Host information processing method and apparatus, electronic device, and computer readable medium

Abstract

Embodiments of the present disclosure disclose a host information processing method and device, electronic equipment and a computer readable medium. A specific embodiment of the method comprises: performing principal component analysis processing on each host information in a host information set to generate host principal component analysis information, obtaining a host principal component analysis information set; performing outlier clustering processing on the host principal component analysis information set to generate an outlier host principal component analysis information group; generating an abnormal host information group based on the outlier host principal component analysis information group, wherein the outlier host principal component analysis information in the outlier host principal component analysis information group corresponds to the abnormal host information in the abnormal host information group; and generating a host abnormal score value group based on a target historical host information group set and the abnormal host information group. The embodiment is related to artificial intelligence, improves the accuracy of host detection, and can detect abnormal hosts in a timely manner.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and more particularly to a host information processing method, apparatus, electronic device, and computer-readable medium. Background Art

[0002] Currently, a common method for detecting the operating status of a host is to detect and analyze the operating indicators of the host itself to detect the operating status of the host.

[0003] However, the above method usually has the following technical problems: the host is not detected from the perspective of the host group, the perspective of host operation status detection is relatively single, the host detection results are biased, and abnormal hosts cannot be detected in time. Summary of the Invention

[0004] The content of this disclosure is used to briefly introduce concepts that will be described in detail in the detailed description section below. The content of this disclosure is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] Some embodiments of the present disclosure provide a host information processing method, apparatus, electronic device, and computer-readable medium to solve the technical problems mentioned in the above background technology section.

[0006] In a first aspect, some embodiments of the present disclosure provide a host information processing method, which includes: performing principal component analysis processing on each host information in a host information set to generate host principal component analysis information and obtain a host principal component analysis information set; performing outlier clustering processing on the above-mentioned host principal component analysis information set to generate an outlier host principal component analysis information group; generating an abnormal host information group based on the above-mentioned outlier host principal component analysis information group, wherein the outlier host principal component analysis information in the above-mentioned outlier host principal component analysis information group corresponds to the abnormal host information in the above-mentioned abnormal host information group; generating a host anomaly score value group based on a target historical host information group set and the above-mentioned abnormal host information group, wherein the target historical host information group in the above-mentioned target historical host information group set corresponds to the abnormal host information in the above-mentioned abnormal host information group, and the abnormal host information in the above-mentioned abnormal host information group corresponds to the host anomaly score value in the above-mentioned host anomaly score value group.

[0007] Optionally, before generating the host anomaly score value group based on the target historical host information group set and the abnormal host information group, the method further includes: determining the host corresponding to each abnormal host information in the abnormal host information group as an abnormal host to obtain an abnormal host group; obtaining the target historical host information group of each abnormal host in the abnormal host group within a preset historical time period to obtain a target historical host information group set.

[0008] Optionally, the abnormal host information in the above-mentioned abnormal host information group includes an abnormal score value and at least one abnormal indicator; and the above-mentioned generation of a host abnormal score value group based on the target historical host information group set and the above-mentioned abnormal host information group includes: inputting the above-mentioned target historical host information group set into a pre-trained host information prediction model to obtain a target host prediction information set, wherein the target host prediction information in the above-mentioned target host prediction information set includes: a host prediction score value and at least one host indicator, and the target host prediction information in the above-mentioned target host prediction information set corresponds to the target historical host information group in the above-mentioned target historical host information group set; generating a host abnormal score value group based on the above-mentioned abnormal host information group and the above-mentioned target host prediction information set.

[0009] Optionally, the above-mentioned generation of a host anomaly score value group based on the above-mentioned abnormal host information group and the above-mentioned target host prediction information set includes: for each abnormal host information in the above-mentioned abnormal host information group, performing the following processing steps: determining the target host prediction information corresponding to the above-mentioned abnormal host information in the above-mentioned target host prediction information set as the target host prediction information to be processed; generating a host anomaly score value based on the above-mentioned abnormal host information and the above-mentioned target host prediction information to be processed; and determining each determined host anomaly score value as a host anomaly score value group.

[0010] Optionally, the above method also includes: determining the host abnormality score value greater than or equal to the preset score value in the above host abnormality score value group as the target host abnormality score value, to obtain the target host abnormality score value group; for each target host abnormality score value in the above target host abnormality score value group, performing the following processing steps: combining the abnormal index and host index corresponding to the above target host abnormality score value into a host abnormality index group; determining the host identifier corresponding to the above target host abnormality score value as the abnormal host identifier; generating abnormal host information based on the above host abnormality indicator group and the above abnormal host identifier; and sending the generated each abnormal host information to the associated maintenance terminal.

[0011] Optionally, before performing principal component analysis on each host information in the host information set to generate host principal component analysis information and obtain the host principal component analysis information set, the method further includes: acquiring host information of each host in the host group to obtain the host information set.

[0012] Optionally, the above-mentioned principal component analysis processing is performed on each host information in the host information set to generate host principal component analysis information and obtain the host principal component analysis information set, including: performing kernel principal component analysis processing on each host information in the above-mentioned host information set to generate host principal component analysis information and obtain the host principal component analysis information set.

[0013] Optionally, the above-mentioned generating a host anomaly score value based on the above-mentioned abnormal host information and the above-mentioned target host prediction information to be processed includes: in response to the individual anomaly indicators included in the above-mentioned abnormal host information being the same as the individual host indicators included in the above-mentioned target host prediction information to be processed, performing the following processing steps: determining one-half of the anomaly score value included in the above-mentioned abnormal host information as the target anomaly score value; determining one-half of the host prediction score value included in the above-mentioned target host prediction information to be processed as the target host prediction score value; determining the sum of the above-mentioned target anomaly score value and the above-mentioned target host prediction score value as the host anomaly score value; in response to the individual anomaly indicators included in the above-mentioned abnormal host information being different from the individual host indicators included in the above-mentioned target host prediction information to be processed, generating a host anomaly score value according to the above-mentioned anomaly score value, the above-mentioned host prediction score value, the above-mentioned individual anomaly indicators and the above-mentioned individual host indicators.

