System anomaly detection method, device, computer program product, and electronic device

Abstract

The present invention discloses a system anomaly detection method, device, computer program product, and electronic device. The relevant embodiments can be applied to various scenarios such as cloud technology, cloud security, artificial intelligence, and smart transportation. The method includes: collecting operating data of multiple operating indicators of a target system according to a preset frequency; extracting the operating data of each operating indicator according to a preset time window to obtain multiple indicator time series corresponding to the multiple operating indicators; inputting the multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-target decision tree anomaly detection processing to obtain multiple anomaly detection results output by multiple target decision trees; and performing weighted frequency statistical processing on the multiple anomaly detection results to determine and output the target anomaly detection results of the target system. The present invention solves the technical problem of low efficiency of anomaly detection.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a system anomaly detection method, device, computer program product, and electronic equipment. Background Art

[0002] With the development of current Internet technologies, clients have increasingly higher requirements for system stability and availability. Currently, system security monitoring is usually performed manually by operations and maintenance personnel, which requires high labor costs and is prone to omissions.

[0003] Applying AI to system operations and maintenance can reduce labor costs. Commonly used AI algorithms include supervised learning and unsupervised learning. Supervised learning requires labeled training data, typically obtained through manual labeling, which is costly, labor-intensive, and inefficient. Unsupervised learning uses algorithms to identify outliers in the data. However, spatial outliers are not necessarily abnormal. Furthermore, the scores calculated by unsupervised algorithms require manual thresholds to define anomalies. Different thresholds can affect the final precision and recall rates.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] Embodiments of the present invention provide a system anomaly detection method, apparatus, computer program product, and electronic device to at least solve the technical problem of low anomaly detection efficiency.

[0006] According to one aspect of an embodiment of the present invention, a system anomaly detection method is provided, comprising: collecting operating data of multiple operating indicators of a target system at a preset frequency, wherein the operating indicators include hardware indicators and software indicators when the target system is running, and the operating data is data of each indicator when the target system is running; extracting the operating data of each operating indicator according to a preset time window to obtain multiple indicator time series corresponding to the multiple operating indicators, wherein each operating indicator corresponds to an indicator time series, and each indicator time series includes a set of operating data when the corresponding operating indicator is running; inputting the multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-target decision tree anomaly detection processing to obtain multiple anomaly detection results output by multiple target decision trees; performing weighted number statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system, wherein the target anomaly detection result includes a target anomaly type when an anomaly occurs in the target system.

[0007] Optionally, multiple indicator time series corresponding to the multiple operating indicators are input into the system anomaly detection model to perform multi-objective decision tree anomaly detection processing, including: performing the following operations on each indicator time series in the multiple indicator time series, when performing the following operations, each indicator time series is the current indicator time series of the current operating indicator: inputting the current indicator time series into the current decision tree corresponding to the current operating indicator in the system anomaly detection model, and obtaining the current anomaly detection result determined by the current decision tree according to the current indicator time series.

[0008] Optionally, the current indicator time series is input into the current decision tree corresponding to the current operating indicator in the system anomaly detection model to obtain the current anomaly detection result determined by the current decision tree based on the current indicator time series, including: determining the parameter value of the target parameter corresponding to the current operating indicator based on a set of data of the current operating indicator included in the current indicator time series; when the decision conditions in the current decision tree include multiple preset value intervals of the target parameter and each of the preset value intervals corresponds to one of multiple anomaly types, determining the current preset value interval in which the parameter value is located in the multiple preset value intervals; determining the anomaly type corresponding to the current preset value interval as the current anomaly detection result output by the current decision tree.

[0009] Optionally, determining the current value interval in which the parameter value is located among the multiple preset value intervals includes: when the target parameter includes multiple parameters and each of the preset value intervals is a combination of a value interval of each parameter in the multiple parameters, determining the current preset value interval among the multiple preset value intervals, wherein the current preset value interval includes a combination of the current value interval of each parameter in the multiple parameters, the parameter value of the target parameter includes the current values of the multiple parameters, and the current values of the multiple parameters are respectively located in the current value intervals of the multiple parameters.

[0010] Optionally, the weighted number of statistical processing is performed on the multiple abnormality detection results to determine and output the target abnormality detection result of the target system, including: when the multiple target decision trees are N target decision trees, the multiple abnormality detection results include N abnormality detection results determined by the N target decision trees, and each abnormality type in the N abnormality detection results is an abnormality type among multiple abnormality types, determining the abnormality type that appears the most times among the N abnormality types as the target abnormality type, wherein N is a natural number greater than or equal to 2.

[0011] Optionally, the weighted number of statistical processing of the multiple abnormality detection results to determine and output the target abnormality detection result of the target system includes: when the multiple target decision trees are N target decision trees, the multiple abnormality detection results include N abnormality detection results determined by the N target decision trees, and M abnormality types among the multiple abnormality types appear in the N abnormality detection results, determining the weighted number of times the M abnormality types appear in the N abnormality types, wherein the weighted number of times the i-th abnormality type among the M abnormality types appears is equal to the value obtained by weighted summing the number of times the i-th abnormality type determined by each target decision tree, wherein N is a natural number greater than or equal to 2, M is less than or equal to N, and i is greater than or equal to 1 and less than or equal to M; and determining the abnormality type with the largest weighted number of times among the weighted numbers of times the M abnormality types appear as the target abnormality type.

[0012] Optionally, the system anomaly detection model is trained by the following steps: running a target project on the target system to control the target system to have an anomaly of a specified anomaly type, wherein the target system is controlled by the target project according to corresponding input parameters to have an anomaly of the specified anomaly type; when the target system has an anomaly of the specified anomaly type, obtaining abnormal operation data of the corresponding operation indicator to obtain an abnormal indicator time series corresponding to the operation indicator; using the abnormal indicator time series of the corresponding operation indicator to train a decision tree to obtain the target decision tree corresponding to the operation indicator.

[0013] Optionally, the following steps are used to obtain an abnormality indicator time series when a specified abnormality type occurs in the target system: obtain a set of input parameters corresponding to the specified abnormality type, wherein each input parameter in the set of input parameters is used to control the target system to have an abnormality of the specified abnormality type; run the target project according to each input parameter in the set of input parameters to control the target system to have an abnormality of the specified abnormality type; record P groups of abnormality indicator time series formed by data of P operating indicators in the target system when an abnormality of the specified abnormality type occurs in the target system, wherein P is a natural number greater than or equal to 1, and the P operating indicators are operating indicators of data abnormality when an abnormality of the specified abnormality type occurs in the target system, and each group of abnormal indicator time series in the P groups of abnormal indicator time series is an abnormal indicator time series of a corresponding operating indicator among the P operating indicators.

[0014] Optionally, acquiring a set of input parameters corresponding to the specified exception type includes: selecting the specified exception type from a plurality of exception types preset in the target project, and acquiring the set of input parameters corresponding to the specified exception type.

[0015] Optionally, obtaining a set of input parameters corresponding to the specified exception type includes: obtaining the set of input parameters corresponding to one of the exception types: CPU high load exception type, memory high load exception type, input and output high load exception type, disk fill exception type, docker / pod kill exception type, network rejection exception type, network timeout exception type, network delay exception type, and network packet loss exception type.

[0016] Optionally, the method further includes: when the multiple target decision trees are N target decision trees and the multiple operating indicators are N operating indicators, after obtaining the abnormal indicator time series when each of the multiple abnormal types occurs in the target system, the acquired abnormal indicator time series and the corresponding abnormal type are formed into N abnormal training sample sets of the N operating indicators, wherein N is a natural number greater than or equal to 1, and each abnormal training sample set includes the abnormal training sample of the corresponding operating indicator in the N operating indicators; using the N abnormal training sample sets of the N operating indicators, respectively train the N decision trees to be trained to obtain the N target decision trees, wherein the abnormal training sample set of each operating indicator is used to train the decision tree to be trained corresponding to each operating indicator in the N decision trees to be trained.

[0017] Optionally, the use of the N abnormal training sample sets of the N operating indicators to train the N decision trees to be trained respectively to obtain the N target decision trees includes: training the sth decision tree to be trained to obtain the sth target decision tree by executing the following steps, wherein 1≤s≤N, the sth decision tree to be trained corresponds to the sth operating indicator, the abnormal training sample set of the sth operating indicator includes Q abnormal indicator time series and corresponding Q actual abnormality types, Q is a natural number greater than or equal to 1: according to a set of data of the sth operating indicator included in each abnormal indicator time series in the Q abnormal indicator time series, determining the parameter value of the target parameter corresponding to the sth operating indicator, wherein the target parameter includes the mean parameter at least one of a parameter, a standard deviation parameter, and a slope parameter, the decision condition of the sth decision tree to be trained includes a plurality of value intervals to be adjusted of the target parameter; according to the parameter value of the target parameter corresponding to the sth operating indicator and the Q actual abnormality types, the plurality of value intervals to be adjusted in the decision condition of the sth decision tree to be trained are adjusted to obtain the sth target decision tree, wherein, when the decision condition of the sth target decision tree includes the plurality of preset value intervals of the target parameter obtained by adjustment, according to the relationship between the parameter value of the target parameter corresponding to the sth operating indicator and the decision condition of the sth target decision tree, the errors between the Q predicted abnormality types and the Q actual abnormality types determined meet a preset convergence condition.

[0018] Optionally, after determining that the abnormality detection result that occurs most frequently among the multiple abnormality detection results is the target abnormality detection result of the target system, the method further includes: sending an alarm message to the target application, wherein the alarm message is used to indicate that an abnormality of the target abnormality type occurs in the target system.

[0019] According to another aspect of an embodiment of the present invention, a system anomaly detection device is also provided, including: an acquisition module for collecting operating data of multiple operating indicators of a target system at a preset frequency, wherein the operating indicators include hardware indicators and software indicators when the target system is running, and the operating data are data of each indicator when the target system is running; an extraction module for collecting operating data of multiple operating indicators of the target system at a preset frequency, wherein the operating indicators include hardware indicators and software indicators when the target system is running, and the operating data are data of each indicator when the target system is running; a processing module for inputting multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-objective decision tree anomaly detection processing to obtain multiple anomaly detection results output by multiple target decision trees; a determination module for performing weighted number statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system, wherein the target anomaly detection result includes a target anomaly type when an anomaly occurs in the target system.

[0020] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the above-mentioned system anomaly detection method when running.

