly detection method, comprising the following specific steps:

[0008] Collecting data of attributes representing the running state of the target software during runtime to obtain a first data set;

[0009] According to the multiple collinearity test standard, the elements in the first data set that do not meet the preset collinearity condition are screened out to obtain a second data set representing key performance elements;

[0010] According to the waveform characteristics of the key performance elements, the second data set is processed by an adaptive discrete wavelet decomposition method to obtain a third data set after noise reduction;

[0011] Training an anomaly detection model using the third data set to obtain a software performance anomaly detection model;

[0012] Detecting the target software to be tested by the software performance anomaly detection model to obtain a detection result.

[0013] Further, collecting data of attributes representing the running state of the target software during runtime to obtain a first data set, comprising the following specific steps:

[0014] Determining the data type of the attributes representing the running state of the software to be collected;

[0015] Deploying data monitoring points for the target software according to the data type;

[0016] Recording monitoring data of the target software during runtime through the data monitoring points to obtain a first data set.

[0017] Further, the data type includes:

[0018] Aging representation element type at the operating system level;

[0019] Performance representation element type at the application program level;

[0020] Performance failure representation element type at the service level.

[0021] Further, recording monitoring data of the target software during runtime through the data monitoring points to obtain a first data set, comprising the following specific steps:

[0022] acquiring monitoring data of the target software in runtime from the data monitoring point through an automatic script program;

[0023] storing the monitoring data in a multi-dimensional time sequence manner to obtain a first data set.

[0024] Further, according to a multicollinearity test standard, elements in the first data set that do not meet a preset multicollinearity condition are screened out to obtain a second data set representing key performance elements, including the following specific steps:

[0025] calculating a variance inflation coefficient of each element in the first data set;

[0026] comparing the variance inflation coefficient with a preset variance inflation coefficient threshold to obtain a comparison result;

[0027] screening out elements in the first data set whose comparison result does not meet the preset multicollinearity condition to obtain a second data set representing key performance elements;

[0028] wherein each element represents a group of software performance element sequences.

[0029] Further, the second data set is pre-marked with corresponding abnormal data through a running log data of the target software to form a sample label.

[0030] Further, according to a waveform feature of the key performance elements, a self-adaptive discrete wavelet decomposition method is used to perform noise reduction processing on the second data set to obtain a third data set after noise reduction, including the following specific steps:

[0031] determining a mother wavelet and a decomposition layer number for discrete wavelet decomposition according to the waveform feature of the key performance elements;

[0032] performing discrete wavelet decomposition on a first element in the second data set through the mother wavelet and the decomposition layer number to obtain an approximate coefficient set of the first element and a detail coefficient set of the first element;

[0033] performing self-adaptive thresholding processing on the detail coefficient set of the first element to obtain a thresholded final detail coefficient set of the first element;

[0034] reconstructing the first element according to the approximate coefficient set of the first element and the final detail coefficient set of the first element to obtain a first noise-reduced element;

[0035] processing the remaining elements in the second data set according to the obtaining step of the first noise-reduced element to obtain a third data set after noise reduction.

[0036] Further, the mother wavelet is a Daubechies wavelet.

[0037] Further, the anomaly detection model adopts an independent forest anomaly detection algorithm.

[0038] The application further provides a software performance anomaly condition detection device, comprising:

[0039] A collection module is configured to collect data of attributes representing a running state of a target software during running, to obtain a first data set;

[0040] A screening module is configured to screen out elements in the first data set that do not meet a preset multicollinearity condition according to a multicollinearity test standard, to obtain a second data set representing key performance elements;

[0041] A noise reduction module is configured to perform noise reduction processing on the second data set by an adaptive discrete wavelet decomposition method according to waveform characteristics of the key performance elements, to obtain a third data set after noise reduction;

[0042] A processing module is configured to train an anomaly detection model by using the third data set, to obtain a software performance anomaly detection model;

[0043] A detection module is configured to detect a target software to be tested by using the software performance anomaly detection model, to obtain a detection result.

[0044] The embodiments provided by the application have at least the following beneficial effects:

[0045] By using the multicollinearity test standard, the adaptive discrete wavelet decomposition method and the anomaly detection model in combination, the problem of excessive noise in the software performance failure representation element data set and the problem of unobvious software performance failure characteristics are effectively solved, so that the accuracy of software detection is improved. BRIEF DESCRIPTION OF DRAWINGS

[0046] The accompanying drawings, which are included to provide a further understanding of the application, constitute a part of the application and serve to explain the application together with the specification. The accompanying drawings illustrate embodiments of the application and, together with the specification, serve to explain the application. In the drawings:

[0047] Figure 1 A flowchart of a software performance anomaly condition detection method provided by an embodiment of the application;

[0048] Figure 2 A flowchart of a first data set acquisition method in a software performance anomaly condition detection method provided by an embodiment of the application;

[0049] Figure 3 A performance failure representation element monitoring deployment schematic diagram provided by an embodiment of the application;

[0050] Figure 4A flow chart of a method for obtaining a second data set in a method for detecting a software performance abnormal condition according to an embodiment of the present application;

[0051] Figure 5 A flow chart of a method for obtaining a third data set in a method for detecting a software performance abnormal condition according to an embodiment of the present application;

[0052] Figure 6 A discrete wavelet decomposition diagram according to an embodiment of the present application;

[0053] Figure 7 An approximation coefficient and a detail coefficient diagram according to an embodiment of the present application;

[0054] Figure 8 A raw signal and a noise-reduced signal diagram according to an embodiment of the present application;

[0055] Figure 9 A schematic diagram of a device for detecting a software performance abnormal condition according to an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments of the present application, all the other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0057] Please refer to Figure 1 The present application provides a method for detecting a software performance abnormal condition, which comprises the following specific steps:

[0058] S100: Collecting data of attributes representing running conditions of a target software, to obtain a first data set.

[0059] It can be understood that the performance of software needs to be embodied in actual operation, and the theoretical performance derived from the logical structure of software code, the selection of programming language and the configuration of running environment is often far from the actual performance. The attribute can be understood as an attribute value representing the performance of software, which can be called a performance representation element. The data can be understood as a numerical value representing the performance of software in running. The first data set in the application can be understood as a performance data set collected during the dynamic running of software, which is used to represent the performance data of online monitoring software in running. Obviously, by collecting the actual data of the performance representation element of software in running, the first data set as the basic data of the detection method can more accurately reflect the running performance of software, and the accuracy of the detection method can be improved.