[0014] Optionally, the outlier host principal component analysis information in the outlier host principal component analysis information group includes principal component variables and abnormality score values, the principal component variables include host indicator feature vectors, the host indicator feature vectors include at least one host indicator feature coefficient, and the host indicator feature coefficient in the at least one host indicator feature coefficient corresponds to a host indicator; and the above-mentioned generation of the abnormal host information group based on the outlier host principal component analysis information group includes: for each outlier host principal component analysis information in the outlier host principal component analysis information group, performing the following processing steps: confirming the principal component variables included in the outlier host principal component analysis information The method comprises the following steps: determining the host indicator characteristic coefficient included in the host indicator characteristic vector of the outlier principal component variable in descending order to obtain a host indicator characteristic coefficient sequence; selecting a preset number of host indicator characteristic coefficients from the host indicator characteristic coefficient sequence as abnormal host indicator characteristic coefficients to obtain an abnormal host indicator characteristic coefficient group; determining the host indicator corresponding to each abnormal host indicator characteristic coefficient in the abnormal host indicator characteristic coefficient group as an abnormal indicator to obtain an abnormal indicator group; and combining the abnormal indicator group with the abnormal score value included in the outlier host principal component analysis information to generate abnormal host information.

[0015] In a second aspect, some embodiments of the present disclosure provide a host information processing device, which includes: an analysis unit, configured to perform principal component analysis processing on each host information in the host information set to generate host principal component analysis information and obtain a host principal component analysis information set; a clustering unit, configured to perform outlier clustering processing on the above-mentioned host principal component analysis information set to generate an outlier host principal component analysis information group; a first generation unit, configured to generate an abnormal host information group based on the above-mentioned outlier host principal component analysis information group, wherein the outlier host principal component analysis information in the above-mentioned outlier host principal component analysis information group corresponds to the abnormal host information in the above-mentioned abnormal host information group; a second generation unit, configured to generate a host anomaly score value group based on the target historical host information group set and the above-mentioned abnormal host information group, wherein the target historical host information group in the above-mentioned target historical host information group set corresponds to the abnormal host information in the above-mentioned abnormal host information group, and the abnormal host information in the above-mentioned abnormal host information group corresponds to the host anomaly score value in the above-mentioned host anomaly score value group.

[0016] Optionally, before the second generation unit, the device also includes: a first determination unit, configured to determine the host corresponding to each abnormal host information in the above-mentioned abnormal host information group as an abnormal host, and obtain an abnormal host group; a first acquisition unit, configured to obtain the target historical host information group of each abnormal host in the above-mentioned abnormal host group within a preset historical time period, and obtain a target historical host information group set.

[0017] Optionally, the abnormal host information in the abnormal host information group includes an abnormality score value and at least one abnormality indicator.

[0018] Optionally, the second generation unit is further configured to: input the above-mentioned target historical host information group set into a pre-trained host information prediction model to obtain a target host prediction information set, wherein the target host prediction information in the above-mentioned target host prediction information set includes: a host prediction score value and at least one host indicator, and the target host prediction information in the above-mentioned target host prediction information set corresponds to the target historical host information group in the above-mentioned target historical host information group set; based on the above-mentioned abnormal host information group and the above-mentioned target host prediction information set, generate a host abnormality score value group.

[0019] Optionally, the second generation unit is further configured to: for each abnormal host information in the above-mentioned abnormal host information group, perform the following processing steps: determine the target host prediction information corresponding to the above-mentioned abnormal host information in the above-mentioned target host prediction information set as the target host prediction information to be processed; generate a host abnormality score value based on the above-mentioned abnormal host information and the above-mentioned target host prediction information to be processed; determine the determined individual host abnormality score values ​​as a host abnormality score value group.

[0020] Optionally, the device also includes: a first determination unit, configured to determine the host abnormality score value greater than or equal to the preset score value in the above-mentioned host abnormality score value group as the target host abnormality score value, and obtain the target host abnormality score value group; a scoring processing unit, configured to perform the following processing steps for each target host abnormality score value in the above-mentioned target host abnormality score value group: combining the abnormality index and host index corresponding to the above-mentioned target host abnormality score value into a host abnormality index group; determining the host identifier corresponding to the above-mentioned target host abnormality score value as the abnormal host identifier; generating abnormal host information based on the above-mentioned host abnormality indicator group and the above-mentioned abnormal host identifier; and a sending unit, configured to send the generated each abnormal host information to the associated maintenance terminal.

[0021] Optionally, before the analyzing unit, the device further includes: a second acquiring unit configured to acquire host information of each host in the host group to obtain a host information set.

[0022] Optionally, the analyzing unit is further configured to: perform kernel principal component analysis on each piece of host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set.

[0023] Optionally, the second generating unit is further configured to: in response to the individual abnormal indicators included in the above-mentioned abnormal host information being the same as the individual host indicators included in the above-mentioned target host prediction information to be processed, perform the following processing steps: determine one-half of the abnormal score value included in the above-mentioned abnormal host information as the target abnormal score value; determine one-half of the host prediction score value included in the above-mentioned target host prediction information to be processed as the target host prediction score value; determine the sum of the above-mentioned target abnormal score value and the above-mentioned target host prediction score value as the host abnormal score value; in response to the individual abnormal indicators included in the above-mentioned abnormal host information being different from the individual host indicators included in the above-mentioned target host prediction information to be processed, generate a host abnormal score value according to the above-mentioned abnormal score value, the above-mentioned host prediction score value, the above-mentioned individual abnormal indicators and the above-mentioned individual host indicators.

[0024] Optionally, the outlier host principal component analysis information in the outlier host principal component analysis information group includes principal component variables and abnormality score values, the principal component variables include host indicator feature vectors, the host indicator feature vectors include at least one host indicator feature coefficient, and the host indicator feature coefficient in the at least one host indicator feature coefficient corresponds to a host indicator.

[0025] Optionally, the first generation unit is further configured to: for each outlier host principal component analysis information in the above-mentioned outlier host principal component analysis information group, perform the following processing steps: determine the principal component variable included in the above-mentioned outlier host principal component analysis information as the outlier principal component variable; sort at least one host indicator characteristic coefficient included in the host indicator feature vector included in the above-mentioned outlier principal component variable in descending order to obtain a host indicator characteristic coefficient sequence; select a preset number of host indicator characteristic coefficients from the above-mentioned host indicator characteristic coefficient sequence as abnormal host indicator characteristic coefficients to obtain an abnormal host indicator characteristic coefficient group; determine the host indicator corresponding to each abnormal host indicator characteristic coefficient in the above-mentioned abnormal host indicator characteristic coefficient group as an abnormal indicator to obtain an abnormal indicator group; combine the above-mentioned abnormal indicator group with the abnormal score value included in the above-mentioned outlier host principal component analysis information to generate abnormal host information.