[0021] According to another aspect of an embodiment of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the anomaly detection method of the above system.

[0022] According to another aspect of an embodiment of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned system abnormality detection method through the computer program.

[0023] In this embodiment of the present invention, a target decision tree can automatically predict the type of system anomalies, avoiding the low accuracy of manual monitoring of system anomalies in the prior art. Furthermore, abnormal training samples corresponding to different anomaly types are automatically generated through target engineering, eliminating the need for manual collection of operational indicator data when system anomalies occur and manual labeling of these operational indicator data by anomaly type, as is done in supervised learning. This addresses the low efficiency of anomaly detection in related technologies.

[0024] Furthermore, each decision tree in the embodiments of the present invention is trained using operational data from a corresponding operational indicator. In other words, the decision tree corresponds to the operational indicator. When predicting system anomalies, the anomaly detection results from multiple decision trees are combined to determine the system anomaly type. This allows the combination of multiple operational indicators to predict the system anomaly type, improving the accuracy of system anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 is a schematic diagram of an application environment of an optional system anomaly detection method according to an embodiment of the present invention;

[0027] Figure 2 is a flow chart of an optional system anomaly detection method according to an embodiment of the present invention;

[0028] Figure 3 is a schematic diagram of an optional secure network client according to an embodiment of the present invention;

[0029] Figure 4 is an optional decision tree diagram according to an embodiment of the present invention;

[0030] Figure 5 FIG2 is a schematic diagram of a multi-objective decision tree anomaly detection processing structure according to an optional embodiment of the present invention;

[0031] Figure 6 This is a schematic diagram of an optional CPU usage indicator time series according to an embodiment of the present invention;

[0032] Figure 7 is a schematic diagram of an optional abnormal indicator time series according to an embodiment of the present invention;

[0033] Figure 8 is an optional overall block diagram according to an embodiment of the present invention;

[0034] Figure 9 This is a schematic diagram of an optional system anomaly detection model training process according to an embodiment of the present invention;

[0035] Figure 10 2 is a schematic diagram of an optional system anomaly detection model training structure according to an embodiment of the present invention;

[0036] Figure 11 is an optional system abnormality monitoring flow chart according to an embodiment of the present invention;

[0037] Figure 12 This is an optional monitoring alarm diagram according to an embodiment of the present invention;

[0038] Figure 13 is an optional overall flow chart according to an embodiment of the present invention;

[0039] Figure 14 is a schematic structural diagram of an optional system anomaly detection device according to an embodiment of the present invention;

[0040] Figure 15 is a schematic structural diagram of an optional electronic device according to an embodiment of the present invention;

[0041] Figure 16 This is a block diagram of a computer system structure of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0043] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] This application can be applied to various scenarios such as cloud technology, cloud security, artificial intelligence, and smart transportation.

[0045] Cloud computing is a computing model that distributes computing tasks across a resource pool consisting of a large number of computers, enabling various application systems to obtain computing power, storage space, and information services as needed. The network that provides resources is called a "cloud." To users, the resources in the "cloud" appear to be infinitely scalable and can be accessed at any time, used on demand, expanded at any time, and paid for on a per-use basis. As a provider of basic cloud computing capabilities, a cloud computing resource pool (referred to as a cloud platform, generally referred to as an IaaS (Infrastructure as a Service) platform) will be established. Various types of virtual resources will be deployed in the resource pool for external customers to choose from. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices.

[0046] Cloud security refers to the security software, hardware, users, organizations, and cloud platforms used in cloud computing business models. It integrates emerging technologies and concepts such as parallel processing, grid computing, and the identification of unknown virus behaviors. Through a network of numerous clients, cloud security monitors software anomalies on the network, obtains the latest information on Trojans and malicious programs on the internet, transmits it to servers for automatic analysis and processing, and then distributes virus and Trojan solutions to every client.

[0047] The main research directions of cloud security include: 1. Cloud computing security, which focuses on how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, compliance auditing, etc.; 2. Cloudification of security infrastructure, which focuses on how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building ultra-large-scale security event, information collection and processing platforms through cloud computing technology, realizing the collection and correlation analysis of massive amounts of information, and improving the ability to control security incidents and risks across the entire network; 3. Cloud security services, which focuses on various security services provided to users based on cloud computing platforms, such as antivirus services.

[0048] Intelligent Traffic System (ITS), also known as Intelligent Transportation System, is an effective and integrated application of advanced science and technology (information technology, computer technology, data communication technology, sensor technology, electronic control technology, automatic control theory, operations research, artificial intelligence, etc.) to transportation, service control and vehicle manufacturing, strengthening the connection between vehicles, roads and users, thereby forming an integrated transportation system that ensures safety, improves efficiency, improves the environment and saves energy. Or;

[0049] Intelligent Vehicle Infrastructure Cooperative Systems (IVICS), also known as VICS, are a development direction of Intelligent Transportation Systems (ITS). VICS utilizes advanced wireless communications and next-generation internet technologies to implement dynamic, real-time information exchange between vehicles and roads. Based on the collection and integration of dynamic traffic information across time and space, VICS conducts active vehicle safety control and collaborative road management. This fully realizes effective coordination between people, vehicles, and roads, ensuring traffic safety and improving traffic efficiency, resulting in a safe, efficient, and environmentally friendly road transportation system.

[0050] The following is an explanation of the keywords involved in this application:

[0051] Chaos Engineering is a set of methods that proactively identify vulnerabilities in production systems by running experiments on them. Chaos Engineering practices can be as simple as running a kill-9 command in production to simulate a sudden outage on a service node, or as complex as selecting a small (but representative) portion of online traffic and automatically running a series of experiments based on a set schedule or frequency.

[0052] Anomaly Detection: Anomaly detection is the process of identifying data that does not conform to expected behavior patterns. Anomaly detection is widely used in various applications, such as credit card fraud detection, insurance and healthcare, network security intrusion detection, and anomaly detection in safety-critical systems. In this context, it primarily refers to monitoring a system for abnormal conditions using collected system metrics.

[0053] Time Series: A time series is a series of numbers that arranges the values of the same statistical indicator in the order of their occurrence.

[0054] Metrics: These metrics represent each type of object that needs to be observed and monitored. These include system metrics, such as server status, network status, and traffic; service metrics, such as the time taken for each API call and the number of errors, which can be categorized as middleware monitoring or container monitoring; and business metrics, such as the number of orders per unit time, payment success rate, A / B testing, and report analysis. By observing each metric at a specific frequency, we obtain a time series of the metric.

[0055] According to one aspect of an embodiment of the present invention, a method for detecting anomalies in a system is provided. Optionally, as an optional implementation, the method for detecting anomalies in the system can be applied to, but is not limited to, Figure 1In the application environment shown, the application environment includes a terminal device 101 , a server 102 and a database 103 .

[0056] Optionally, in this embodiment, the terminal device may include but is not limited to at least one of the following: a mobile phone (such as an Android phone, an iOS phone, etc.), a laptop computer, a tablet computer, a PDA, an MID (Mobile Internet Devices), a PAD, a desktop computer, a smart TV, etc. A target client is installed on the terminal device, and the target client includes but is not limited to a secure network client, a video client, a game client, etc. The network may include but is not limited to a wired network, a wireless network, wherein the wired network includes a local area network, a metropolitan area network, and a wide area network, and the wireless network includes Bluetooth, WIFI, and other networks that implement wireless communication. The server may be a single server, or a server cluster consisting of multiple servers, or a cloud server. The database is used to store the operating data of the system. The above is only an example, and this embodiment does not impose any limitation on this.

[0057] Alternatively, as an optional implementation, Figure 2 As shown, the anomaly detection method of the above system includes:

[0058] Step S202, collecting operation data of multiple operation indicators of the target system at a preset frequency, wherein the operation indicators include hardware indicators and software indicators when the target system is running, and the operation data is data of each indicator when the target system is running;

[0059] The target system is a system that runs a target client, including software and hardware. The target client includes but is not limited to: a secure network client, a game client, etc. The target system can be a system in a terminal device or a system in a server. Figure 3 The figure shows a schematic diagram of a secure network client according to an optional embodiment of the present invention. The network security client can run on a terminal device, and the hardware and software operation status of the system can be viewed on the network security client. As shown in the figure, the CPU usage of the gateway node, memory usage, uplink and downlink bandwidth, etc. can be viewed in the client.

[0060] The aforementioned operational indicators include, but are not limited to, hardware and software indicators. These indicators can be further broken down into multiple indicators. For example, hardware indicators include CPU usage, memory usage, free disk space, and network uplink and downlink traffic. Software indicators include process indicators, business indicators, and component indicators. Business indicators can be further broken down into multiple indicators. For example, business indicators include user logins, user visits, and user access traffic. Process indicators include the survival indicator for each process. Component indicators include indicators related to components such as gateways, storage, and message queues.

[0061] The above-mentioned indicator time series is data collected at preset time points during system operation. The preset time can be selected based on actual conditions, for example, 8:00 to 8:10, 9:00 to 10:00, 6:00 to 12:00, etc. The indicator collection module can collect operational data for various operational indicators, including machine operation indicators, process, component and module indicators, and business-related indicators. Indicators can be collected and aggregated at a certain frequency (for example, once a minute). The currently collected indicator operation data is timestamped and stored in the time series database.

[0062] Step S204: extracting the operating data of each operating indicator according to a preset time window to obtain a plurality of indicator time series corresponding to the plurality of operating indicators, wherein each operating indicator corresponds to an indicator time series, and each indicator time series includes a set of operating data when the corresponding operating indicator is running;

[0063] The length of the above-mentioned preset time window can be determined according to actual conditions, for example, 10 hours, 15 hours, 24 hours, 48 hours, etc. The operating data of each indicator within a time window T (for example, 24 hours) is extracted from the time series database to form a time series of each indicator. Assuming that the above-mentioned operating indicator is CPU usage, the CPU usage of the system can be collected multiple times from 8:00 to 18:00 in the preset time window. For example, the collected data is 0.4, 0.3, 0.25, 0.2, and 0.22. Then the indicator time series of the operating indicator CPU usage is: 0.4, 0.3, 0.25, 0.2, and 0.22. Assuming that the above-mentioned operating indicator is the number of user visits, the number of times the user visits the target client can be collected multiple times within the preset time window from 9:00 to 22:00. The collected data is 4, 3, 6, 2, and 8. Then the indicator time series of the operating indicator user visit number is 4, 3, 6, 2, and 8.