[0060] Further, please refer to Figure 2 In a preferred embodiment provided by the application, data representing the performance of target software in running is collected to obtain a first data set, including the following specific steps:

[0061] S101: determining the data type of the attribute representing the performance of software in running to be collected;

[0062] S102: deploying a data monitoring point for target software according to the data type;

[0063] S103: recording monitoring data of the target software in running through the data monitoring point to obtain a first data set.

[0064] It should be noted that the index data representing the performance of software is reflected in many aspects, and therefore the data type of the performance representation element to be collected needs to be determined. The data type can be understood as a category divided according to the corresponding distinguishing features of the attribute representing the performance of software, that is, a category divided according to the corresponding distinguishing features of the performance representation element. Obviously, the data type is different, and the performance representation element corresponding to the data type is different in the form of embodiment. Different embodiment forms often correspond to different data collection positions. The data collection position can be understood as a data monitoring point. Obviously, determining the data monitoring point of target software according to the actual data type can effectively improve the accuracy of the collected data.

[0065] Specifically, in a preferred embodiment provided by the application, the data type includes:

[0066] an aging representation element type at the operating system level;

[0067] a performance representation element type at the application program level;

[0068] a performance failure representation element type at the service level.

[0069] It can be understood that the performance characterization elements of the software objects can be collected at the three levels respectively according to the operating system level, the application program level and the service level. In a specific embodiment, referring to Figure 3 The data monitoring points of the performance characterization elements of the target software are deployed online. The data monitoring points are respectively deployed at the operating system level, the application level and the corresponding service level of the client. The operating system level corresponds to the operating system level, the application level corresponds to the application program level, and the service level corresponding to the client corresponds to the service level. When the data monitoring points of the performance characterization elements of the target software are deployed, the system performance can be monitored at the operating system level by calling the console command, the application program of the software object can be monitored at the application level by connecting the JMX management application port, and the service state of the software object can be monitored at the service level through the client application program interface. The aging characterization element types at the operating system level are mainly system resources, such as CPU usage, memory usage, I / O device consumption, network related state, file handle consumption and other performance indicators. Monitoring and analyzing the operating system resources helps to observe the system performance and handle more requests from the database application by understanding the system resource usage. The software application obtains resources from the underlying operating system, so the performance data of the system can be obtained at the operating system level by calling the console command. For the performance characterization element types at the application program level, for example, for the software application developed in Java, the application level performance characterization elements refer to the performance indicators from the Java virtual machine (JVM), such as the heap memory utilization of the application. The information of the software object at the JVM level is monitored by using the Java management extension (JMX). JMX is a Java application interface, and by connecting the JMX port, the information of the software object node running on the JVM can be connected to establish a connection, and the program state information can be monitored in real time. The performance failure characterization element types at the service level refer to how the database application responds to the user's request. These measurements are basic performance indicators for evaluating the quality of service by determining whether the database application meets the user's needs. For example, the throughput of the database application is represented by the number of application operations (insertion, replacement, update, deletion and query, etc.) per second. The information at the application level is mainly the performance characterization elements reflecting the database business level performance exhibited by the software in the aging process, such as throughput and delay time. The information at this level is closely related to the amount of business to be processed by the database, so the data can be collected in real time through the client application program interface. By respectively deploying the data monitoring points at the operating system level, the application program level and the service level, the running status of the software can be more truly reflected, and the accuracy of the collected data can be effectively improved.

[0070] Further, in a preferred embodiment provided in the present application, the monitoring data of the target software at runtime is recorded by the data monitoring point to obtain a first data set, including the following specific steps:

[0071] The monitoring data of the target software at runtime is obtained from the data monitoring point by an automatic script program;

[0072] The monitoring data is stored in a multi-dimensional time sequence manner to obtain the first data set.

[0073] It can be understood that the automatic script program can be written in various script languages, such as Shell, Perl, and Python, etc. Preferably, the automatic script program herein can be written by Shell. In the specific implementation process, when collecting the monitoring data of the target software at runtime, a Shell script file can be written, and the process of executing a console command, connecting a JMX port, and connecting a client application interface is written into the Shell script file. The sampling interval of the monitoring data can be set as t, and the monitoring command is called once every t to collect the real value of the performance characteristic element data in real time. The runtime data of the multi-layer software failure characteristic elements collected at continuous different time points form a multi-dimensional time sequence. Each software failure characteristic element corresponds to a dimension of the multi-dimensional time sequence, and the multi-dimensional failure characteristic elements corresponding to each sampling time point form the multi-dimensional information of a sample point. The monitoring data is stored in a multi-dimensional time sequence manner to obtain the first data set, realizing automatic monitoring and data storage. The first data set herein is a multi-dimensional performance characteristic time sequence set. Through the automatic data monitoring and storage manner, the data collection efficiency can be effectively improved.

[0074] S200: According to the multicollinearity test standard, the elements in the first data set that do not meet the preset multicollinearity condition are screened out to obtain a second data set representing key performance elements.

[0075] It should be noted that multicollinearity refers to the distortion or difficulty of accurate estimation of the model in the linear regression model due to the existence of exact correlation or high correlation between the explanatory variables. The key performance element can be understood as an attribute value that further reflects the software performance on the basis of the performance characteristic element. By introducing the multicollinearity test standard, the data in the first data set that does not meet the corresponding condition is screened out to obtain the second data set that meets the condition. Apparently, the preset multicollinearity condition herein can be adjusted according to actual conditions to ensure that the screened data meets the actual demand. Through the multicollinearity test standard, the multicollinearity of the second data set can be effectively reduced, and the detection stability is improved.

[0076] For details, please refer to Figure 4In a preferred embodiment provided in this application, elements in the first dataset that do not meet the preset collinearity condition are screened out according to the multicollinearity test criterion to obtain a second dataset representing key performance elements, including the following specific steps:

[0077] S201: Calculate the variance inflation coefficient for each element in the first dataset;

[0078] S202: Compare the variance inflation coefficient with a preset variance inflation coefficient threshold to obtain a comparison result;

[0079] S203: Filter out elements in the first dataset whose comparison results do not meet the preset collinearity condition to obtain a second dataset representing key performance elements;

[0080] Each element represents a sequence of software performance characterization elements.