[0026] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0027] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0028] The above-described embodiments of the present disclosure have the following beneficial effects: Through the host information processing methods of some embodiments of the present disclosure, hosts can be detected from the horizontal perspective of the host population and the vertical perspective of the host's target historical host information group, thereby improving the accuracy of host detection and promptly detecting abnormal hosts. Specifically, the reason for the inability to promptly detect abnormal hosts is that the hosts are not detected from the perspective of the host population, the host operating status is detected from a relatively single perspective, and the host detection results are biased, making it impossible to promptly detect abnormal hosts. Based on this, the host information processing methods of some embodiments of the present disclosure first perform principal component analysis on each host information in a host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set. This allows the host information of multiple hosts to be analyzed from a horizontal perspective, providing data support for the subsequent detection of abnormal entities. Next, outlier clustering is performed on the host principal component analysis information set to generate an outlier host principal component analysis information set. This allows the principal component analysis information of outlier hosts (the principal component information of abnormal hosts) to be analyzed. Then, based on the outlier host principal component analysis information set, an abnormal host information set is generated. Thus, the abnormal host information of the abnormal host can be parsed from a horizontal perspective. Finally, based on the target historical host information group set and the above-mentioned abnormal host information group, a host abnormality score value group is generated. Among them, the target historical host information group in the above-mentioned target historical host information group set corresponds to the abnormal host information in the above-mentioned abnormal host information group, and the abnormal host information in the above-mentioned abnormal host information group corresponds to the host abnormality score value in the above-mentioned host abnormality score value group. Thus, the host can be detected from two perspectives: the horizontal perspective (host group) and the vertical perspective (target historical host information). The accuracy of host detection is improved, and abnormal hosts can be detected in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0030] Figure 1 is a schematic diagram of an application scenario of the host information processing method of some embodiments of the present disclosure;

[0031] Figure 2 is a flow chart of some embodiments of the host information processing method according to the present disclosure;

[0032] Figure 3 is a flow chart of other embodiments of the host information processing method according to the present disclosure;

[0033] Figure 4 are flow charts of further embodiments of the host information processing method according to the present disclosure;

[0034] Figure 5 is a schematic structural diagram of some embodiments of a host information processing device according to the present disclosure;

[0035] Figure 6 It is a structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0036] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0037] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0038] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0039] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0040] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0041] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0042] Figure 1 It is a schematic diagram of an application scenario of the host information processing method according to some embodiments of the present disclosure.

[0043] exist Figure 1In an application scenario, computing device 101 may first perform principal component analysis on each piece of host information 1021 in host information set 102 to generate host principal component analysis information, thereby obtaining host principal component analysis information set 103. For example, host information 1021 may include: number of processes, CPU (Central Processing Unit) metrics, memory metrics, load metrics, disk space metrics, disk I / O (Input Output) metrics, and number of connections metrics. Next, computing device 101 may perform outlier clustering on the host principal component analysis information set 103 to generate an outlier host principal component analysis information group 104. Then, computing device 101 may generate an abnormal host information group 105 based on the outlier host principal component analysis information group 104. The outlier host principal component analysis information in the outlier host principal component analysis information group 104 corresponds to the abnormal host information in the abnormal host information group 105. Finally, computing device 101 may generate a host anomaly score value group 107 based on the target historical host information group set 106 and the abnormal host information group 105. The target historical host information group in the target historical host information group set 106 corresponds to the abnormal host information in the abnormal host information group 105 , and the abnormal host information in the abnormal host information group 105 corresponds to the host abnormality score value in the host abnormality score value group 107 .

[0044] It should be noted that the computing device 101 can be either hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device. When the computing device is software, it can be installed in the hardware devices listed above. It can be implemented as multiple software or software modules for providing distributed services, or as a single software or software module. No specific limitations are given here.

[0045] It should be understood that Figure 1 The number of computing devices in the embodiment is merely illustrative. Any number of computing devices may be provided according to implementation requirements.

[0046] Continue to refer Figure 2 , shows a process 200 of some embodiments of the host information processing method according to the present disclosure. The host information processing method includes the following steps:

[0047] Step 201 : performing principal component analysis on each host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set.

[0048] In some embodiments, the execution subject of the host information processing method (eg Figure 1The computing device 101 shown can perform principal component analysis on each piece of host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set. Here, the host information in the host information set may refer to the current operating information of a host. The host information may include, but is not limited to, the number of processes, CPU metrics, memory metrics, load metrics, disk space metrics, disk I / O metrics, and number of connections. Principal component analysis may refer to a PCA (Principal Components Analysis) analysis. The host principal component analysis information may include a first principal component variable and a second principal component variable. The first and second principal component variables may be derived through dimensionality reduction analysis of multiple metrics (number of processes, CPU metrics, memory metrics, load metrics, disk space metrics, disk I / O metrics, and number of connections) included in the host information using PCA (Principal Components Analysis). Both the first and second principal component variables contain metrics included in the host information. Here, the CPU metric may indicate CPU processing speed. The memory metric may indicate memory capacity. The load metric may indicate host circuit load. The disk space metric may indicate remaining disk storage space. The Disk IO metric indicates the input and output rate of the disk, while the Connection metric indicates the number of devices accessing the host.

[0049] In some optional implementations of some embodiments, the execution entity may perform kernel principal component analysis (KPCA) on each piece of host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set. Here, KPCA may refer to Kernel Principal Component Analysis (KPCA). This can address the issue of PCA dimensionality reduction not clearly distinguishing hosts.

[0050] Optionally, before step 201 , the method further includes: acquiring host information of each host in the host group to obtain a host information set.

[0051] In some embodiments, the execution subject can obtain the host information of each host in the host group from the terminal device through a wired connection or a wireless connection to obtain a host information set. Here, the host can refer to a computer host or a control host.

[0052] Step 202: Perform outlier clustering processing on the host principal component analysis information set to generate an outlier host principal component analysis information group.

[0053] In some embodiments, the execution entity may perform outlier clustering on the host principal component analysis information set to generate an outlier host principal component analysis information group. Here, the outlier clustering process may refer to a DBSCAN (Density-Based Spatial Clustering of Applications with Noise) clustering algorithm.

[0054] In practice, first, the execution entity may perform outlier clustering processing on the host principal component analysis information set to generate a host principal component analysis information group set. Here, the host principal component analysis information in the host principal component analysis information group set includes a cluster label. The cluster label may represent an outlier cluster or a cluster cluster. Then, each host principal component analysis information whose cluster label included in the host principal component analysis information group set is represented as an outlier cluster may be determined as an outlier host principal component analysis information group. Here, the cluster label represented as an outlier cluster may indicate that the host is an outlier on the first principal component variable or an outlier on the second principal component variable.