[0064] Step S206: Inputting multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-objective decision tree anomaly detection processing, and obtaining multiple anomaly detection results output by the multiple target decision trees;

[0065] The system anomaly detection model includes multiple target decision trees. Each target decision tree is a decision tree obtained by training a target decision tree using abnormal training samples of the corresponding operating indicators. The abnormal training samples include recorded actual anomaly types and abnormal indicator time series. The abnormal indicator time series is the data of the corresponding operating indicator recorded when the target system, controlled by the target project according to the corresponding input parameters, experiences anomalies of the specified anomaly type. The target project may be a chaos project.

[0066] Take the three operating indicators of CPU usage, memory usage and user access as examples, each operating indicator corresponds to a decision tree. Figure 4 Figure 1 shows a decision tree diagram according to an optional embodiment of the present invention. Exception types 1, 2, 3, and 4 in the figure represent four different exception types, including but not limited to: high CPU load, high memory load, high I / O load, disk fill, docker / pod kill, network rejection, network timeout, network delay, and network packet loss. The structure of the decision tree shown in the figure and the types of exception types that each decision tree can predict are merely for illustration of this embodiment. The specific structure of the decision tree and the types of exception types that each decision tree can predict can be determined based on actual conditions.

[0067] The target parameters include, but are not limited to, one or more of the mean, standard deviation, and slope. The target parameter values include, but are not limited to, one or more of the mean, standard deviation, and slope of a set of data of the current operating indicator.

[0068] The determining of the parameter value of the target parameter corresponding to the current operating indicator includes at least one of the following: when the target parameter includes a mean parameter, determining the parameter value of the mean parameter corresponding to the current operating indicator to be equal to the mean of the set of data of the current operating indicator; when the target parameter includes a standard deviation parameter, determining the parameter value of the standard deviation parameter corresponding to the current operating indicator to be equal to the standard deviation of the set of data of the current operating indicator; when the target parameter includes a slope parameter, determining the parameter value of the slope parameter corresponding to the current operating indicator to be equal to the slope of the set of data of the current operating indicator.

[0069] The target parameter may include one or more of the mean, standard deviation, and slope. The decision condition of the decision tree may be any one of the mean, standard deviation, and slope, or a combination of any of these parameters.

[0070] For example, the decision conditions of the target decision tree include mean and standard deviation. The preset value interval corresponding to anomaly type 1 includes a combination of the mean and standard deviation value intervals. The preset value interval corresponding to anomaly type 1 is {mean value interval 1, standard deviation value interval 1}. The preset value interval corresponding to anomaly type 2 is {mean value interval 2, standard deviation value interval 2}.

[0071] For another example, the decision conditions of the target decision tree include mean, standard deviation, and slope. The preset value interval corresponding to anomaly type 1 includes a combination of the value intervals of the mean, standard deviation, and slope. The preset value interval corresponding to anomaly type 1 is {mean value interval 1, standard deviation value interval 1, slope value interval 1}. The preset value interval corresponding to anomaly type 2 is {mean value interval 2, standard deviation value interval 2, slope value interval 2}.

[0072] Among them, the abnormal type of the system can be determined by the value range of the mean, standard deviation and slope of the indicator operation series.

[0073] Step S208 , performing weighted statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system, wherein the target anomaly detection result includes a target anomaly type when an anomaly occurs in the target system.

[0074] Among them, for a certain type of anomaly, it is necessary to combine multiple indicators for prediction. For example, for network delay, it is necessary to combine the operating data of multiple operating indicators such as message queues, user access traffic, number of user logins, number of user accesses, etc. to determine whether the system has a network delay anomaly. In addition, for each operating indicator, there are multiple types of anomalies that may affect the occurrence. For example, for user access traffic, the types of anomalies that may affect the occurrence are network rejection, network timeout, network delay, and network packet loss. Therefore, for the indicator time series of each operating indicator, it is necessary to input the target decision trees corresponding to multiple indicators, and the anomaly types predicted by different target decision trees may be different. It is necessary to combine multiple anomaly detection results output by the target decision trees corresponding to multiple indicators to obtain the target anomaly type. Specifically, the anomaly type that appears the most times among the multiple anomaly types output by multiple target decisions can be used as the target anomaly type for the target system anomaly.

[0075] The following takes the three operating indicators of message queue, user access traffic, and user login number as examples. Figure 5 FIG2 is a schematic diagram of a multi-objective decision tree anomaly detection processing structure according to an optional embodiment of the present invention, including the following steps:

[0076] Step S11, when the target system is running, obtain the indicator time series of three operating indicators: message queue, user access flow, and user login number, including: message queue indicator time series, user access flow indicator time series, and user login number indicator time series.

[0077] In step S12, the indicator time series of the above three operating indicators are respectively input into the decision trees of the corresponding operating indicators. The message queue indicator time series is input into the message queue decision tree 1, the user access flow indicator time series is input into the user access flow decision tree 2, and the user login number indicator time series is input into the user login number decision tree 3. The structures of decision trees 1, 2, and 3 can be the same or different. The structures of decision trees 1, 2, and 3 in the figure are only for illustration of this embodiment. The anomaly types that decision tree 1 can predict include: anomaly type 1, anomaly type 2, anomaly type 3, and anomaly type 4. The anomaly types that decision tree 2 can predict include: anomaly type 3 and anomaly type 5. The anomaly types that decision tree 3 can predict include: anomaly type 2, anomaly type 3, and anomaly type 5. The anomaly types 1, 2, 3, 4, and 5 can be any anomaly type, including but not limited to network rejection, network timeout, network delay, network packet loss, and other anomaly types. This embodiment is only for the purpose of briefly illustrating the present application solution. The specific anomaly type can be determined according to actual circumstances.

[0078] In step S13, each decision tree outputs anomaly detection results, and the target anomaly type of the target system is determined based on the anomaly detection results. Assume that the anomaly detection result of decision tree 1 is anomaly type 1, the anomaly detection result of decision tree 2 is anomaly type 3, and the anomaly detection result of decision tree 3 is anomaly type 3. The anomaly type with the largest number of anomaly detection results can be used as the target anomaly type. In this embodiment, since anomaly type 3 has the largest number of occurrences, the target anomaly type of the target system is determined to be anomaly type 3.

[0079] Through the above-described embodiments, a pre-trained system anomaly detection model can be used to predict the type of system anomalies, thus avoiding the high workload and low efficiency of manual prediction. Furthermore, the training samples for the system anomaly detection model are labeled using target engineering, avoiding the problem of manually labeling samples in the prior art for supervised models. The target engineering achieves the goal of automatically labeling training samples, thereby improving sample labeling efficiency.

[0080] Optionally, multiple indicator time series corresponding to the multiple operating indicators are input into the system anomaly detection model to perform multi-objective decision tree anomaly detection processing, including: performing the following operations on each indicator time series in the multiple indicator time series, when performing the following operations, each indicator time series is the current indicator time series of the current operating indicator: inputting the current indicator time series into the current decision tree corresponding to the current operating indicator in the system anomaly detection model, and obtaining the current anomaly detection result determined by the current decision tree according to the current indicator time series.

[0081] As an optional implementation, the above-mentioned system anomaly detection model includes multiple target decision trees, each target decision tree corresponds to an indicator type, for example, CPU usage corresponds to target decision tree 1, and memory usage corresponds to target decision tree 1. For indicator time series corresponding to multiple operating indicators, when processing each indicator time series, the indicator time series currently being processed is called the current indicator time series. Assuming that the indicator time series corresponding to the CPU usage is currently being processed, the indicator time series is input into the system anomaly detection model and the target decision tree (current decision tree) corresponding to the CPU usage. The decision tree performs system anomaly detection on the indicator time series process of the CPU usage to obtain a detection result. The detection result includes whether the system has an anomaly and the type of anomaly when the system has an anomaly.

[0082] Optionally, the current indicator time series is input into the current decision tree corresponding to the current operating indicator in the system anomaly detection model to obtain the current anomaly detection result determined by the current decision tree based on the current indicator time series, including: determining the parameter value of the target parameter corresponding to the current operating indicator based on a set of data of the current operating indicator included in the current indicator time series; when the decision conditions in the current decision tree include multiple preset value intervals of the target parameter and each of the preset value intervals corresponds to one of multiple anomaly types, determining the current preset value interval in which the parameter value is located in the multiple preset value intervals; determining the anomaly type corresponding to the current preset value interval as the current anomaly detection result output by the current decision tree.

[0083] As an optional implementation, the above-mentioned operating indicator is CPU usage, and the target parameter is the mean value. The following example is used for explanation:

[0084] Step S21: When the system is running, the CPU usage rate is collected within a preset time period (such as 1 day) to obtain the CPU usage rate indicator time series, such as Figure 6 The following is a time series diagram of the CPU usage indicator.

[0085] Step S12: Calculate the mean of the indicator time series.

[0086] In step S13, the mean is analyzed using a decision tree corresponding to CPU usage. Assume that the decision tree's decision criteria only include the mean. In the decision tree's decision criteria, the mean's preset value range of 1-3 corresponds to anomaly type 1. Assume that the mean of the indicator time series is 2. By confirming that the mean falls within the preset value range of 1-3, this preset value range corresponds to anomaly type 1. Therefore, it can be confirmed that the system anomaly type is anomaly type 1.

[0087] For another example, the operating indicator is memory usage, and the target parameters are mean and standard deviation. The following example illustrates this:

[0088] Step S21 , when the system is running, the memory usage rate within a preset time period (such as 19:00-22:00) is obtained to obtain a time series of memory usage indicators.

[0089] In step S22, the indicator time series diagram may be divided into M random intervals, one of which is randomly selected, for example, the memory usage data from 20:00 to 21:00 is selected, and the mean and standard deviation of the memory usage in the random interval are calculated.

[0090] In step S23, the mean and standard deviation are analyzed using a decision tree corresponding to memory usage. Assume that the decision tree's decision criteria include the mean and standard deviation. Within the decision tree's decision criteria, a mean value range of 1-3 corresponds to anomaly type 1, while a mean value range of 3-5 corresponds to anomaly type 2. A standard deviation value range of 0-1.5 corresponds to anomaly type 1, while a standard deviation value range of 1.5-2.5 corresponds to anomaly type 2. Assume that the target system's indicator time series between 20:00 and 21:00 has a mean of 2 and a standard deviation of 1.1. By confirming that the mean, standard deviation, and slope fall within the preset value ranges, the anomaly type corresponding to the preset value range is determined to be the system's anomaly type. Comparison reveals that a mean of 2 falls within the preset mean value range of 1-3, corresponding to anomaly type 1, and a standard deviation of 1.1 falls within the preset standard deviation value range of 0-1.5, corresponding to anomaly type 1. Therefore, the system's anomaly type is confirmed to be anomaly type 1.