[0081] It should be noted that there are certain correlations among the performance data collected during software monitoring. Directly processing and using this data would result in low accuracy. Therefore, it is necessary to select the first dataset representing the software performance characteristics. Based on the multicollinearity test principle in regression analysis, the collinearity of different performance characteristics in the first dataset is tested, and performance characteristics with severe collinearity are removed. It should be pointed out that the purpose of selecting the second dataset representing key performance characteristics is to obtain the attributes that describe the key features of software performance failures, removing irrelevant and redundant attributes, making the anomaly detection process faster and consuming fewer resources. Here, the variance inflation coefficient refers to the ratio of the variance when multicollinearity exists among the explanatory variables to the variance when multicollinearity does not exist, reflecting the degree of variance increase caused by multicollinearity. The first dataset can be understood as a multidimensional performance characterization time series set.

[0082] In one specific implementation, assume a multidimensional performance characterization time series set X = {X1, X2, ..., X...} m}, where the first dataset is X. m represents the number of performance representation elements. In the set X... i Let X represent a set of software performance characterization elements, i = 1, 2, ..., m. Iterate through the set X and calculate X for each group. i Variance inflation coefficient (VIF) i The calculation formula is as follows:

[0083]

[0084] Among them, R i For X i The negative correlation coefficients for regression analysis of the remaining serial variables; this factor measures the degree of variance inflation of the multicollinear regression coefficients in the model.

[0085] Pre-set a threshold for variance inflation coefficient and compare VIF. i The result is compared with the variance inflation coefficient threshold. If the comparison result is VIF... i If the variance inflation factor exceeds a threshold, the software performance characteristic sequence is removed, forming a set of Key Performance Indicators (KPIs). For example, the variance inflation factor threshold is preset to 10. If VIF... i If the value is greater than 10, it indicates a severe multicollinearity problem in the sequence and redundancy in the data. In this case, the corresponding software performance characterization element sequence X should be removed. i VIF is retained i A sequence of performance characteristics with fewer than 10 elements constitutes a set of Key Performance Indicators (KPIs). In a specific application scenario, based on the deployment of monitoring data points and after multicollinearity testing, the set of KPIs mainly includes key performance characteristics at three levels: operating system level, application level, and service level. These key performance characteristics can be understood as performance failure characteristics. For example, performance failure characteristics at the operating system level include: "%iowait", representing the percentage of CPU time idle during periods of pending disk I / O requests; "tps", representing the total number of transfers sent per second to physical devices, where transfers are I / O requests to physical devices, and multiple logical requests can be combined into a single I / O request to a device; "kbwrtn / s", representing the amount of data written to devices per second (in blocks); "%memused", representing the percentage of memory used; "cached", representing the amount of memory used by the kernel to cache data; "active", representing the amount of active memory that has been recently used and is generally not reclaimed; "runq-sz", representing the length of the run queue for network activity waiting to run; "plist-sz", representing the number of tasks in the task list; "rxmcst / s", representing the number of multicast packets received per second; "totsck", representing the total number of sockets used; and "handle", representing the total number of file handles used. Application-level performance failure metrics include: "%heapmemused," representing the percentage of heap memory used in the JVM; and "%user," representing the percentage of CPU utilization occurring during application-level execution, excluding the time spent running virtual processors. Service-level performance failure metrics include: "Throughput," representing the number of tasks completed by the database per second; and "Maxlatency(s)," representing the maximum latency required to execute tasks from the client. Clearly, introducing a variance inflation coefficient can effectively filter out targeted performance metrics, improving data reliability.

[0086] Further, in a preferred embodiment provided by the present application, the second data set is pre-labeled by running log data of the target software to mark the corresponding abnormal data and form a sample label.

[0087] It can be understood that the data set for model training needs to be labeled in advance, and after training the abnormal model, the effectiveness of the model needs to be evaluated using the label of the abnormal sample. The second data set here marks the corresponding abnormal data and forms a sample label by searching for information about performance failure of software objects from the log of the target software. For example, according to the performance failure log information and the timestamp when the failure occurs during software running, the data set is labeled. Specifically, the normal sample can be labeled as 0 and the abnormal sample can be labeled as 1. Obviously, based on the data recorded in the running log of the actual target software, the elements in the second data set are labeled, which can effectively improve the accuracy of the labeled information.

[0088] S300: According to the waveform characteristics of the key performance elements, the second data set is denoised by an adaptive discrete wavelet decomposition method to obtain a third data set after denoising.

[0089] It can be understood that when collecting performance data of the target software, some noise will inevitably be introduced into the collected performance data. In a specific embodiment, the adaptive discrete wavelet denoising method is used to exclude the interference of noise and extract valuable software performance failure features from the collected second data set. The second data set here can be understood as a software performance failure element data set. The adaptive discrete wavelet denoising method has excellent time-frequency positioning characteristics. Since it uses a multi-resolution method, the wavelet transform can describe the non-stationary characteristics of the signal to extract and retain valuable performance failure features. By using the adaptive discrete wavelet decomposition method to denoise the data set, the accuracy of the data set can be further improved.

[0090] Specifically, please refer to Figure 5 In a preferred embodiment provided by the present application, according to the waveform characteristics of the key performance elements, the second data set is denoised by an adaptive discrete wavelet decomposition method to obtain a third data set after denoising, including the following specific steps:

[0091] S301: According to the waveform characteristics of the key performance elements, determine the mother wavelet for discrete wavelet decomposition and the decomposition level;

[0092] S302: Discrete wavelet decomposition is performed on the first element in the second data set by using the mother wavelet and the decomposition level to obtain a first element approximation coefficient set and a first element detail coefficient set;

[0093] S303: performing adaptive thresholding processing on the first element detail coefficient set to obtain a thresholded first element final detail coefficient set;

[0094] S304: reconstructing the first element according to the first element approximation coefficient set and the first element final detail coefficient set to obtain a first denoised element;

[0095] S305: processing the remaining elements in the second data set according to the obtaining step of the first denoised element to obtain a third data set after denoising.

[0096] It should be noted that the second data set here can be understood as a key performance indicator element set. Assuming that the key performance indicator element set is KPIs={X1,X2,…,X i}, i represents the number of key performance indicator elements, i.e., the second data set is KPIs.

[0097] In step S301, a mother wavelet ψ(t) used for discrete wavelet decomposition and a decomposition layer number N are determined.

[0098] In step S302, discrete wavelet decomposition is performed on X i in the set KPIs to obtain an approximation coefficient set A={a1,a2,…,a j} and a detail coefficient set D={d1,d2,…,d j}, j=1,2,…,N. Here, X i can be understood as a first element. Apparently, the first element here only indicates an element taken from the set KPIs, and is not a limitation on the position of the taken element. The approximation coefficient set A here can be understood as a first element approximation coefficient set. The detail coefficient set D here can be understood as a first element detail coefficient set.