[0055] In some optional implementations of some embodiments, the execution entity may perform outlier clustering on the host principal component analysis information set using a target clustering algorithm to generate an outlier host principal component analysis information group. Here, the target clustering algorithm may refer to a DBSCAN (Density-Based Spatial Clustering of Applications with Noise) clustering algorithm that incorporates an L-BFGS (Limited memory-BFGS, quasi-Newton method) algorithm and a CH (Calinski-Harabasz Score) score. Here, the larger the CH score value, the better the clustering effect.

[0056] Step 203: Generate an abnormal host information group based on the outlier host principal component analysis information group.

[0057] In some embodiments, the execution entity may generate an abnormal host information group based on the outlier host principal component analysis information group. The outlier host principal component analysis information in the outlier host principal component analysis information group corresponds to the abnormal host information in the abnormal host information group. The outlier host principal component analysis information may include principal component variables and an anomaly score value. The principal component variables may represent a first principal component variable or a second principal component variable. The principal component variables may include a host indicator feature vector. The host indicator feature vector may include at least one host indicator feature coefficient. One of the at least one host indicator feature coefficients corresponds to a host indicator. The host indicator may represent any metric included in the host information (number of processes, CPU metric, memory metric, load metric, disk space metric, disk I / O metric, or number of connections metric). The anomaly score value may represent the probability of a single host generated during the outlier clustering process being clustered as an outlier cluster (the host's cluster label represents an outlier cluster). That is, the anomaly score value may be a significant digit representing the probability of a single host being clustered as an outlier cluster (the host's cluster label represents an outlier cluster).

[0058] In practice, for each piece of outlier host principal component analysis information in the outlier host principal component analysis information group, the execution subject may perform the following processing steps:

[0059] The first step is to select a target number of host index characteristic coefficients from the host index characteristic vectors included in the outlier host principal component analysis information. Here, the target number of host index characteristic coefficients is selected from the host index characteristic coefficients included in the host index characteristic vectors in descending order. There is no restriction on the setting of the target number.

[0060] In the second step, the host indicator corresponding to each host indicator characteristic coefficient in the target number of host indicator characteristic coefficients is determined as an abnormal indicator to obtain an abnormal indicator group.

[0061] In the third step, the abnormal indicator group and the abnormal score value included in the outlier host principal component analysis information are combined to generate abnormal host information.

[0062] In some optional implementations of some embodiments, the execution subject may perform the following processing steps for each outlier host principal component analysis information in the outlier host principal component analysis information group:

[0063] In the first step, the principal component variables included in the principal component analysis information of the outlier host are determined as outlier principal component variables.

[0064] In the second step, at least one host indicator characteristic coefficient included in the host indicator characteristic vector included in the outlier principal component variable is sorted in descending order to obtain a host indicator characteristic coefficient sequence. In practice, the host indicator characteristic coefficients in the host indicator characteristic vector included in the outlier principal component variable can be sorted in descending order to obtain the host indicator characteristic coefficient sequence.

[0065] In the third step, a preset number of host indicator characteristic coefficients are selected from the aforementioned host indicator characteristic coefficient sequence as abnormal host indicator characteristic coefficients to obtain an abnormal host indicator characteristic coefficient group. In practice, a preset number of host indicator characteristic coefficients can be selected from the aforementioned host indicator characteristic coefficient sequence as abnormal host indicator characteristic coefficients to obtain an abnormal host indicator characteristic coefficient group. The setting of the preset number is not limited. For example, the preset number can be 2.

[0066] In the fourth step, the host indicator corresponding to each abnormal host indicator characteristic coefficient in the abnormal host indicator characteristic coefficient group is determined as an abnormal indicator to obtain an abnormal indicator group.

[0067] In the fifth step, the abnormal indicator group is combined with the abnormal score value included in the outlier host principal component analysis information to generate abnormal host information.

[0068] Step 204: Generate a host anomaly score value group based on the target historical host information group set and the abnormal host information group.

[0069] In some embodiments, the execution entity may generate a host anomaly score value group based on the target historical host information group set and the abnormal host information group. The target historical host information group in the target historical host information group set corresponds to the abnormal host information in the abnormal host information group, and the abnormal host information in the abnormal host information group corresponds to the host anomaly score value in the host anomaly score value group. The target historical host information group in the target historical host information group set may refer to the operating information of the host corresponding to the abnormal host information within a preset historical time period. The target historical host information may include, but is not limited to, the number of processes, CPU metrics, memory metrics, load metrics, disk space metrics, disk IO metrics, and connection number metrics.

[0070] In practice, first, for each target historical host information group in the target historical host information group set, the following processing steps are performed:

[0071] The first step is to perform the following processing steps for each target historical host information in the target historical host information group:

[0072] 1. The target historical host information, including the host indicators that meet the abnormal conditions in each host indicator, is determined as an abnormal host indicator to obtain an abnormal host indicator group. The abnormal condition is that the host indicator is not within a preset range. Here, each host indicator can represent: number of processes, CPU indicator, memory indicator, load indicator, disk space indicator, disk IO indicator, and number of connections indicator. For example, the abnormal condition can be "the number of processes is not within the corresponding preset range of the number of processes, or the CPU indicator is not within the corresponding preset range of the CPU indicator..." ...meaning that the memory indicator, or the load indicator, or the disk space indicator, or the disk IO indicator, or the number of connections indicator is not within the corresponding preset range.

[0073] 2. Determine the ratio of the number of abnormal host indicators included in the abnormal host indicator group to the number of host indicators included in the individual host indicators as the abnormal indicator probability.

[0074] 3. The significant figures of the above abnormal indicator probabilities are determined as the historical host abnormality score value.

[0075] In the second step, the average of the determined anomaly scores of the historical hosts is determined as the target anomaly score of the historical host.

[0076] The third step is to perform deduplication processing on each of the obtained abnormal host indicator groups to obtain a deduplication abnormal host indicator group. Here, first, each abnormal host indicator group can be merged to obtain a merged abnormal host indicator group. Then, the merged abnormal host indicator group can be deduplicated to obtain a deduplication abnormal host indicator group.

[0077] In the fourth step, the target historical host anomaly score value and the deduplicated anomaly host indicator group are combined to generate target historical host anomaly information.

[0078] The fifth step is to determine whether the deduplicated abnormal host index group included in the target historical host abnormal information is the same as the abnormal index group included in the abnormal host information corresponding to the target historical host abnormal information, that is, whether the deduplicated abnormal host index group is the same as the abnormal index group.