[0091] In the above embodiment, the indicator time series is converted into statistical features such as the mean, variance, and slope of the subsequences, and the system anomaly detection model is used for classification. This can avoid the problem of a huge feature space and improve the detection efficiency of the model.

[0092] Optionally, determining the current value interval in which the parameter value is located among the multiple preset value intervals includes: when the target parameter includes multiple parameters and each of the preset value intervals is a combination of a value interval of each parameter in the multiple parameters, determining the current preset value interval among the multiple preset value intervals, wherein the current preset value interval includes a combination of the current value interval of each parameter in the multiple parameters, the parameter value of the target parameter includes the current values of the multiple parameters, and the current values of the multiple parameters are respectively located in the current value intervals of the multiple parameters.

[0093] As an optional implementation, the target parameter may include multiple of the mean, standard deviation, and slope. The decision condition of the decision tree may be any combination of the mean, standard deviation, and slope. The preset value interval is a combination of the value intervals corresponding to multiple parameters, with each preset value interval corresponding to a specific anomaly type.

[0094] For example, if the decision tree's decision conditions include the mean and standard deviation, the preset value interval corresponding to anomaly type 1 includes a combination of the mean and standard deviation value intervals. The preset value interval corresponding to anomaly type 1 is {mean value interval 1, standard deviation value interval 1}. The preset value interval corresponding to anomaly type 2 is {mean value interval 2, standard deviation value interval 2}.

[0095] For example, the decision tree's decision criteria include mean, standard deviation, and slope. The preset value interval corresponding to anomaly type 1 includes a combination of the mean, standard deviation, and slope value intervals. The preset value interval corresponding to anomaly type 1 is {mean value interval 1, standard deviation value interval 1, slope value interval 1}. The preset value interval corresponding to anomaly type 2 is {mean value interval 2, standard deviation value interval 2, slope value interval 2}. The system's anomaly type can be determined by the value intervals within which the mean, standard deviation, and slope of the indicator's running sequence fall.

[0096] The following is an explanation using a specific embodiment. It is assumed that the operating indicator is the CPU usage rate and the decision conditions of the decision tree are the mean, standard deviation and slope.

[0097] Step S31: When the system is running, the CPU usage rate within a preset time period (such as 1 day) is obtained to obtain the CPU usage rate indicator time series, such as Figure 6 The following is a time series diagram of the CPU usage indicator.

[0098] In step S32, the indicator time series diagram can be divided into M random intervals, and one interval is randomly selected, for example, the random interval of 20:00-21:00 is selected. The mean, standard deviation and slope of the CPU usage in the random interval are calculated. The mean and standard deviation can be calculated according to the mean and standard deviation calculation method in the prior art. For the slope, Figure 6 As shown in the figure, the CPU usage values between 0:00-21:00 form a straight line, and the slope K of the indicator time series between 20:00-21:00 can be obtained.

[0099] Step S33, use the decision tree corresponding to the CPU usage to analyze the above mean, standard deviation, and slope. In the decision conditions of the decision tree, the preset value interval corresponding to abnormal type 1 is {mean: 1-3, standard deviation: 0-1.5, slope: 0-0.3}, where 1-3 is the value interval of the mean, 0-1.5 is the value interval of the standard deviation, and 0-0.3 is the value interval of the slope. The preset value interval corresponding to abnormal type 2 is {mean: 3-5, standard deviation: 1.5-2.5, slope: 0.3-0.7}, where 3-5 is the value interval of the mean, 1.5-2.5 is the value interval of the standard deviation, and 0.3-0.7 is the value interval of the slope.

[0100] Assume that the target system's CPU usage between 20:00 and 21:00 has a mean of 2, a standard deviation of 1.1, and a slope of 0.2. By confirming that these mean, standard deviation, and slope are within the current preset range {mean: 1-3, standard deviation: 0-1.5, slope: 0-0.3}, where 1-3 is the current range for mean, 0-1.5 is the current range for standard deviation, and 0-0.3 is the current range for slope, anomaly type 1 corresponding to the preset range is determined to be the target anomaly type for the system.

[0101] In the above embodiment, the indicator time series is converted into statistical features such as the mean, variance, and slope of the subsequences, and the system anomaly detection model is used for classification. This can avoid the problem of a huge feature space and improve the prediction efficiency of the model.

[0102] Optionally, the weighted number of statistical processing is performed on the multiple abnormality detection results to determine and output the target abnormality detection result of the target system, including: when the multiple target decision trees are N target decision trees, the multiple abnormality detection results include N abnormality detection results determined by the N target decision trees, and each abnormality type in the N abnormality detection results is an abnormality type among multiple abnormality types, determining the abnormality type that appears the most times among the N abnormality types as the target abnormality type, wherein N is a natural number greater than or equal to 2.

[0103] As an optional implementation, N decision trees can output N anomaly detection results, and the same anomaly detection result may exist among the N anomaly detection results. For example, if N=3, the anomaly detection result of decision tree 1 is anomaly type 1, the anomaly detection result of decision tree 2 is anomaly type 1, and the anomaly detection result of decision tree 3 is anomaly type 3. The system anomaly type is determined to be anomaly type 1.

[0104] The following is an illustration using a specific example. Taking the three operational indicators of message queue, user access traffic, and user login count as examples, while the target system is running, indicator time series for these three operational indicators are obtained, including: a message queue indicator time series, a user access traffic indicator time series, and a user login indicator time series. The indicator time series for these three operational indicators are input into the corresponding decision trees: the message queue indicator time series is input into decision tree 1 for the message queue, the user access traffic indicator time series is input into decision tree 2 for user access traffic, and the user login indicator time series is input into decision tree 3 for user login count. Assume that the anomaly detection result of decision tree 1 is anomaly type 1, the anomaly detection result of decision tree 2 is anomaly type 3, and the anomaly detection result of decision tree 3 is anomaly type 3. The anomaly type with the largest number of anomaly detection results can be selected as the target anomaly type. In this embodiment, since anomaly type 3 has the largest number of anomaly types, the target anomaly type for the target system is determined to be anomaly type 3. In this embodiment, based on the anomaly detection results of the decision trees corresponding to multiple indicators, the anomaly type with the largest number in the anomaly detection results is used as the anomaly type of the system. Since multiple indicators are combined, the accuracy of the system anomaly type prediction can be improved.

[0105] Optionally, the weighted number of statistical processing of the multiple abnormality detection results to determine and output the target abnormality detection result of the target system includes: when the multiple target decision trees are N target decision trees, the multiple abnormality detection results include N abnormality detection results determined by the N target decision trees, and M abnormality types among the multiple abnormality types appear in the N abnormality detection results, determining the weighted number of times the M abnormality types appear in the N abnormality types, wherein the weighted number of times the i-th abnormality type among the M abnormality types appears is equal to the value obtained by weighted summing the number of times the i-th abnormality type determined by each target decision tree, wherein N is a natural number greater than or equal to 2, M is less than or equal to N, and i is greater than or equal to 1 and less than or equal to M; and determining the abnormality type with the largest weighted number of times among the weighted numbers of times the M abnormality types appear as the target abnormality type.

[0106] As an optional implementation, since different indicators have different degrees of influence on anomaly types, weights can be assigned to the anomaly detection results of the decision trees corresponding to each operational indicator. The system's anomaly results are determined based on the weighted values of the anomaly detection results. Taking the four operational indicators of message queue, user access traffic, number of user logins, and number of user visits as examples, while the target system is running, the indicator time series for these four operational indicators are obtained, including: a message queue indicator time series, a user access traffic indicator time series, a user login number indicator time series, and a user visit number indicator time series. The indicator time series for these four operational indicators are input into the corresponding decision trees: the message queue indicator time series is input into decision tree 1 for the message queue, the user access traffic indicator time series is input into decision tree 2 for user access traffic, the user login number indicator time series is input into decision tree 3 for user logins, and the user visit number indicator time series is input into decision tree 4 for user visit numbers. Assume that the anomaly detection result of decision tree 1 is anomaly type 1, the anomaly detection result of decision tree 2 is anomaly type 1, the anomaly detection result of decision tree 3 is anomaly type 3, and the anomaly detection result of decision tree 4 is anomaly type 3. Based on the weights corresponding to each indicator, the weighted counts of the two anomaly types are calculated. Assume that the weight corresponding to the message queue is 0.3, the weight corresponding to user access traffic is 0.4, the weight corresponding to the number of user logins is 0.2, and the weight corresponding to the number of user accesses is 0.1. The calculated weighted counts for anomaly type 1 are 0.7, and the weighted counts for anomaly type 3 are 0.7. Anomaly type 1, which has the largest weighted count, is determined to be the system's anomaly type. In this embodiment, by assigning different weights to different indicators, the system's anomaly type can be predicted by combining the degree of influence of multiple operating indicators on the anomaly type, thereby improving the accuracy of the system anomaly type prediction.

[0107] Optionally, the system anomaly detection model is trained by the following steps: running a target project on the target system to control the target system to have an anomaly of a specified anomaly type, wherein the target system is controlled by the target project according to corresponding input parameters to have an anomaly of the specified anomaly type; when the target system has an anomaly of the specified anomaly type, obtaining abnormal operation data of the corresponding operation indicator to obtain an abnormal indicator time series corresponding to the operation indicator; using the abnormal indicator time series of the corresponding operation indicator to train a decision tree to obtain the target decision tree corresponding to the operation indicator.

[0108] Among them, the above-mentioned system anomaly detection can be a system anomaly detection model. The network model of the system anomaly detection model includes multiple decision trees, each decision tree corresponds to an operation indicator, and the decision tree is used to determine whether the operation indicator of the target system is abnormal and the type of abnormality that occurs based on the indicator time series of the corresponding operation indicator. Taking the three operation indicators of CPU usage, memory usage and number of user access as examples, each operation indicator corresponds to a decision tree. Figure 4 Figure 1 shows a decision tree diagram according to an optional embodiment of the present invention. Exception types 1, 2, 3, and 4 in the figure represent four different exception types, including but not limited to: high CPU load, high memory load, high I / O load, disk fill, docker / pod kill, network rejection, network timeout, network delay, and network packet loss. The structure of the decision tree shown in the figure and the types of exception types that each decision tree can predict are merely for illustration of this embodiment. The specific structure of the decision tree and the types of exception types that each decision tree can predict can be determined based on actual conditions.