[0099] In step S303, the approximation coefficient set A is retained, and adaptive thresholding processing is performed on the detail coefficient set D={d1,d2,…,d j}. When performing adaptive thresholding processing, an adaptive thresholding function needs to be used, which is set according to the log function of the length of each decomposition level detail coefficient d j and the standard deviation of d j . The standard deviation is the arithmetic square root of the variance, which calculates the difference between each coefficient in the detail coefficient and the overall mean, reflecting the degree of dispersion of the detail coefficient. The adaptive thresholding function used is as follows:

[0100]

[0101] where std represents the standard deviation, and length represents the length value.

[0102] The specific processing method is as follows:

[0103]

[0104] This equation compares the set of detail coefficients D of the noise signal with an adaptive threshold, and performs nonlinear thresholding on the high-frequency detail coefficients. If the value is less than or equal to the threshold, the value becomes zero, thus obtaining the thresholded detail coefficients D' = {d1', d2', ..., d j The detail coefficient D' here can be understood as the final detail coefficient set of the first element.

[0105] In step S304, based on the Nth-level approximation coefficient a n The detail coefficients D'={d1',d2',…,d at thresholding levels 1 to N j Key performance characteristics of reconstruction and denoising X i The first noise reduction element X is obtained. i '.

[0106] In step S305, the set of key performance indicator elements (KPIs) is traversed, and steps S301 to S304 are repeated to obtain the denoised key performance indicator element dataset KPIs'={X1',X2',…,X i '}. Here, 'KPIs' can be understood as a third dataset.

[0107] Furthermore, in a preferred embodiment provided in this application, the mother wavelet is a Dobesy wavelet.

[0108] It should be noted that the Dobesi wavelet is a type of wavelet function, commonly used in fields such as digital signal analysis, signal compression, and noise removal.

[0109] In step S301, based on the waveform characteristics of the key performance elements, a Daubechies wavelet with a vanishing moment order of 5 is selected as the mother wavelet for discrete wavelet decomposition, specifically db5 from the Daubechies wavelet family (dbN) is selected as the mother wavelet for discrete wavelet decomposition. The Daubechies wavelet includes two functions: low-pass filtering (LPF) and high-pass filtering (HPF). Preferably, the number of decomposition layers in this application is set to 4.

[0110] In step S302, please refer to Figure 6 A schematic diagram of discrete wavelet decomposition, for X in the set KPIs. i Perform hierarchical discrete wavelet decomposition. X in the set KPIs. iThe input signal is passed through a low-pass filter (LPF) and a high-pass filter (HPF), and then downsampled to decompose the original signal into a set of subsequences with low-frequency and high-frequency scales. The low-frequency subsequences are then decomposed step-by-step to obtain the approximate coefficient set A = {a1, a2, ..., a4} at low frequencies and the detail coefficient set D = {d1, d2, ..., d4} at high frequencies. j}, j = 1, 2, ..., 4. Please refer to... Figure 7 The provided diagrams of approximation coefficients and detail coefficients show that a1, a2, a3, and a4 are the approximation coefficients corresponding to the four levels, which can be seen to preserve the waveform of the original signal; d1, d2, d3, and d4 are the detail coefficients corresponding to the four levels, which can be seen to represent irregular fluctuations in the high-frequency state.

[0111] In step S303, the set of low-frequency approximation coefficients A is retained, and the set of detail coefficients D = {d1, d2, ..., d...} is processed. j Adaptive thresholding is performed. Adaptive thresholding requires an adaptive threshold function, which is set based on the detail coefficients d at each decomposition level. j The log function of length and d j The standard deviation is the arithmetic square root of the variance, calculating the difference between each coefficient in the detail coefficients and the population mean, reflecting the dispersion of the detail coefficients. The adaptive threshold function used is as follows:

[0112]

[0113] Where std represents the standard deviation and length represents the length value.

[0114] The specific processing method is as follows:

[0115]

[0116] This equation compares the set of detail coefficients D of the noise signal with an adaptive threshold, and performs nonlinear thresholding on the high-frequency detail coefficients. If the value is less than or equal to the threshold, the value becomes zero, thus obtaining the thresholded detail coefficients D' = {d1', d2', ..., d j The detail coefficient D' here can be understood as the final detail coefficient set of the first element.

[0117] In step S304, based on the set decomposition level 4, the approximation coefficient a4 of level 4 and the thresholded detail coefficients D'={d1',d2',…,d4'} of levels 1 to 4 are selected to reconstruct the key performance characterization element X after removing noise interference. i The first noise reduction element X is obtained. i Please refer to '。 Figure 8The provided original signal and the denoised signal are shown in the schematic diagram. As can be seen from the diagram, the performance failure feature X i The waveform of the original signal is retained, and the performance failure anomaly is more prominent. The transient noise unrelated to the performance failure is removed.

[0118] In step S305, the set of key performance characterization elements KPIs is traversed, and the above steps S301-S304 are repeated to obtain the denoised key characterization element dataset KPIs' = {X1', X2', …, X i '}. Here, KPIs' can be understood as a third dataset.

[0119] S400: Train the anomaly detection model with the third dataset to obtain a software performance anomaly detection model.

[0120] It can be understood that before the anomaly detection model is trained with a specific dataset, the model cannot complete the actual detection work. After the anomaly detection model is trained with a specific dataset, the model can be used in the corresponding detection work. In order to preliminarily evaluate the detection effect of the trained software performance anomaly detection model, the third dataset can be divided into a training set and a test set. The training set is used to train the anomaly detection model, and the test set is used to evaluate the trained anomaly detection model, and finally the software performance anomaly detection model used for actual detection work is obtained. It should be noted that there are many types of anomaly detection models, and the present application can use a general or specific anomaly detection model for corresponding model training operations.

[0121] Specifically, in a preferred embodiment provided by the present application, the anomaly detection model uses an independent forest anomaly detection algorithm.