[0079] In the sixth step, in response to determining that the above-mentioned deduplicated abnormal host indicator group is the same as the abnormal indicator group included in the above-mentioned abnormal host information, the sum of the target historical host abnormal score value included in the above-mentioned target historical host abnormal information and the abnormal score value included in the above-mentioned abnormal host information is determined as the host abnormal score value.

[0080] Optionally, before step 204, the method further includes:

[0081] In the first step, the host corresponding to each abnormal host information in the abnormal host information group is determined as an abnormal host to obtain an abnormal host group.

[0082] In some embodiments, the execution entity may determine the host represented by each abnormal host information in the abnormal host information group as an abnormal host to obtain an abnormal host group.

[0083] The second step is to obtain the target historical host information group of each abnormal host in the abnormal host group within a preset historical time period to obtain a target historical host information group set.

[0084] In some embodiments, the above-mentioned execution entity can obtain the target historical host information group of each abnormal host in the above-mentioned abnormal host group within a preset historical time period from the terminal device through a wired connection or a wireless connection to obtain a target historical host information group set. Here, there is no restriction on the setting of the preset historical time period. The preset historical time period can be 1 day. The target historical host information group in the target historical host information group set can refer to the operating information of the host corresponding to the abnormal host information within the preset historical time period. Here, the target historical host information can include a host indicator group. The host indicator group can include but is not limited to: number of processes, CPU indicator, memory indicator, load indicator, disk space indicator, disk IO indicator, and number of connections indicator.

[0085] The above-described embodiments of the present disclosure have the following beneficial effects: Through the host information processing methods of some embodiments of the present disclosure, hosts can be detected from the horizontal perspective of the host population and the vertical perspective of the host's target historical host information group, thereby improving the accuracy of host detection and promptly detecting abnormal hosts. Specifically, the reason for the inability to promptly detect abnormal hosts is that the hosts are not detected from the perspective of the host population, the host operating status is detected from a relatively single perspective, and the host detection results are biased, making it impossible to promptly detect abnormal hosts. Based on this, the host information processing methods of some embodiments of the present disclosure first perform principal component analysis on each host information in a host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set. This allows the host information of multiple hosts to be analyzed from a horizontal perspective, providing data support for the subsequent detection of abnormal entities. Next, outlier clustering is performed on the host principal component analysis information set to generate an outlier host principal component analysis information set. This allows the principal component analysis information of outlier hosts (the principal component information of abnormal hosts) to be analyzed. Then, based on the outlier host principal component analysis information set, an abnormal host information set is generated. Thus, the abnormal host information of the abnormal host can be parsed from a horizontal perspective. Finally, based on the target historical host information group set and the above-mentioned abnormal host information group, a host abnormality score value group is generated. Among them, the target historical host information group in the above-mentioned target historical host information group set corresponds to the abnormal host information in the above-mentioned abnormal host information group, and the abnormal host information in the above-mentioned abnormal host information group corresponds to the host abnormality score value in the above-mentioned host abnormality score value group. Thus, the host can be detected from two perspectives: the horizontal perspective (host group) and the vertical perspective (target historical host information). The accuracy of host detection is improved, and abnormal hosts can be detected in a timely manner.

[0086] Further references Figure 3 , shows some other embodiments of the host information processing method according to the present disclosure. The host information processing method includes the following steps:

[0087] Step 301 : Perform principal component analysis on each host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set.

[0088] Step 302: Perform outlier clustering processing on the host principal component analysis information set to generate an outlier host principal component analysis information group.

[0089] Step 303: Generate an abnormal host information group based on the outlier host principal component analysis information group.

[0090] In some embodiments, the specific implementation of steps 301-303 and the resulting technical effects can be referred to Figure 2The corresponding steps 201-203 in the embodiments are not described in detail here.

[0091] Step 304: Input the target historical host information set into a pre-trained host information prediction model to obtain a target host prediction information set.

[0092] In some embodiments, the execution subject of the host information processing method (eg Figure 1 The computing device 101 shown can input the target historical host information group set into a pre-trained host information prediction model to obtain a target host prediction information set. The target host prediction information in the target host prediction information set includes a host prediction score and at least one host metric. The target host prediction information in the target host prediction information set corresponds to the target historical host information group in the target historical host information group set. Here, the host prediction score can represent the predicted frequency score for a target historical host information group. The at least one host metric can refer to an abnormal host metric predicted for a target historical host information group. Here, the pre-trained host information prediction model can refer to a host information prediction model trained using deep learning methods, using a sample target historical host information group as input and abnormal host metrics and sample scores (host prediction scores) as expected outputs. For example, the pre-trained host information prediction model can be a CNN+LSTM (Convolutional Neural Networks+Long Short-Term Memory) neural network model. Here, the pre-trained host information prediction model can include an LSTM block and an FCN (Fully Connected Network) block. The data input to the LSTM block is 128*30*5. The data input to the FCN block is 1*5*30, with a convolution kernel of 3*30 and 128 feature maps. The 30*1 matrix output by the LSTM and the 128*1 matrix output by the FCN can be concatenated to obtain a (30+128)*1 matrix. The outputs of the two models (the LSTM block and the FCN block) are then merged and the predicted anomaly probability is output through the Softmax function. (The significant digits of the predicted anomaly probability can be used as the host prediction score.)

[0093] Step 305: Generate a host anomaly score value group based on the abnormal host information group and the target host prediction information set.

[0094] In some embodiments, the execution entity may generate a host anomaly score value group based on the abnormal host information group and the target host prediction information set. The abnormal host information in the abnormal host information group includes an anomaly score value and at least one anomaly indicator. The anomaly score value may represent the probability that a single host generated during the outlier clustering process is clustered into an outlier cluster (the host's clustering label represents an outlier cluster). That is, the anomaly score value may be a valid digit representing the probability that a single host is clustered into an outlier cluster (the host's clustering label represents an outlier cluster).

[0095] In practice, based on the abnormal host information group and the target host prediction information set, the execution entity may generate a host anomaly score value group through the following steps:

[0096] The first step is to perform the following processing steps for each abnormal host information in the abnormal host information group:

[0097] In a first processing step, the target host prediction information corresponding to the abnormal host information in the target host prediction information set is determined as the target host prediction information to be processed.

[0098] The second processing step is to generate a host anomaly score value based on the abnormal host information and the predicted information of the target host to be processed.

[0099] In practice, the second processing step may include the following sub-steps:

[0100] In the first sub-step, in response to the abnormality indicators included in the abnormal host information being the same as the host indicators included in the target host prediction information to be processed, the following processing steps are performed:

[0101] 1. Determine half of the abnormality score value included in the abnormal host information as the target abnormality score value.