[0109] Among them, the above-mentioned target project can be a chaos project, through which various types of anomalies can be designed, such as high CPU load, high memory load, high IO load, disk filling, killing docker / pod, network rejection, network timeout, network delay, network packet loss, etc. For each type of anomaly, input parameters to run the chaos project. When the chaos project is running, the operating indicators of the system and the operating data of each operating indicator within the preset time are collected to obtain the abnormal indicator time series. The preset time can be determined according to the actual situation, for example, it can be one hour, one day, 5 hours, etc. Taking high CPU load as an example, by specifying the target as the CPU of the node and the experimental action as burn, it is necessary to use the chaos engineering program to keep the CPU running. The following is the CPU anomaly manufacturing case program:

[0110] #CPU all cores load 80%

[0111] Chaos-executor attack--target cpu--action burn--flag "percent=80; duration=100"

[0112] #CPU specifies two core loads 100%

[0113] Chaos-executor attack--target cpu--action burn--flag "cores=2; duration=100"

[0114] #CPU specifies 1, 3 cores with 100% load

[0115] Chaos-executor attack--target cpu--action burn--flag "core-list=1,3; duration=100"

[0116] In the above CPU abnormal manufacturing cases, three types of CPU indicator abnormalities were created: 80% load on all CPU cores, 100% load on two designated CPU cores, and 100% load on 1 and 3 designated CPU cores.

[0117] like Figure 7 The figure shows a schematic diagram of an abnormal indicator time series according to an optional embodiment of the present invention, including CPU usage, memory usage, and disk space usage. The horizontal axis in the figure is time, and the vertical axis is the data of the operating indicators at different time points when the corresponding abnormal type is detected. The operating indicator data collected at each time point is the abnormal time series. The corresponding decision tree is trained by the abnormal indicator time series of each operating indicator to obtain a target decision tree corresponding to the operating indicator. The decision tree corresponding to the operating indicator can perform anomaly detection on the operating indicator time series to obtain anomaly detection results. Assuming that the operating indicator is CPU usage, an abnormal indicator time series with abnormal CPU usage is generated through chaos engineering. The decision tree is trained using the abnormal indicator time series with abnormal CPU usage to obtain a target decision tree corresponding to CPU usage. For the CPU usage time indicator series, the target decision tree corresponding to CPU usage can be used to predict the CPU usage, and the anomaly detection results output by the target decision tree corresponding to CPU usage can be obtained. Based on the anomaly detection results, it can be determined whether the system's CPU usage is abnormal and the type of anomaly that has occurred.

[0118] Optionally, the following steps are used to obtain an abnormality indicator time series when a specified abnormality type occurs in the target system: obtain a set of input parameters corresponding to the specified abnormality type, wherein each input parameter in the set of input parameters is used to control the target system to have an abnormality of the specified abnormality type; run the target project according to each input parameter in the set of input parameters to control the target system to have an abnormality of the specified abnormality type; record P groups of abnormality indicator time series formed by data of P operating indicators in the target system when an abnormality of the specified abnormality type occurs in the target system, wherein P is a natural number greater than or equal to 1, and the P operating indicators are operating indicators of data abnormality when an abnormality of the specified abnormality type occurs in the target system, and each group of abnormal indicator time series in the P groups of abnormal indicator time series is an abnormal indicator time series of a corresponding operating indicator among the P operating indicators.

[0119] As an optional implementation, the following conditions can be defined for creating system anomalies using Chaos Engineering: Target, which refers to the component where the system anomaly occurs, such as a container or application framework; Scope, which refers to the specific machine or cluster that triggers the system anomaly; Rule Matcher, which defines the relevant matching rules based on the configured Target, and multiple rules can be configured; Action, which refers to the specific scenario simulated by the experiment. Different Targets will result in different implementation scenarios. For example, disk anomalies may include: disk full, high disk I / O read / write speed, disk hardware failure, etc. For applications, you can abstract out anomaly scenarios such as latency, anomalies, returning a specified value (error code, large object, etc.), parameter tampering, and repeated calls.

[0120] For example, if the CPU overload exception type is specified above, by specifying the node's CPU as the target and the experimental action as burn, the hybrid engineering program will need to keep the CPU running continuously. A set of input parameters can be the CPU overload level, such as 80%, 60%, or 90%. This is illustrated using the following CPU overload exception as an example:

[0121] #CPU all cores load 80%

[0122] Chaos-executor attack--target cpu--action burn--flag "percent=80; duration=100"

[0123] For example, a set of input parameters might be "percent = 80; duration = 100." Entering these parameters into Chaos Engineering, running Chaos Engineering can create an anomaly where all CPU cores are loaded at 80%. After this anomaly occurs, data for P related operating indicators is collected over a preset period of time to generate a time series of the anomaly indicators. These P indicators can be determined based on actual conditions. For example, data for indicators such as CPU utilization, memory utilization, and free disk space can be collected to generate a time series of the corresponding anomaly indicators.

[0124] Optionally, acquiring a set of input parameters corresponding to the specified exception type includes: selecting the specified exception type from a plurality of exception types preset in the target project, and acquiring the set of input parameters corresponding to the specified exception type.

[0125] As an optional implementation, Chaos Engineering can simulate various system anomaly scenarios, labeling multiple anomaly types. Each label corresponds to a specific fault type, and you can select a label to create a corresponding fault type. For example, if the specified anomaly type is CPU full load, multiple labels can be included for CPU full load, such as 80% load on all CPU cores, 100% load on two designated CPU cores, or 100% load on cores 1 and 3. If you select the label "80% load on all CPU cores," and obtain the input parameters percent = 80; duration = 100, Chaos Engineering will automatically run Chaos-executorattack --target cpu --action burn --flag "percent = 80; duration = 100," creating a system anomaly with all CPU cores loaded at 80%.

[0126] In this embodiment, chaos engineering is used to create system anomalies. Combined with a supervised multi-classification machine learning algorithm, online data can be monitored to determine whether the system is experiencing an anomaly and the specific type of situation causing the anomaly. This avoids the inefficiency of supervised classification machines requiring manual labeling in existing technologies and improves the efficiency of labeling system anomaly types.

[0127] Optionally, obtaining a set of input parameters corresponding to the specified exception type includes: obtaining the set of input parameters corresponding to one of the exception types: CPU high load exception type, memory high load exception type, input and output high load exception type, disk fill exception type, docker / pod kill exception type, network rejection exception type, network timeout exception type, network delay exception type, and network packet loss exception type.

[0128] Optionally, the method further includes: when the multiple target decision trees are N target decision trees and the multiple operating indicators are N operating indicators, after obtaining the abnormal indicator time series when each of the multiple abnormal types occurs in the target system, the acquired abnormal indicator time series and the corresponding abnormal type are formed into N abnormal training sample sets of the N operating indicators, wherein N is a natural number greater than or equal to 1, and each abnormal training sample set includes the abnormal training sample of the corresponding operating indicator in the N operating indicators; using the N abnormal training sample sets of the N operating indicators, respectively train the N decision trees to be trained to obtain the N target decision trees, wherein the abnormal training sample set of each operating indicator is used to train the decision tree to be trained corresponding to each operating indicator in the N decision trees to be trained.

[0129] As an optional implementation, Figure 8 The figure shows an overall block diagram of an optional embodiment of the present invention, which includes the main process of the method, the chaos engineering data collection process, and the model training process. The following steps are included:

[0130] Step S81: Deploy system-related servers, indicator collection servers, and target projects (e.g., chaos engineering). Deploy system-related services and related indicator collection services in a production or test environment, and then install the software required for chaos engineering, such as the open source chaosbalde tool.

[0131] Step S82: collecting the operating data of each indicator when the indicator is operating normally, and collecting the operating data of each indicator when the system is operating normally to form a normal indicator time series.

[0132] Step S83: Start the target engineering manufacturing system abnormality, including but not limited to: CPU / memory abnormality, network abnormality, process abnormality and other abnormalities. Collect the data of various indicators during the abnormality to form an abnormality indicator time series.

[0133] Step S84: training the system anomaly detection model, using the system normal operation index data and anomaly index data as training data. Figure 9The figure shows a schematic diagram of the system anomaly detection model training process according to an optional embodiment of the present invention, which includes: using the target project to make the target system have an anomaly of a specified anomaly type according to the input parameters, obtaining the operating data of each operating indicator of the target system when the anomaly of the specified anomaly type occurs, intercepting part of the operating data of each operating indicator according to the preset time window to obtain the abnormal indicator time series, selecting m random intervals, and dividing the indicator time series into m subsequences. The mean, standard deviation and slope of each subsequence are generated, and then a decision tree is created and trained based on the 3m features obtained. The abnormal operating data of each operating indicator is trained to obtain the target decision tree corresponding to the indicator. The multiple decision trees that have been trained constitute the system anomaly detection model. Figure 10 The figure shows a schematic diagram of the system anomaly detection model training structure according to an optional embodiment of the present invention, wherein T1, T2, T N is the abnormal indicator time series of various indicators when the system fails (corresponding to N is N operating indicators, T N is the time series of abnormal indicators during each fault type, T1, T2, and TN are N abnormal training sample sets), C1, C2, and CN are the classification models for the corresponding indicators (corresponding to N target decision trees). Decision tree C1 is obtained by training using T1, decision tree C2 is obtained by training using T2, and decision tree CN is obtained by training using TN (corresponding to using the N abnormal training sample sets of the N operating indicators, training the N decision trees to be trained separately to obtain N target decision trees). When detecting system faults, the indicator time series during system operation is input into the decision tree of the corresponding indicator to obtain the prediction results P1, P2…PN output by each decision tree. The target fault type is determined by voting through P1, P2…PN. The target fault type is the fault type of the system.

[0134] Step S85: deploy the trained system anomaly detection model to monitor system anomalies. Figure 11 The figure shows a flow chart of system anomaly monitoring according to an optional embodiment of the present invention. After the system anomaly detection model is obtained through training, the model can be deployed in a production environment.