[0122] It should be noted that the independent forest here can also be called an isolated forest, i.e. iForest (IsolationForest), which is a fast anomaly detection method based on Ensemble, has linear time complexity and high accuracy, and is a state-of-the-art algorithm that meets the requirements of big data processing. In the specific implementation process, the third dataset can be divided into a training set and a test set, and the anomaly detection model is trained and evaluated. Specifically, the key characterization element dataset KPIs' can be divided into a training set and a test set, and the anomaly detection model iForest is trained. The training set can be set to 70% of the dataset KPIs', and the test set is set to 30% of the dataset KPIs'. The training set is used to train the anomaly detection model, and the test set is used to evaluate the detection effect of the anomaly detection model.

[0123] S500: Detect the target software to be tested by the software performance anomaly detection model to obtain a detection result.

[0124] It can be understood that the software performance anomaly detection model is trained by a data set of key performance elements for representing software performance anomaly conditions. The target software to be detected can be understood as a certain software identical to the target software corresponding to the third data set, or a software belonging to the same category as the target software corresponding to the third data set.

[0125] Referring to Figure 9 The application further provides a software performance anomaly condition detection device 100, comprising:

[0126] A collection module 11 is configured to collect data of attributes representing running conditions of a target software during running, to obtain a first data set;

[0127] A screening module 12 is configured to screen out elements in the first data set that do not meet a preset multicollinearity condition according to a multicollinearity test standard, to obtain a second data set representing key performance elements;

[0128] A noise reduction module 13 is configured to perform noise reduction processing on the second data set by an adaptive discrete wavelet decomposition method according to waveform features of the key performance elements, to obtain a third data set after noise reduction;

[0129] A processing module 14 is configured to train an anomaly detection model by using the third data set, to obtain a software performance anomaly detection model;

[0130] A detection module 15 is configured to detect a target software to be detected by using the software performance anomaly detection model, to obtain a detection result.

[0131] It can be understood that the performance of software can be truly reflected only in actual running process, and theoretical performance derived from theoretical deduction from logical structure of software code, selection of programming language and configuration of running environment, etc. is often far from actual performance. The attributes can be understood as attribute values representing software running performance, which can be referred to as performance representing elements. The data can be understood as numerical values of attributes representing software running performance during running. The first data set in the application can be understood as a performance data set collected during dynamic running of software, for representing performance data of online monitoring software during running. It is obvious that the first data set as basic data of the detection method can more accurately reflect the running performance of software by collecting actual data of performance representing elements of software during running, to improve accuracy of the detection method.

[0132] Further, in a preferred embodiment provided by the application, the collection module 11 is specifically configured to:

[0133] determine a data type of attributes representing running conditions of software to be collected;

[0134] According to the data type, a target software deployment data monitoring point is determined;

[0135] Through the data monitoring point, monitoring data of the target software running time is recorded to obtain a first data set.

[0136] It should be noted that the index data embodying the software running performance is reflected in multiple aspects, and therefore, the data type of the performance characterization element to be collected needs to be determined. The data type here can be understood as a category of properties representing the software running condition according to corresponding distinguishing features, i.e., a category of performance characterization elements according to corresponding distinguishing features. Obviously, the data type is different, and the performance characterization element corresponding thereto is different in the form of embodiment, and different forms of embodiment often correspond to different data collection positions. The data collection position here can be understood as a data monitoring point. It is obvious that the data monitoring point of the target software is determined according to the actual data type, which can effectively improve the accuracy of the collected data.

[0137] Specifically, in a preferred embodiment provided by the present application, the data type includes:

[0138] an aging characterization element type of an operating system level;

[0139] a performance characterization element type of an application program level;

[0140] a performance failure characterization element type of a service level.

[0141] It can be understood that according to the operating system level, the application program level and the service level, the performance characterization elements of the software object can be collected at the three levels respectively. In a specific embodiment, please refer to Figure 3The data monitoring points of the online monitoring performance characterization elements of the target software are deployed. The data monitoring points are respectively deployed in the operating system layer, the application layer, and the corresponding service layer of the client. The operating system layer corresponds to the operating system level, the application layer corresponds to the application program level, and the service layer corresponding to the client corresponds to the service level. When deploying the data monitoring points of the performance characterization elements of the target software, the system performance can be monitored by calling the console command in the operating system layer, the application program of the software object can be monitored by connecting the JMX management application port in the application layer, and the service state of the software object can be monitored by the client application program interface in the service layer. The aging characterization element types in the operating system level are mainly system resources, such as CPU usage, memory usage, I / O device consumption, network-related state, file handle consumption, and other performance indicators. Monitoring and analyzing the operating system resources help to observe the system performance and process more requests from the database application by understanding the system resource usage. The software application obtains resources from the underlying operating system, so the performance data of the system can be obtained by calling the console command in the operating system layer. For the performance characterization element types in the application program level, for example, for the software application developed by Java, the application-level performance characterization elements refer to the performance indicators from the Java virtual machine (JVM), such as the heap memory utilization of the application. The information of the software object in the JVM layer is monitored by using the Java management extension (JMX). The JMX is a Java application interface, and the connection with the information of the software object node running in the JVM can be established by connecting the JMX port, so as to monitor the program state information in real time. The performance failure characterization element types in the service level refer to how the database application responds to the user's request. These measurements are basic performance indicators for evaluating the service quality by determining whether the database application meets the user's demand. For example, the throughput of the database application is represented by the number of application operations (insertion, replacement, update, deletion, and query, etc.) per second. The information in the application program level is mainly the performance characterization elements reflecting the database business level, such as the throughput and delay time, which are exhibited by the software in the aging process. The information in this level is closely related to the amount of business to be processed by the database, so the data can be collected in real time through the client application program interface. By respectively deploying the data monitoring points in the operating system level, the application program level, and the service level, the running status of the software can be more truly reflected, and the accuracy of the collected data can be effectively improved.

[0142] Further, in a preferred embodiment provided in the application, the monitoring data of the target software during runtime is recorded through the data monitoring points to obtain a first data set, including the following specific steps:

[0143] The monitoring data of the target software during runtime is obtained from the data monitoring points through an automatic script program.

[0144] The monitoring data is stored in a multi-dimensional time sequence manner to obtain a first data set.