[0102] 2. Determine half of the host prediction score value included in the target host prediction information to be processed as the target host prediction score value.

[0103] 3. The sum of the target anomaly score and the target host prediction score is determined as the host anomaly score.

[0104] It can be understood that the abnormal indicators included in the abnormal host information are the same as the host indicators included in the target host prediction information to be processed, which may mean that the abnormal indicators in the abnormal indicators are the same as the host indicators in the host indicators.

[0105] In the second sub-step, in response to the fact that the various anomaly indicators included in the abnormal host information are different from the various host indicators included in the target host prediction information to be processed, a host anomaly score value is generated based on the anomaly score value, the host prediction score value, the various anomaly indicators, and the various host indicators. In practice, first, the abnormal indicators in the various anomaly indicators that are the same as the various host indicators can be determined as target anomaly indicators to obtain a target anomaly indicator group. Then, the various anomaly indicators and the various host indicators can be merged to obtain a merged indicator group. Next, the merged indicator group can be deduplicated to obtain a deduplicated merged indicator group. Then, according to the target anomaly indicator group, weights are set for the deduplicated merged indicators in the deduplicated merged indicator group. For example, the weight setting method can be such that the weight of the deduplicated merged indicator corresponding to the target anomaly indicator is twice that of other deduplicated merged indicators (deduplicated merged indicators for which there is no corresponding target anomaly indicator). Finally, the sum of the product values ​​of the weights corresponding to each anomaly indicator and the anomaly score value can be determined as the anomaly indicator score. The host score can be determined as the sum of the product values ​​of the weights corresponding to the respective host indicators and the host prediction score. Finally, the sum of the anomaly indicator score and the host score can be determined as the host anomaly score.

[0106] In the second step, the determined host anomaly score values ​​are determined as a host anomaly score value group.

[0107] from Figure 3 It can be seen that with Figure 2 Compared with the description of some corresponding embodiments, Figure 3 Process 300 in some corresponding embodiments uses a pre-trained host information prediction model to predict fluctuations in target historical host information (number of processes, CPU metrics, memory metrics, load metrics, disk space metrics, disk I / O metrics, and connection count metrics) from a vertical dimension within a preset historical time period. This allows for the detection of host anomalies from a vertical dimension. Furthermore, host anomaly indicators can be output from both vertical and horizontal perspectives. This facilitates subsequent maintenance engineers to perform maintenance inspections based on the output anomaly indicators, shortening maintenance time.

[0108] Further references Figure 4 , shows some further embodiments of the host information processing method according to the present disclosure. The host information processing method includes the following steps:

[0109] Step 401 : Perform principal component analysis on each host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set.

[0110] Step 402: Perform outlier clustering processing on the host principal component analysis information set to generate an outlier host principal component analysis information group.

[0111] Step 403: Generate an abnormal host information group based on the outlier host principal component analysis information group.

[0112] Step 404: Generate a host anomaly score value group based on the target historical host information group set and the abnormal host information group.

[0113] In some embodiments, the specific implementation of steps 401-404 and the resulting technical effects can be referred to Figure 2 The corresponding steps 201-204 in the embodiments are not described in detail here.

[0114] Step 405 : Determine the host anomaly score values ​​greater than or equal to the preset score value in the host anomaly score value group as the target host anomaly score value, thereby obtaining the target host anomaly score value group.

[0115] In some embodiments, the execution subject of the host information processing method (eg Figure 1 The computing device 101 shown in the figure can determine the host anomaly score value greater than or equal to the preset score value in the above host anomaly score value group as the target host anomaly score value, thereby obtaining the target host anomaly score value group. Here, there is no restriction on the setting of the preset score value.

[0116] Step 406: For each target host anomaly score value in the target host anomaly score value group, perform the following processing steps:

[0117] Step 4061: Combine the anomaly index and host index corresponding to the target host anomaly score value into a host anomaly index group.

[0118] In some embodiments, the execution entity may combine the abnormality index and the host index corresponding to the target host abnormality score value into a host abnormality index group. That is, each abnormality index and each host index corresponding to the target host abnormality score value may be combined into a host abnormality index group.

[0119] Step 4062: Determine the host identifier corresponding to the target host anomaly score value as the abnormal host identifier.

[0120] In some embodiments, the execution entity may determine the host identifier of the host corresponding to the target host anomaly score as the abnormal host identifier. Here, the host identifier may refer to an identifier representing the host.

[0121] Step 4063: Generate abnormal host information based on the host abnormality indicator group and the abnormal host identifier.

[0122] In some embodiments, the execution entity may generate abnormal host information based on the host abnormality indicator group and the abnormal host identifier. In practice, the execution entity may combine the host abnormality indicator group and the abnormal host identifier to generate abnormal host information.

[0123] Step 407: Send the generated information of each abnormal host to the associated maintenance terminal.

[0124] In some embodiments, the execution subject may send the generated information of each abnormal host to an associated maintenance terminal. Here, the maintenance terminal may refer to a maintenance device (computing device / server) that is communicatively connected to the execution subject and is used to repair the abnormal host.

[0125] from Figure 4 It can be seen that with Figure 2 Compared with the description of some corresponding embodiments, Figure 4 In some corresponding embodiments, process 400 can send the root cause indicator (host indicator that causes the host abnormality) and host identification of the abnormal host to the maintenance terminal, so that maintenance personnel can quickly repair the abnormal machine based on the root cause indicator, shortening the maintenance time.

[0126] Further references Figure 5 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a host information processing device. These device embodiments are similar to Figure 2 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0127] like Figure 5As shown, the host information processing device 500 of some embodiments includes: an analyzing unit 501 , a clustering unit 502 , a first generating unit 503 and a second generating unit 504 . Among them, the analysis unit 501 is configured to perform principal component analysis processing on each host information in the host information set to generate host principal component analysis information and obtain a host principal component analysis information set; the clustering unit 502 is configured to perform outlier clustering processing on the above-mentioned host principal component analysis information set to generate an outlier host principal component analysis information group; the first generation unit 503 is configured to generate an abnormal host information group based on the above-mentioned outlier host principal component analysis information group, wherein the outlier host principal component analysis information in the above-mentioned outlier host principal component analysis information group corresponds to the abnormal host information in the above-mentioned abnormal host information group; the second generation unit 504 is configured to generate a host anomaly score value group based on the target historical host information group set and the above-mentioned abnormal host information group, wherein the target historical host information group in the above-mentioned target historical host information group set corresponds to the abnormal host information in the above-mentioned abnormal host information group, and the abnormal host information in the above-mentioned abnormal host information group corresponds to the host anomaly score value in the above-mentioned host anomaly score value group.