[0135] The indicator collection module can collect data for various system indicators, including but not limited to machine indicators, module-level indicators, and business indicators. For machine indicator collection, it can collect indicator data for various software during system operation. For module-level indicator collection, it can collect hardware indicator data for each module, including but not limited to indicator data for the gateway communication module, policy control module, login authentication module, business connection module, data module, and other modules shown in the figure. Business indicator collection can be performed within the business log storage. The collected indicator data is collected at a certain frequency (e.g., 1 minute) and aggregated. The currently collected data can be timestamped to form the current timestamp indicator data. This data is then stored in a dedicated timestamp database. Historical data within a time window T (e.g., 24 hours) is retrieved from the time series database and combined with the current data to form a time series for each indicator. The time series is then sent to the trained multivariate system anomaly detection model for classification. The model determines whether the system is normal or abnormal, or is experiencing a specific type of anomaly. When the model detects an anomaly, it will send an alert to the relevant operation and maintenance personnel via email, text message, or instant messaging and inform them of the type of anomaly, thereby enabling real-time monitoring of the system.

[0136] Optionally, the use of the N abnormal training sample sets of the N operating indicators to train the N decision trees to be trained respectively to obtain the N target decision trees includes: training the sth decision tree to be trained to obtain the sth target decision tree by executing the following steps, wherein 1≤s≤N, the sth decision tree to be trained corresponds to the sth operating indicator, the abnormal training sample set of the sth operating indicator includes Q abnormal indicator time series and corresponding Q actual abnormality types, Q is a natural number greater than or equal to 1: according to a set of data of the sth operating indicator included in each abnormal indicator time series in the Q abnormal indicator time series, determining the parameter value of the target parameter corresponding to the sth operating indicator, wherein the target parameter includes the mean parameter at least one of a parameter, a standard deviation parameter, and a slope parameter, the decision condition of the sth decision tree to be trained includes a plurality of value intervals to be adjusted of the target parameter; according to the parameter value of the target parameter corresponding to the sth operating indicator and the Q actual abnormality types, the plurality of value intervals to be adjusted in the decision condition of the sth decision tree to be trained are adjusted to obtain the sth target decision tree, wherein, when the decision condition of the sth target decision tree includes the plurality of preset value intervals of the target parameter obtained by adjustment, according to the relationship between the parameter value of the target parameter corresponding to the sth operating indicator and the decision condition of the sth target decision tree, the errors between the Q predicted abnormality types and the Q actual abnormality types determined meet a preset convergence condition.

[0137] As an optional implementation, each indicator collected is a time series, and a multivariate time series classification model can be trained. The training data is split into univariate time series of a single indicator, and its classification model is trained separately. For the classification model of univariate time series, the Time Series Forest (TSF) algorithm is used for training. The Time Series Forest model converts the indicator time series into statistical features such as the mean, variance, and slope of the subsequence, and uses the system anomaly detection model for classification. TSF overcomes the problem of the huge interval feature space by using the system anomaly detection model method (with the statistical information of each interval as the feature).

[0138] The sth decision tree to be trained can be a decision tree corresponding to any operating indicator. Assuming the indicator is a message queue, the sth decision tree to be trained corresponding to the message queue is trained. One indicator can correspond to multiple fault types (e.g., Q, depending on the actual situation of Q). Taking Q = 3 as an example, the message queue can predict three fault types: network rejection, network timeout, and network delay. When creating a network rejection fault type through chaos engineering, a time series of abnormal indicators of the message queue is obtained for this fault type; when creating a network timeout fault type through chaos engineering, a time series of abnormal indicators of the message queue is obtained for this fault type; when creating a network delay fault type through chaos engineering, a time series of abnormal indicators of the message queue is obtained for this fault type. By creating the above three fault types through chaos engineering, three time series of abnormal indicators can be obtained.

[0139] Each abnormal indicator time series can be divided into m random intervals to obtain m subsequences. A set of data for the sth operating indicator can be a set of data consisting of m subsequences, and the value of m can be determined according to the actual situation, for example, 3, 5, 8, etc. The mean, standard deviation, and slope of each subsequence are generated. The sth decision tree to be trained is trained based on the mean, standard deviation, and slope of each subsequence, as well as the corresponding actual fault type. The multiple value intervals to be adjusted in the decision conditions of the sth decision tree to be trained are adjusted. Based on the relationship between the mean, standard deviation, and slope values and the decision conditions, the target decision tree is trained to obtain the error between the predicted fault type and the actual fault type for the mean, standard deviation, and slope of the subsequence of the target decision tree, which meets the preset convergence condition. The preset condition can be determined according to the actual situation. For example, the number of times the predicted fault type is the actual fault type is greater than the preset value. The preset value can be determined according to the actual situation, for example, 5, 10, 13, etc.

[0140] This application creates various anomalies in the system through chaos work, and collects the indicator time series of the abnormal period as anomaly samples, so as to train a supervised model to obtain the system's anomaly detection model, and realize anomaly alarms that are accurate to specific categories. In addition, the traditional supervised method requires a large number of operation and maintenance personnel to manually label the training data. The operation and maintenance automation is realized through machine learning algorithms, which solves the problems of inflexibility and large amount of manual configuration of traditional threshold methods, and effectively reduces the workload of operation and maintenance personnel. Through multi-indicator anomaly detection, multiple indicators can be comprehensively evaluated for system indicator anomalies, and risks that are difficult to detect with a single indicator can be discovered, thereby improving the accuracy of alarms. The system is monitored in real time to ensure the normal and stable operation of the system.

[0141] Optionally, after determining that the abnormality detection result that occurs most frequently among the multiple abnormality detection results is the target abnormality detection result of the target system, the method further includes: sending an alarm message to the target application, wherein the alarm message is used to indicate that an abnormality of the target abnormality type occurs in the target system.

[0142] As an optional implementation, the target application includes but is not limited to an instant messaging client. Figure 12 The figure shows a monitoring alarm diagram according to an optional embodiment of the present invention, which includes the collection of system indicators, including but not limited to the hardware indicators and software indicators shown in the figure. The figure is only for illustration of this embodiment. The specific indicator collection can be determined according to the actual situation. For example, it can also include cluster indicators, network indicators, security indicators, etc. The data of the collected indicators can be displayed on the user interface, including but not limited to web pages, client interfaces, etc. The server can create anomalies through chaos engineering, and through the various anomalies created, collect the abnormal indicator time series of various indicators to train to obtain a system anomaly detection model. The system anomaly detection model is used to predict the anomaly type of the system, and the prediction result is sent to the user terminal. Specifically, the alarm information can be sent to the user terminal through instant messaging, text messages, emails, etc. By sending the system fault type to the instant messaging client, the operation and maintenance personnel can be reminded that the system has a fault. The operation and maintenance personnel can repair the system in a timely and accurate manner according to the system fault type.

[0143] As an optional implementation, Figure 13 The figure shows an overall flow chart of an optional embodiment, which includes the following steps:

[0144] Step S1301: deploying a target system and a target project. The target project includes but is not limited to chaos engineering. Deploying a target system includes but is not limited to collecting indicator data of services and operating indicators in the target system.

[0145] Step S1302: Start the target project, so that the target system is manufactured with instruction-type exceptions, including but not limited to CPU exceptions, memory exceptions, network exceptions, process exceptions, etc.

[0146] Step S1303: Acquire the operating data of each operating indicator when the target system is abnormal. Acquire the operating data of each indicator in a preset time period through a preset time window to obtain the abnormal indicator time series corresponding to each operating indicator, such as abnormal indicator time series 1 to abnormal indicator time series N shown in the figure.

[0147] Step S1304: Use the abnormal indicator time series corresponding to each operating indicator to train a system anomaly detection model. The system anomaly detection model includes multiple decision trees to be trained. The abnormal time series corresponding to each operating indicator is used to train the decision tree to be trained to obtain a target decision tree corresponding to the operating indicator. For example, decision tree 1, decision tree 2, and decision tree N in the system anomaly detection model shown in the figure are target decision trees that have been trained.

[0148] Step S1305: Collect the operating data of each indicator when the target system is running according to the preset collection frequency. The preset collection frequency can be determined according to the actual situation, for example, 1 minute, 10 seconds, etc. The indicator collection module can be used to collect the operating data of each operating indicator, including machine operating indicators, indicators of each process, component and module, and business-related indicators. The indicators can be collected at a certain frequency (for example, 1 minute) and aggregated. The currently collected indicator operation data will be timestamped and stored in the time series database;

[0149] Step S1306: Extracting the operating data of each operating indicator according to a preset time window to obtain multiple indicator time series corresponding to the multiple operating indicators, wherein each operating indicator corresponds to an indicator time series, and each indicator time series includes a set of operating data when the corresponding operating indicator is running. The length of the time window can be determined according to actual conditions, for example, 10 hours, 15 hours, 24 hours, 48 hours, etc.

[0150] Step S1307: Input multiple indicator time series corresponding to multiple operating indicators into the system anomaly detection model to perform multi-objective decision tree anomaly detection processing, and obtain multiple anomaly detection results output by the multiple target decision trees;

[0151] Step S1308 , performing weighted statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system, wherein the target anomaly detection result includes a target anomaly type when an anomaly occurs in the target system.

[0152] It should be noted that for the aforementioned method embodiments, for simplicity of description, they are all expressed as a series of action combinations. However, those skilled in the art should be aware that the present invention is not limited by the order of the actions described, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0153] According to another aspect of the embodiments of the present invention, there is also provided a system abnormality detection device for implementing the above-mentioned system abnormality detection method. Figure 14 As shown, the device includes: a collection module 1402, which is used to collect operating data of multiple operating indicators of the target system at a preset frequency, wherein the operating indicators include hardware indicators and software indicators when the target system is running, and the operating data is data of each indicator when the target system is running; an extraction module 1404, which is used to collect operating data of multiple operating indicators of the target system at a preset frequency, wherein the operating indicators include hardware indicators and software indicators when the target system is running, and the operating data is data of each indicator when the target system is running; a processing module 1406, which is used to input multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-target decision tree anomaly detection processing to obtain multiple anomaly detection results output by multiple target decision trees; a determination module 1408, which is used to perform weighted number statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system, wherein the target anomaly detection result includes a target anomaly type when an anomaly occurs in the target system.

[0154] Optionally, the above-mentioned device is also used to perform the following operations on each indicator time series of the multiple indicator time series. When performing the following operations, each indicator time series is the current indicator time series of the current operating indicator: the current indicator time series is input into the current decision tree corresponding to the current operating indicator in the system anomaly detection model, and the current anomaly detection result determined by the current decision tree according to the current indicator time series is obtained.