[0145] It can be understood that the automation script program can be written in various script languages, such as Shell, Perl, and Python. Preferably, the automation script program herein can be written by Shell. In the specific implementation process, when collecting the monitoring data of the target software running, a Shell script file can be written to write the process of calling the console command, connecting the JMX port, and connecting the client application interface into the Shell script file. The sampling interval of the monitoring data can be set to t, and the monitoring command is called once every t to collect the real value of the performance characteristic element data in real time. The runtime data of the multi-layer software failure characteristic elements collected at continuous different time points form a multi-dimensional time sequence. Each software failure characteristic element corresponds to a dimension of the multi-dimensional time sequence, and the multi-dimensional failure characteristic elements corresponding to each sampling time point form multi-dimensional information of a sample point. The monitoring data is stored in a multi-dimensional time sequence manner to obtain a first data set, and the automation monitoring and data storage are realized. The first data set herein is a multi-dimensional performance characteristic time sequence set. Through the automated data monitoring and storage manner, the data collection efficiency can be effectively improved.

[0146] It should be noted that the multicollinearity refers to that the estimation of the model is distorted or difficult to be accurately estimated due to the existence of exact correlation or high correlation between the explanatory variables in the linear regression model. The key performance element can be understood as the attribute value that can better reflect the software performance after further screening on the basis of the performance characteristic element. Through the introduction of the multicollinearity test standard, the data in the first data set that does not meet the corresponding condition is screened out to obtain a second data set that meets the condition. Apparently, the preset collinearity condition herein can be adjusted according to the actual situation to ensure that the screened data meets the actual demand. Through the multicollinearity test standard, the multicollinearity of the second data set can be effectively reduced, and the detection stability is improved.

[0147] Specifically, in a preferred embodiment provided in the application, the screening module 12 is specifically used for:

[0148] calculating a variance inflation factor of each element in the first data set;

[0149] comparing the variance inflation factor with a preset variance inflation factor threshold to obtain a comparison result;

[0150] screening out elements in the first data set whose comparison result does not meet a preset collinearity condition to obtain a second data set representing key performance elements;

[0151] The each element represents a group of software performance characteristic element sequences.

[0152] It should be noted that there are certain correlations among the performance data collected during software monitoring. Directly processing and using this data would result in low accuracy. Therefore, it is necessary to select the first dataset representing the software performance characteristics. Based on the multicollinearity test principle in regression analysis, the collinearity of different performance characteristics in the first dataset is tested, and performance characteristics with severe collinearity are removed. It should be pointed out that the purpose of selecting the second dataset representing key performance characteristics is to obtain the attributes that describe the key features of software performance failures, removing irrelevant and redundant attributes, making the anomaly detection process faster and consuming fewer resources. Here, the variance inflation coefficient refers to the ratio of the variance when multicollinearity exists among the explanatory variables to the variance when multicollinearity does not exist, reflecting the degree of variance increase caused by multicollinearity. The first dataset can be understood as a multidimensional performance characterization time series set.

[0153] In one specific implementation, assume a multidimensional performance characterization time series set X = {X1, X2, ..., X...} m}, where the first dataset is X. m represents the number of performance representation elements. In the set X... i Let X represent a set of software performance characterization elements, i = 1, 2, ..., m. Iterate through the set X and calculate X for each group. i Variance inflation coefficient (VIF) i The calculation formula is as follows:

[0154]

[0155] Among them, R i For X i The negative correlation coefficients for regression analysis of the remaining serial variables; this factor measures the degree of variance inflation of the multicollinear regression coefficients in the model.

[0156] Pre-set a threshold for variance inflation coefficient and compare VIF. i The result is compared with the variance inflation coefficient threshold. If the comparison result is VIF... i If the variance inflation factor exceeds a threshold, the sequence of software performance characterization elements is removed, forming a set of Key Performance Indicators (KPIs). For example, if the variance inflation factor threshold is preset to 10, and the VIF... i If the value is greater than 10, it indicates a severe multicollinearity problem in the sequence and redundancy in the data. In this case, the corresponding software performance characterization element sequence X should be removed. i VIF iThe performance characterization element sequence <10 constitutes a set of key performance indicators (KPIs). In a specific application scenario, according to the deployment of the monitoring data points, after multiple collinearity tests, the set of KPIs mainly contains three levels of key performance indicators. The three levels include: the operating system level, the application program level, and the service level. The key performance indicators here can be understood as performance failure characterization elements. For example, the performance failure characterization elements of the operating system level: "%iowait", representing the percentage of CPU idle time during which the system has outstanding disk I / O requests; "tps", representing the total number of transmissions sent to physical devices per second, where a transmission is an I / O request to a physical device, and multiple logical requests can be combined into one I / O request to the device; "kbwrtn / s", representing the amount of data written to the device per second (in blocks); "%memused", representing the percentage of used memory; "cached", representing the amount of kernel memory used for caching data; "active", representing the amount of active memory that has recently been used and is generally not recycled; "runq-sz", representing the length of the running queue of network activity waiting time; "plist-sz", representing the number of tasks in the task list; "rxmcst / s", representing the number of multicast data packets received per second; "totsck", representing the total number of sockets used; "handle", representing the total number of file handles used. The performance failure characterization elements of the application program level: "%heapmemused", representing the percentage of used heap memory in JVM; "%user", representing the percentage of CPU utilization when the application program is executed, which does not include the time spent running virtual processors. The performance failure characterization elements of the service level: "Throughput", representing the number of tasks completed by the database per second; "Maxlatency(s)", representing the maximum delay time required to execute a task from the client. Obviously, by introducing the coefficient of variation, targeted performance characterization elements can be effectively screened, improving the reliability of the data.

[0157] Further, in a preferred embodiment provided in the present application, the second data set is pre-marked with corresponding abnormal data by running log data of the target software to form a sample label.

[0158] It can be understood that the data set for model training is labeled in advance, and after training the anomaly model, the effectiveness of the model needs to be evaluated using the label of the anomaly sample. The second data set here is labeled by the log of the target software to find information about the performance failure of the software object, and the corresponding abnormal data is labeled to form a sample label. For example, according to the performance failure log information and the timestamp when the failure occurs during software running, the data set is labeled. Specifically, the normal sample can be labeled as 0, and the abnormal sample can be labeled as 1. Obviously, based on the data recorded in the running log of the actual target software, the elements in the second data set are labeled, which can effectively improve the accuracy of the labeled information.

[0159] It should be noted that when collecting the performance data of the target software, some noise will inevitably be introduced into the collected performance data. In a specific embodiment, the adaptive discrete wavelet denoising method is used to exclude the interference of noise, and valuable software performance failure features are extracted from the collected second data set. The second data set here can be understood as a software performance failure feature data set. The adaptive discrete wavelet denoising method has excellent time-frequency positioning characteristics. Since it uses a multi-resolution method, wavelet transform can describe the non-stationary characteristics of the signal to extract and retain valuable performance failure features. By using the adaptive discrete wavelet decomposition method for data set denoising, the accuracy of the data set can be further improved.