[0128] Optionally, before the second generation unit 504, the device 500 also includes: a first determination unit, configured to determine the host corresponding to each abnormal host information in the above-mentioned abnormal host information group as an abnormal host, and obtain an abnormal host group; a first acquisition unit, configured to obtain the target historical host information group of each abnormal host in the above-mentioned abnormal host group within a preset historical time period, and obtain a target historical host information group set.

[0129] Optionally, the abnormal host information in the abnormal host information group includes an abnormality score value and at least one abnormality indicator.

[0130] Optionally, the second generation unit 504 is further configured to: input the above-mentioned target historical host information group set into a pre-trained host information prediction model to obtain a target host prediction information set, wherein the target host prediction information in the above-mentioned target host prediction information set includes: a host prediction score value and at least one host indicator, and the target host prediction information in the above-mentioned target host prediction information set corresponds to the target historical host information group in the above-mentioned target historical host information group set; based on the above-mentioned abnormal host information group and the above-mentioned target host prediction information set, generate a host abnormality score value group.

[0131] Optionally, the second generation unit 504 is further configured to: for each abnormal host information in the above-mentioned abnormal host information group, perform the following processing steps: determine the target host prediction information corresponding to the above-mentioned abnormal host information in the above-mentioned target host prediction information set as the target host prediction information to be processed; generate a host abnormality score value based on the above-mentioned abnormal host information and the above-mentioned target host prediction information to be processed; and determine the determined individual host abnormality score values ​​as a host abnormality score value group.

[0132] Optionally, the device 500 also includes: a first determination unit, configured to determine the host abnormality score value greater than or equal to the preset score value in the above-mentioned host abnormality score value group as the target host abnormality score value, and obtain the target host abnormality score value group; a scoring processing unit, configured to perform the following processing steps for each target host abnormality score value in the above-mentioned target host abnormality score value group: combining the abnormality index and host index corresponding to the above-mentioned target host abnormality score value into a host abnormality index group; determining the host identifier corresponding to the above-mentioned target host abnormality score value as the abnormal host identifier; generating abnormal host information based on the above-mentioned host abnormality indicator group and the above-mentioned abnormal host identifier; and a sending unit, configured to send the generated each abnormal host information to the associated maintenance terminal.

[0133] Optionally, before the analyzing unit 501 , the apparatus 500 further includes: a second acquiring unit configured to acquire host information of each host in the host group to obtain a host information set.

[0134] Optionally, the analyzing unit 501 is further configured to: perform kernel principal component analysis on each piece of host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set.

[0135] Optionally, the second generation unit 504 is further configured to: in response to the individual abnormal indicators included in the above-mentioned abnormal host information being the same as the individual host indicators included in the above-mentioned target host prediction information to be processed, perform the following processing steps: determine one-half of the abnormal score value included in the above-mentioned abnormal host information as the target abnormal score value; determine one-half of the host prediction score value included in the above-mentioned target host prediction information to be processed as the target host prediction score value; determine the sum of the above-mentioned target abnormal score value and the above-mentioned target host prediction score value as the host abnormal score value; in response to the individual abnormal indicators included in the above-mentioned abnormal host information being different from the individual host indicators included in the above-mentioned target host prediction information to be processed, generate a host abnormal score value according to the above-mentioned abnormal score value, the above-mentioned host prediction score value, the above-mentioned individual abnormal indicators and the above-mentioned individual host indicators.

[0136] Optionally, the outlier host principal component analysis information in the outlier host principal component analysis information group includes principal component variables and abnormality score values, the principal component variables include host indicator feature vectors, the host indicator feature vectors include at least one host indicator feature coefficient, and the host indicator feature coefficient in the at least one host indicator feature coefficient corresponds to a host indicator.

[0137] Optionally, the first generation unit 503 is further configured to: for each outlier host principal component analysis information in the above-mentioned outlier host principal component analysis information group, perform the following processing steps: determine the principal component variable included in the above-mentioned outlier host principal component analysis information as the outlier principal component variable; sort at least one host indicator characteristic coefficient included in the host indicator feature vector included in the above-mentioned outlier principal component variable in descending order to obtain a host indicator characteristic coefficient sequence; select a preset number of host indicator characteristic coefficients from the above-mentioned host indicator characteristic coefficient sequence as abnormal host indicator characteristic coefficients to obtain an abnormal host indicator characteristic coefficient group; determine the host indicator corresponding to each abnormal host indicator characteristic coefficient in the above-mentioned abnormal host indicator characteristic coefficient group as an abnormal indicator to obtain an abnormal indicator group; combine the above-mentioned abnormal indicator group with the abnormal score value included in the above-mentioned outlier host principal component analysis information to generate abnormal host information.

[0138] It is understood that the units described in the device 500 are similar to those in the reference Figure 2 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 500 and the units included therein, and will not be repeated here.

[0139] Reference below Figure 6 , which shows an electronic device (eg, Figure 1 The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0140] like Figure 6As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0141] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead. Figure 6 Each block shown in the figure may represent one device, or may represent multiple devices as needed.

[0142] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network via the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of some embodiments of the present disclosure are performed.

[0143] It should be noted that the computer-readable medium described in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0144] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (HyperText Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0145] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device. The computer-readable medium carries one or more programs, and when executed by the electronic device, causes the electronic device to: perform principal component analysis on each host information in the host information set to generate host principal component analysis information and obtain a host principal component analysis information set; perform outlier clustering on the host principal component analysis information set to generate an outlier host principal component analysis information group; generate an abnormal host information group based on the outlier host principal component analysis information group, wherein the outlier host principal component analysis information in the outlier host principal component analysis information group corresponds to the abnormal host information in the abnormal host information group; and generate a host anomaly score value group based on the target historical host information group set and the abnormal host information group, wherein the target historical host information group in the target historical host information group set corresponds to the abnormal host information in the abnormal host information group, and the abnormal host information in the abnormal host information group corresponds to the host anomaly score value in the host anomaly score value group.

[0146] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0147] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0148] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor including an analysis unit, a clustering unit, a first generation unit, and a second generation unit. The names of these units do not, in some cases, constitute a limitation on the units themselves. For example, the analysis unit may also be described as "a unit that performs principal component analysis on each host information in the host information set to generate host principal component analysis information and obtain a host principal component analysis information set."