[0155] Optionally, the above-mentioned device is also used to determine the parameter value of the target parameter corresponding to the current operating indicator based on a set of data of the current operating indicator included in the current indicator time series; when the decision conditions in the current decision tree include multiple preset value intervals of the target parameter and each of the preset value intervals corresponds to one of multiple abnormality types, determine the current preset value interval in which the parameter value is located in the multiple preset value intervals; determine the abnormality type corresponding to the current preset value interval, which is the current abnormality detection result output by the current decision tree.

[0156] Optionally, the above-mentioned device is also used to determine the current preset value interval in the multiple preset value intervals when the target parameter includes multiple parameters and each of the preset value intervals is a combination of a value interval of each parameter in the multiple parameters, wherein the current preset value interval includes a combination of the current value interval of each parameter in the multiple parameters, the parameter value of the target parameter includes the current values of the multiple parameters, and the current values of the multiple parameters are respectively located in the current value intervals of the multiple parameters.

[0157] Optionally, the above-mentioned device is also used to, when the multiple target decision trees are N target decision trees, the multiple anomaly detection results include N anomaly detection results determined by the N target decision trees, and each anomaly type in the N anomaly detection results is an anomaly type among multiple anomaly types, determine the anomaly type that appears the most times among the N anomaly types as the target anomaly type, wherein N is a natural number greater than or equal to 2.

[0158] Optionally, the above-mentioned device is also used to determine the weighted number of times the M abnormality types appear in the N abnormality types when the multiple target decision trees are N target decision trees, the multiple abnormality detection results include N abnormality detection results determined by the N target decision trees, and M abnormality types among the multiple abnormality types appear in the N abnormality detection results, wherein the weighted number of times the i-th abnormality type in the M abnormality types appears is equal to the value obtained by weighted summing the number of times the i-th abnormality type determined by each target decision tree, wherein N is a natural number greater than or equal to 2, M is less than or equal to N, and i is greater than or equal to 1 and less than or equal to M; and determine the abnormality type with the largest weighted number of times among the weighted numbers of times the M abnormality types appear as the target abnormality type.

[0159] Optionally, the above-mentioned device is also used to train the system anomaly detection model through the following steps: running a target project on the target system to control the target system to have an anomaly of a specified anomaly type, wherein the target system is controlled by the target project according to corresponding input parameters to have an anomaly of the specified anomaly type; when the target system has an anomaly of the specified anomaly type, obtaining the corresponding abnormal operation data of the operation indicator to obtain the abnormal indicator time series corresponding to the operation indicator; using the corresponding abnormal indicator time series of the operation indicator to train the decision tree to obtain the target decision tree corresponding to the operation indicator.

[0160] Optionally, the above-mentioned device is also used to obtain a time series of abnormal indicators when a specified abnormal type occurs in the target system through the following steps: obtaining a set of input parameters corresponding to the specified abnormal type, wherein each input parameter in the set of input parameters is used to control the target system to have an abnormality of the specified abnormal type; running the target project according to each input parameter in the set of input parameters respectively to control the target system to have an abnormality of the specified abnormal type; recording P groups of abnormal indicator time series formed by data of P operating indicators in the target system when an abnormality of the specified abnormal type occurs in the target system, wherein P is a natural number greater than or equal to 1, and the P operating indicators are operating indicators of data abnormality when an abnormality of the specified abnormal type occurs in the target system, and each group of abnormal indicator time series in the P groups of abnormal indicator time series is an abnormal indicator time series of a corresponding operating indicator among the P operating indicators.

[0161] Optionally, the apparatus is further configured to select the designated exception type from a plurality of exception types preset in the target project, and obtain the set of input parameters corresponding to the designated exception type.

[0162] Optionally, the above-mentioned device is also used to obtain the set of input parameters corresponding to one of the exception types: CPU high load exception type, memory high load exception type, input and output high load exception type, disk filling exception type, docker / pod killing exception type, network rejection exception type, network timeout exception type, network delay exception type, and network packet loss exception type.

[0163] Optionally, the above-mentioned device is also used to, when the multiple target decision trees are N target decision trees and the multiple operating indicators are N operating indicators, after obtaining the abnormal indicator time series when each of the multiple abnormal types occurs in the target system, form N abnormal training sample sets of the N operating indicators with the acquired abnormal indicator time series and the corresponding abnormal type, wherein N is a natural number greater than or equal to 1, and each abnormal training sample set includes the abnormal training sample of the corresponding operating indicator in the N operating indicators; use the N abnormal training sample sets of the N operating indicators to train the N decision trees to be trained respectively to obtain the N target decision trees, wherein the abnormal training sample set of each operating indicator is used to train the decision tree to be trained corresponding to each operating indicator in the N decision trees to be trained.

[0164] Optionally, the above-mentioned device is also used to train the sth decision tree to be trained to obtain the sth target decision tree by executing the following steps, wherein 1≤s≤N, the sth decision tree to be trained corresponds to the sth operating indicator, and the abnormal training sample set of the sth operating indicator includes Q abnormal indicator time series and corresponding Q actual abnormal types, and Q is a natural number greater than or equal to 1: according to a set of data of the sth operating indicator included in each abnormal indicator time series in the Q abnormal indicator time series, determine the parameter value of the target parameter corresponding to the sth operating indicator, wherein the target parameter includes at least one of a mean parameter, a standard deviation parameter and a slope parameter, and the sth The decision conditions of the decision tree to be trained include multiple value intervals to be adjusted of the target parameter; according to the parameter value of the target parameter corresponding to the s-th operating indicator and the Q actual abnormality types, the multiple value intervals to be adjusted in the decision conditions of the s-th decision tree to be trained are adjusted to obtain the s-th target decision tree, wherein, when the decision conditions of the s-th target decision tree include the multiple preset value intervals of the target parameter obtained by adjustment, according to the relationship between the parameter value of the target parameter corresponding to the s-th operating indicator and the decision conditions of the s-th target decision tree, the errors between the Q predicted abnormality types and the Q actual abnormality types determined meet the preset convergence conditions.

[0165] Optionally, the above-mentioned device is further used to send alarm information to the target application, wherein the alarm information is used to indicate that an anomaly of the target anomaly type occurs in the target system.

[0166] According to another aspect of the embodiment of the present invention, an electronic device for implementing the abnormality detection method of the above system is also provided. The electronic device may be Figure 1The terminal device or server shown in FIG. This embodiment is described by taking the electronic device as a server as an example. Figure 15 As shown, the electronic device includes a memory 1502 and a processor 1504. The memory 1502 stores a computer program, and the processor 1504 is configured to execute the steps in any of the above method embodiments through the computer program.

[0167] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0168] Optionally, in this embodiment, the processor may be configured to execute the following steps through a computer program:

[0169] S1, collecting operation data of multiple operation indicators of the target system at a preset frequency, wherein the operation indicators include hardware indicators and software indicators when the target system is running, and the operation data is data of each indicator when the target system is running;

[0170] S2, extracting the operating data of each operating indicator according to a preset time window to obtain a plurality of indicator time series corresponding to the plurality of operating indicators, wherein each operating indicator corresponds to an indicator time series, and each indicator time series includes a set of operating data when the corresponding operating indicator is running;

[0171] S3, inputting multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-objective decision tree anomaly detection processing, and obtaining multiple anomaly detection results output by multiple target decision trees;

[0172] S4, performing weighted statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system, wherein the target anomaly detection result includes a target anomaly type when an anomaly occurs in the target system.

[0173] Alternatively, those skilled in the art will appreciate that Figure 15 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (MID), a PAD, or other terminal devices. Figure 15 It does not limit the structure of the electronic device. For example, the electronic device may also include Figure 15 More or fewer components (such as network interfaces, etc.) as shown in, or with Figure 15 Different configurations shown.

[0174] Among them, the memory 1502 can be used to store software programs and modules, such as the program instructions / modules corresponding to the anomaly detection method and device of the anomaly type determination system in the embodiment of the present invention. The processor 1504 executes various functional applications and data processing by running the software programs and modules stored in the memory 1502, that is, to implement the above-mentioned anomaly detection method of the anomaly type determination system. The memory 1502 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1502 may further include a memory remotely located relative to the processor 1504, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 1502 can be used specifically but not limited to store information such as sample characteristics of items and target virtual resource accounts. As an example, if Figure 15 As shown, the memory 1502 may include, but is not limited to, the acquisition module 1402, extraction module 1404, processing module 1406, and determination module 1408 in the abnormality detection device of the abnormality type determination system. Furthermore, other modules and units in the abnormality detection device of the abnormality type determination system may also be included, but are not limited to, other modules and units, which are not further described in this example.

[0175] Optionally, the transmission device 1506 is used to receive or send data via a network. Specific examples of the network may include a wired network and a wireless network. In one embodiment, the transmission device 1506 includes a network interface controller (NIC), which can be connected to other network devices and a router via a network cable to communicate with the Internet or a local area network. In one embodiment, the transmission device 1506 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0176] In addition, the electronic device further includes: a display 1508 for displaying the indicator time series and target anomaly detection results; and a connection bus 1510 for connecting the various module components in the electronic device.

[0177] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting multiple nodes through network communication. The nodes may form a peer-to-peer (P2P) network, and any computing device, such as a server, terminal, or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0178] According to one aspect of the present application, a computer program product is provided, comprising a computer program / instructions containing program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via the communication portion 1609 and / or installed from a removable medium 1611. When the computer program is executed by the central processing unit 1601, the various functions provided in the embodiments of the present application are performed.

[0179] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0180] Figure 16 The block diagram schematically shows a computer system structure of an electronic device used to implement an embodiment of the present application.

[0181] It should be noted that Figure 16 The computer system 1600 of the electronic device shown is only an example and should not limit the functions and scope of use of the embodiments of the present application.

[0182] like Figure 16 As shown, the computer system 1600 includes a central processing unit 1601 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 1602 (ROM) or the program loaded from the storage part 1608 into the random access memory 1603 (RAM). Various programs and data required for system operation are also stored in the random access memory 1603. The central processing unit 1601, the read-only memory 1602 and the random access memory 1603 are connected to each other via a bus 1604. An input / output interface 1605 (i.e., an I / O interface) is also connected to the bus 1604.