[0160] Specifically, in a preferred embodiment provided by the present application, the denoising module 13 is specifically used for:

[0161] According to the waveform characteristics of the key performance elements, the mother wavelet and the decomposition layer number for discrete wavelet decomposition are determined;

[0162] The first element in the second data set is decomposed by the mother wavelet and the decomposition layer number to obtain a first element approximation coefficient set and a first element detail coefficient set;

[0163] The first element detail coefficient set is adaptively thresholded to obtain a thresholded first element final detail coefficient set;

[0164] According to the first element approximation coefficient set and the first element final detail coefficient set, the first element is reconstructed to obtain a first denoised element;

[0165] According to the first denoised element, the remaining elements in the second data set are processed to obtain a third denoised data set.

[0166] It should be noted that the second data set here can be understood as a key performance feature set. Assuming that the key performance feature set is KPIs = {X1, X2, …, Xi} and i represents the number of key performance indicators, i.e. the second data set is KPIs. In a specific embodiment, the steps are as follows:

[0167] The mother wavelet ψ(t) for discrete wavelet decomposition and the number of decomposition levels N are determined.

[0168] X i from the set KPIs is taken as the first element. j Discrete wavelet decomposition is performed on the first element to obtain an approximation coefficient set A = {a1, a2, …, a j} and a detail coefficient set D = {d1, d2, …, d i} at the first level, where X j can be understood as the first element. Obviously, the first element here only indicates that an element is taken from the set KPIs, and is not a limitation on the position of the taken element. The approximation coefficient set A here can be understood as the first element approximation coefficient set. The detail coefficient set D here can be understood as the first element detail coefficient set.

[0169] The approximation coefficient set A is retained, and the detail coefficient set D = {d1, d2, …, d j} is subjected to adaptive thresholding processing. An adaptive thresholding function is used in adaptive thresholding processing, and the setting basis is the log function of the length of each decomposition level and the standard deviation of d j . The standard deviation is the arithmetic square root of the variance, which calculates the difference between each coefficient in the detail coefficient and the overall mean, reflecting the degree of dispersion of the detail coefficient. The adaptive thresholding function used is as follows:

[0170]

[0171] where std represents the standard deviation, and length represents the length value.

[0172] The specific processing method is as follows:

[0173]

[0174] This equation compares the detail coefficient set D of the noise signal and the adaptive threshold, and performs nonlinear thresholding processing on the high-frequency detail coefficient. If the value is less than or equal to the threshold, the point becomes zero, and the thresholding-processed detail coefficient D' = {d1', d2', …, d j '} is obtained. The detail coefficient D' here can be understood as the first element final detail coefficient set.

[0175] According to the N-level approximation coefficient a n and the thresholding detail coefficient D' = {d1', d2', …, d jKey performance characterization elements X of the denoised reconstruction i , to obtain the first denoised element X i .

[0176] Iterate the above steps through the set of key performance characterization elements KPIs to obtain the denoised key characterization element dataset KPIs' = {X1', X2', …, X i '}. Here, KPIs' can be understood as a third dataset.

[0177] Further, in a preferred embodiment provided by the present application, the mother wavelet is a Daubechies wavelet.

[0178] It should be noted that the Daubechies wavelet is a wavelet function commonly used in the fields of digital signal analysis, signal compression, and noise removal. In a specific embodiment, the steps are as follows:

[0179] According to the waveform characteristics of the key performance elements, a Daubechies wavelet with a vanishing moment order of 5 is selected as the mother wavelet for discrete wavelet decomposition, i.e., db5 in the Daubechies (dbN) wavelet family is selected as the mother wavelet for discrete wavelet decomposition. The Daubechies wavelet includes a low-pass filter (LPF) and a high-pass filter (HPF). Preferably, the number of decomposition layers in the present application is set to 4.

[0180] Please refer to Figure 6 the discrete wavelet decomposition schematic diagram, and perform hierarchical discrete wavelet decomposition on X i in the set KPIs. X i in the set KPIs is input into the low-pass filter LPF and the high-pass filter HPF, and then is down-sampled to decompose the original signal into a set of sub-sequences with low and high frequency scales; then the low-frequency scale sub-sequences are decomposed level by level, and finally the approximation coefficient set A = {a1, a2, …, a4} at low frequency and the detail coefficient set D = {d1, d2, …, d j}, j = 1, 2, …, 4 are obtained. Please refer to Figure 7 the approximation coefficient and detail coefficient schematic diagram provided by the present application, a1, a2, a3, a4 are the approximation coefficients corresponding to the four levels, respectively, and it can be seen that the waveform of the original signal is preserved; d1, d2, d3, d4 are the detail coefficients corresponding to the four levels, respectively, and it can be seen that they are irregular fluctuations at high frequency.

[0181] The approximation coefficient set A is retained, and the detail coefficient set D = {d1, d2, …, d j} is subjected to adaptive thresholding processing. An adaptive thresholding function is required when performing adaptive thresholding processing, and the setting basis is the detail coefficient d jThe log function of length and d j The standard deviation is the arithmetic square root of the variance, calculating the difference between each coefficient in the detail coefficients and the population mean, reflecting the dispersion of the detail coefficients. The adaptive threshold function used is as follows:

[0182]

[0183] Where std represents the standard deviation and length represents the length value.

[0184] The specific processing method is as follows:

[0185]

[0186] This equation compares the set of detail coefficients D of the noise signal with an adaptive threshold, and performs nonlinear thresholding on the high-frequency detail coefficients. If the value is less than or equal to the threshold, the value becomes zero, thus obtaining the thresholded detail coefficients D' = {d1', d2', ..., d j The detail coefficient D' here can be understood as the final detail coefficient set of the first element.

[0187] Based on the set decomposition level of 4, the approximation coefficient a4 of level 4 and the thresholded detail coefficients D'={d1',d2',…,d4'} of levels 1 to 4 are selected to reconstruct the key performance characterization element X after removing noise interference. i The first noise reduction element X is obtained. i Please refer to '。 Figure 8 A schematic diagram of the original signal and the denoised signal is provided. The diagram shows the failure characterization element X after denoising and reconstruction. i The waveform of the original signal was preserved, the performance failure anomaly was made more prominent, and transient noise unrelated to the performance failure was removed.