[0183] The following components are connected to the input / output interface 1605: an input section 1606 including a keyboard, a mouse, and the like; an output section 1607 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and a speaker; a storage section 1608 including a hard disk; and a communication section 1609 including a network interface card such as a local area network card or a modem. The communication section 1609 performs communication processing via a network such as the Internet. A drive 1610 is also connected to the input / output interface 1605 as needed. Removable media 1611, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 1610 as needed, so that computer programs read therefrom can be installed into the storage section 1608 as needed.

[0184] In particular, according to an embodiment of the present application, the processes described in the various method flow charts can be implemented as computer software programs. For example, an embodiment of the present application includes a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for executing the methods shown in the flow charts. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1609 and / or installed from a removable medium 1611. When the computer program is executed by the central processing unit 1601, the various functions defined in the system of the present application are performed.

[0185] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the methods provided in the various optional implementations described above.

[0186] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0187] S1, collecting operation data of multiple operation indicators of the target system at a preset frequency, wherein the operation indicators include hardware indicators and software indicators when the target system is running, and the operation data is data of each indicator when the target system is running;

[0188] S2, extracting the operating data of each operating indicator according to a preset time window to obtain a plurality of indicator time series corresponding to the plurality of operating indicators, wherein each operating indicator corresponds to an indicator time series, and each indicator time series includes a set of operating data when the corresponding operating indicator is running;

[0189] S3, inputting multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-objective decision tree anomaly detection processing, and obtaining multiple anomaly detection results output by multiple target decision trees;

[0190] S4, performing weighted statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system, wherein the target anomaly detection result includes a target anomaly type when an anomaly occurs in the target system.

[0191] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing the hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0192] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above-mentioned computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes a number of instructions for causing one or more computer devices (such as personal computers, servers, or network devices) to execute all or part of the steps of the methods described in various embodiments of the present invention.

[0193] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0194] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, and can be electrical or other forms.

[0195] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0196] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0197] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in a system, characterized in that: include: Collecting operation data of multiple operation indicators of the target system at a preset frequency, wherein the operation indicators include hardware indicators and software indicators when the target system is running, and the operation data is data of each indicator when the target system is running; Extracting the operating data of each operating indicator according to a preset time window to obtain a plurality of indicator time series corresponding to the plurality of operating indicators, wherein each operating indicator corresponds to an indicator time series, and each indicator time series includes a set of operating data when the corresponding operating indicator is running; When the number of target decision trees is N and the number of operating indicators is N, after obtaining a time series of abnormal indicators when an abnormality of each of the multiple abnormality types occurs in the target system, the obtained abnormal indicator time series and the corresponding abnormality type are used to form N abnormal training sample sets of the N operating indicators, where N is a natural number greater than or equal to 1, and each abnormal training sample set includes an abnormal training sample of a corresponding operating indicator among the N operating indicators; Using the N abnormal training sample sets of the N operating indicators, respectively train the N decision trees to be trained to obtain the N target decision trees, wherein the abnormal training sample set of each operating indicator is used to train the decision tree to be trained corresponding to each operating indicator in the N decision trees to be trained; Inputting multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-objective decision tree anomaly detection processing, and obtaining multiple anomaly detection results output by the multiple target decision trees; A weighted number of statistical processing is performed on the multiple abnormality detection results to determine and output a target abnormality detection result of the target system, wherein the target abnormality detection result includes a target abnormality type when an abnormality occurs in the target system.

2. The method according to claim 1, characterized in that Inputting multiple indicator time series corresponding to the multiple operating indicators into a system anomaly detection model to perform multi-objective decision tree anomaly detection processing, including: Perform the following operations on each indicator time series in the multiple indicator time series, where each indicator time series is a current indicator time series of a currently running indicator: The current indicator time series is input into a current decision tree corresponding to the current operation indicator in the system anomaly detection model to obtain a current anomaly detection result determined by the current decision tree according to the current indicator time series.

3. The method according to claim 2, characterized in that Inputting the current indicator time series into the current decision tree corresponding to the current operating indicator in the system anomaly detection model to obtain a current anomaly detection result determined by the current decision tree according to the current indicator time series includes: Determining a parameter value of the target parameter corresponding to the current operating indicator according to a set of data of the current operating indicator included in the current indicator time series; When the decision conditions in the current decision tree include multiple preset value intervals of the target parameter, and each of the preset value intervals corresponds to one of multiple abnormality types, determining the current preset value interval in which the parameter value is located in the multiple preset value intervals; Determine the anomaly type corresponding to the current preset value interval, which is the current anomaly detection result output by the current decision tree.

4. The method according to claim 3, characterized in that Determining the current value interval of the parameter value in the plurality of preset value intervals includes: When the target parameter includes multiple parameters and each of the preset value intervals is a combination of a value interval of each parameter in the multiple parameters, the current preset value interval is determined in the multiple preset value intervals, wherein the current preset value interval includes a combination of the current value interval of each parameter in the multiple parameters, the parameter value of the target parameter includes the current values of the multiple parameters, and the current values of the multiple parameters are respectively located in the current value intervals of the multiple parameters.

5. The method according to claim 1, wherein The performing weighted statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system includes: When the multiple target decision trees are N target decision trees, the multiple anomaly detection results include N anomaly detection results determined by the N target decision trees, and each anomaly type in the N anomaly detection results is an anomaly type among multiple anomaly types, an anomaly type that appears the most times among the N anomaly types is determined as the target anomaly type, where N is a natural number greater than or equal to 2.

6. The method according to claim 1, characterized in that The performing weighted statistical processing on the multiple anomaly detection results to determine and output a target anomaly detection result of the target system includes: When the multiple target decision trees are N target decision trees, the multiple anomaly detection results include N anomaly detection results determined by the N target decision trees, and M anomaly types among the multiple anomaly types appear in the N anomaly detection results, determining the weighted number of times the M anomaly types appear in the N anomaly types, wherein the weighted number of times the i-th anomaly type among the M anomaly types appears is equal to a value obtained by weighted summing the number of times the i-th anomaly type determined by each target decision tree, wherein N is a natural number greater than or equal to 2, M is less than or equal to N, and i is greater than or equal to 1 and less than or equal to M; The abnormality type with the largest weighted number of occurrences of the M abnormality types is determined as the target abnormality type.

7. The method according to any one of claims 1 to 6, characterized in that The system anomaly detection model is trained by the following steps: Running a target project on the target system to control the target system to have an exception of a specified exception type; When an exception of the specified exception type occurs in the target system, abnormal operation data of the corresponding operation indicator is obtained to obtain an abnormal indicator time series corresponding to the operation indicator; The abnormal indicator time series of the corresponding operating indicator is used to train the to-be-trained decision tree to obtain the target decision tree corresponding to the operating indicator.

8. The method according to any one of claims 1 to 6, characterized in that Obtain the time series of anomaly indicators of a specified anomaly type in the target system by performing the following steps: Acquire a set of input parameters corresponding to the specified exception type, wherein each input parameter in the set of input parameters is used to control the target system to have an exception of the specified exception type; Running the target project according to each input parameter in the set of input parameters respectively, so as to control the target system to have an exception of the specified exception type; Recording P groups of abnormal indicator time series formed by data of P operating indicators in the target system when an abnormality of the specified abnormality type occurs in the target system, wherein: P is a natural number greater than or equal to 1.

9. The method according to claim 8, wherein obtaining a set of input parameters corresponding to the specified exception type comprises: The specified exception type is selected from a plurality of exception types preset in the target project, and the set of input parameters corresponding to the specified exception type is obtained.

10. The method according to claim 1, characterized in that The N abnormal training sample sets of the N operating indicators are used to train the N decision trees to be trained respectively to obtain the N target decision trees, including: The sth decision tree to be trained is trained to obtain the sth target decision tree by performing the following steps, wherein 1≤s≤N, the abnormal training sample set of the sth operating indicator includes Q abnormal indicator time series, and Q is a natural number greater than or equal to 1: Determining, based on a set of data of the s-th operating indicator included in each of the Q abnormal indicator time series, a parameter value of a target parameter corresponding to the s-th operating indicator, wherein the decision condition of the s-th decision tree to be trained includes a plurality of value intervals to be adjusted for the target parameter; According to the parameter value of the target parameter corresponding to the sth operating indicator and the Q actual abnormality types, the multiple value intervals to be adjusted in the decision conditions of the sth decision tree to be trained are adjusted to obtain the sth target decision tree.

11. The method according to claim 1, wherein After determining that the anomaly detection result having the largest number of occurrences among the multiple anomaly detection results is the target anomaly detection result of the target system, the method further includes: Sending an alarm message to a target application, wherein the alarm message is used to indicate that an anomaly of the target anomaly type occurs in the target system.

12. A system abnormality detection device, characterized in that: include: a collection module, configured to collect operation data of a plurality of operation indicators of a target system at a preset frequency, wherein the operation indicators include hardware indicators and software indicators when the target system is running, and the operation data is data of each indicator when the target system is running; an extraction module, configured to collect operation data of a plurality of operation indicators of a target system at a preset frequency, wherein the operation indicators include hardware indicators and software indicators when the target system is running, and the operation data is data of each indicator when the target system is running; The device is further configured to, when the number of target decision trees is N and the number of operating indicators is N, after obtaining a time series of abnormal indicators when an abnormality of each of the multiple abnormality types occurs in the target system, form N abnormal training sample sets of the N operating indicators with the obtained abnormal indicator time series and the corresponding abnormal type, wherein N is a natural number greater than or equal to 1, and each abnormal training sample set includes an abnormal training sample of an operating indicator corresponding to the N operating indicators; use the N abnormal training sample sets of the N operating indicators to train N decision trees to be trained, respectively, to obtain the N target decision trees, wherein the abnormal training sample set of each operating indicator is used to train the decision tree to be trained corresponding to each operating indicator in the N decision trees to be trained; a processing module, configured to input a plurality of indicator time series corresponding to the plurality of operating indicators into a system anomaly detection model to perform multi-objective decision tree anomaly detection processing, and obtain a plurality of anomaly detection results output by the plurality of objective decision trees; The determination module is used to perform weighted statistical processing on the multiple abnormality detection results to determine and output a target abnormality detection result of the target system, wherein the target abnormality detection result includes a target abnormality type when an abnormality occurs in the target system.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein the method according to any one of claims 1 to 11 is executed when the program is executed.

14. A computer program product comprising a computer program / instructions, characterized in that The computer program / instructions, when executed by a processor, implement the method steps of claims 1 to 11.

15. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 11 through the computer program.

Images