[0188] Iterate through the set of key performance indicators (KPIs) and repeat the above steps to obtain the denoised dataset of key performance indicators (KPIs) KPIs'={X1',X2',…,X i '}. Here, 'KPIs' can be understood as a third dataset.

[0189] It can be understood that the anomaly detection model cannot complete the actual detection work before being trained by a specific data set. After the anomaly detection model is trained by a specific data set, the model can be used in the corresponding detection work. In order to preliminarily evaluate the detection effect of the trained software performance anomaly detection model, the third data set can be divided into a training set and a test set. The training set is used to train the anomaly detection model, and the test set is used to evaluate the trained anomaly detection model, and finally the software performance anomaly detection model used for actual detection work is obtained. It should be noted that there are many types of anomaly detection models, and the present application can use general or specific anomaly detection models for corresponding model training operations.

[0190] Specifically, in a preferred embodiment provided by the present application, the anomaly detection model adopts an independent forest anomaly detection algorithm.

[0191] It should be noted that the independent forest here can also be called an isolated forest, i.e. iForest (IsolationForest), which is a fast anomaly detection method based on Ensemble, has linear time complexity and high accuracy, and is a state-of-the-art algorithm that meets the requirements of big data processing. In the specific implementation process, the third data set can be divided into a training set and a test set, and the anomaly detection model is trained and evaluated. Specifically, the key performance element data set KPIs' can be divided into a training set and a test set, and the anomaly detection model iForest is trained. The training set can be set to 70% of the data set KPIs', and the test set is set to 30% of the data set KPIs'. The training set is used to train the anomaly detection model, and the test set is used to evaluate the detection effect of the anomaly detection model.

[0192] It can be understood that the software performance anomaly detection model is trained by a data set of key performance elements representing software performance anomalies. The target software to be tested can be understood as the same software as the target software corresponding to the third data set, or the target software corresponding to the third data set belongs to the same category.

[0193] The embodiments provided by the present application have at least the following beneficial effects:

[0194] By combining the use of multiple collinearity test standards, adaptive discrete wavelet decomposition method and anomaly detection model, the problems of excessive noise in software performance failure characterization element data set and unobvious software performance failure characteristics are effectively solved, thereby improving the accuracy of software detection.

[0195] It is also to be noted that the terms "comprising", "including", and any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises a... " does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the recited element.

[0196] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer-readable program code.

[0197] The embodiments of the present application described above are only used to explain the technical solutions of the present application and not to limit the present application. Although the present application has been described in detail, those skilled in the art will understand that the present application can make various modifications and changes without departing from the spirit and scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of the claims of the present application.

Claims

1. A method of detecting software performance anomalies, characterized by, The method comprises the following specific steps: Collecting data of attributes representing the running state of the target software to obtain a first data set; According to a multicollinearity test standard, elements in the first data set that do not meet a preset multicollinearity condition are screened out to obtain a second data set representing key performance elements; According to waveform characteristics of the key performance elements, a mother wavelet and a decomposition layer number for discrete wavelet decomposition are determined; The first elements in the second data set are subjected to discrete wavelet decomposition by using the mother wavelet and the decomposition layer number to obtain a first element approximation coefficient set and a first element detail coefficient set; The first element detail coefficient set is subjected to adaptive thresholding processing to obtain a thresholded first element final detail coefficient set; The first element is reconstructed according to the first element approximation coefficient set and the first element final detail coefficient set to obtain a first denoised element; The remaining elements in the second data set are processed according to the obtaining step of the first denoised element to obtain a third data set after denoising; The third data set is used to train an anomaly detection model to obtain a software performance anomaly detection model; The target software to be tested is detected by using the software performance anomaly detection model to obtain a detection result.

2. The detection method of claim 1, wherein, Collecting data of attributes representing the running state of the target software to obtain a first data set comprises the following specific steps: Determining a data type of the attributes representing the running state of the software to be collected; Deploying a data monitoring point for the target software according to the data type; Recording monitoring data of the target software in running through the data monitoring point to obtain the first data set.

3. The detection method of claim 2, wherein, The data type comprises: an aging representation element type at an operating system level; a performance representation element type at an application program level; a performance failure representation element type at a service level.

4. The detection method as described in claim 2, characterized in that, Recording monitoring data of the target software in running through the data monitoring point to obtain the first data set comprises the following specific steps: Obtaining the monitoring data of the target software in running from the data monitoring point through an automatic script program; Storing the monitoring data in a multi-dimensional time sequence manner to obtain the first data set.

5. The detection method as described in claim 1, characterized in that, According to a multicollinearity test standard, elements in the first data set that do not meet a preset multicollinearity condition are screened out to obtain a second data set representing key performance elements, which comprises the following specific steps: Calculating a variance inflation coefficient of each element in the first data set; Comparing the variance inflation coefficient with a preset variance inflation coefficient threshold to obtain a comparison result; Screening out elements in the first data set that do not meet the preset multicollinearity condition according to the comparison result to obtain the second data set representing the key performance elements; The each element represents a group of software performance representation element sequences.

6. The method of claim 1, wherein, The second data set is pre-marked with corresponding abnormal data through running log data of the target software to form a sample label.

7. The detection method as described in claim 1, characterized in that, The mother wavelet is a Morlet wavelet.

8. The method of claim 1, wherein, The anomaly detection model adopts an independent forest anomaly detection algorithm.

9. A device for detecting software performance anomalies, characterized in that, The method comprises the following steps: A collecting module is configured to collect data of attributes representing the running state of the target software to obtain a first data set; The screening module is configured to screen out elements in the first data set that do not meet a preset multicollinearity condition according to a multicollinearity test criterion, to obtain a second data set representing key performance elements; The noise reduction module is configured to: determine a mother wavelet and a decomposition layer number for discrete wavelet decomposition according to a waveform feature of the key performance elements; perform discrete wavelet decomposition on a first element in the second data set by using the mother wavelet and the decomposition layer number, to obtain a first element approximation coefficient set and a first element detail coefficient set; perform adaptive thresholding processing on the first element detail coefficient set, to obtain a thresholded first element final detail coefficient set; reconstruct the first element according to the first element approximation coefficient set and the first element final detail coefficient set, to obtain a first noise-reduced element; and perform the obtaining step on the first noise-reduced element, to obtain a third data set after noise reduction. The processing module is configured to train an anomaly detection model by using the third data set, to obtain a software performance anomaly detection model. The detection module is configured to detect a target software to be tested by using the software performance anomaly detection model, to obtain a detection result.

Images