[0149] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0150] The above description is only an illustration of some preferred embodiments of the present disclosure and the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A host information processing method, comprising: Performing principal component analysis on each host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set, wherein the host information in the host information set refers to current operating information of a host; Performing outlier clustering processing on the host principal component analysis information set to generate an outlier host principal component analysis information group, wherein the outlier host principal component analysis information includes principal component variables and anomaly score values, the principal component variables include host indicator feature vectors, and the anomaly score value represents the probability that a single host generated in the outlier clustering process is clustered into an outlier cluster; Generating an abnormal host information group based on the outlier host principal component analysis information group includes: for each piece of outlier host principal component analysis information in the outlier host principal component analysis information group, generating abnormal host information based on a host indicator characteristic coefficient in a host indicator characteristic vector included in the outlier host principal component analysis information and the abnormality score value, wherein the outlier host principal component analysis information in the outlier host principal component analysis information group corresponds to the abnormal host information in the abnormal host information group; Based on the target historical host information group set and the abnormal host information group, a host anomaly score value group is generated, wherein the target historical host information group in the target historical host information group set corresponds to the abnormal host information in the abnormal host information group, the abnormal host information in the abnormal host information group corresponds to the host anomaly score value in the host anomaly score value group, and the target historical host information group in the target historical host information group set refers to the operation information of the host corresponding to the abnormal host information within a preset historical time period.

2. The method according to claim 1, wherein Before generating a host anomaly score value group based on the target historical host information group set and the abnormal host information group, the method further includes: Determine the host corresponding to each abnormal host information in the abnormal host information group as an abnormal host to obtain an abnormal host group; A target historical host information group of each abnormal host in the abnormal host group within a preset historical time period is obtained to obtain a target historical host information group set.

3. The method according to claim 1, wherein The abnormal host information in the abnormal host information group includes an abnormal score value and at least one abnormal indicator; as well as The generating of a host anomaly score value group based on the target historical host information group set and the abnormal host information group includes: Inputting the target historical host information group set into a pre-trained host information prediction model to obtain a target host prediction information set, wherein the target host prediction information in the target host prediction information set includes: a host prediction score value and at least one host indicator, and the target host prediction information in the target host prediction information set corresponds to the target historical host information group in the target historical host information group set; A host anomaly score value group is generated based on the abnormal host information group and the target host prediction information set.

4. The method according to claim 3, wherein: The generating of a host anomaly score value group based on the abnormal host information group and the target host prediction information set includes: For each abnormal host information in the abnormal host information group, perform the following processing steps: determining the target host prediction information corresponding to the abnormal host information in the target host prediction information set as the target host prediction information to be processed; Generate a host anomaly score based on the abnormal host information and the predicted information of the target host to be processed; The determined anomaly score values ​​of each host are determined as a host anomaly score value group.

5. The method according to claim 1, wherein The method further comprises: Determine the host anomaly score value greater than or equal to the preset score value in the host anomaly score value group as the target host anomaly score value, to obtain the target host anomaly score value group; For each target host anomaly score value in the target host anomaly score value group, perform the following processing steps: Combining the abnormality index and the host index corresponding to the target host abnormality score value into a host abnormality index group; Determine the host identifier corresponding to the target host anomaly score value as the abnormal host identifier; Generate abnormal host information based on the host abnormality indicator group and the abnormal host identifier; The generated information of each abnormal host is sent to the associated maintenance terminal.

6. The method according to claim 1, wherein Before performing principal component analysis on each host information in the host information set to generate host principal component analysis information and obtain the host principal component analysis information set, the method further includes: Get the host information of each host in the host group to obtain a host information set.

7. The method according to claim 1, wherein The principal component analysis is performed on each host information in the host information set to generate host principal component analysis information, and the host principal component analysis information set is obtained, including: Performing kernel principal component analysis processing on each host information in the host information set to generate host principal component analysis information, thereby obtaining a host principal component analysis information set.

8. The method according to claim 4, wherein Generating a host anomaly score based on the abnormal host information and the target host prediction information to be processed includes: In response to the abnormal host information including the abnormal indicators being the same as the host indicators included in the target host prediction information to be processed, the following processing steps are performed: Determine half of the abnormality score value included in the abnormal host information as a target abnormality score value, wherein the abnormality score value is a valid figure of the probability that a single host is clustered into an outlier cluster; Determining half of the host prediction score value included in the target host prediction information to be processed as the target host prediction score value, wherein the host prediction score value represents a predicted frequency score for a target historical host information group; Determine the sum of the target anomaly score value and the target host prediction score value as the host anomaly score value; In response to each abnormality indicator included in the abnormal host information being different from each host indicator included in the predicted information of the target host to be processed, generating a host abnormality score value based on the abnormality score value, the host predicted score value, each abnormality indicator, and each host indicator, wherein generating the host abnormality score value based on the abnormality score value, the host predicted score value, each abnormality indicator, and each host indicator includes: Determine the abnormal indicators in the abnormal indicators that are the same as those in the host indicators as target abnormal indicators to obtain a target abnormal indicator group; merge the abnormal indicators and the host indicators to obtain a merged indicator group; de-duplicate the merged indicator group to obtain a de-duplicated merged indicator group; set weights for the de-duplicated merged indicators in the de-duplicated merged indicator group according to the target abnormal indicator group; determine the abnormal indicator score value as the sum of the product values ​​of the weights corresponding to the abnormal indicators and the abnormal score values; determine the host score value as the sum of the product values ​​of the weights corresponding to the host indicators and the host prediction score values; and determine the host abnormal score value as the sum of the abnormal indicator score value and the host score value.

9. The method according to claim 1, wherein The outlier host principal component analysis information in the outlier host principal component analysis information group includes a principal component variable and an anomaly score value, the principal component variable includes a host indicator feature vector, the host indicator feature vector includes at least one host indicator feature coefficient, and the host indicator feature coefficient in the at least one host indicator feature coefficient corresponds to a host indicator; as well as The generating of the abnormal host information group based on the outlier host principal component analysis information group includes: For each piece of outlier host principal component analysis information in the outlier host principal component analysis information group, the following processing steps are performed: Determining the principal component variables included in the outlier host principal component analysis information as outlier principal component variables; sorting in descending order at least one host index characteristic coefficient included in the host index characteristic vector included in the outlier principal component variable to obtain a host index characteristic coefficient sequence; Selecting a preset number of host indicator characteristic coefficients from the host indicator characteristic coefficient sequence as abnormal host indicator characteristic coefficients to obtain an abnormal host indicator characteristic coefficient group; Determine the host indicator corresponding to each abnormal host indicator characteristic coefficient in the abnormal host indicator characteristic coefficient group as an abnormal indicator to obtain an abnormal indicator group; The abnormal indicator group is combined with the abnormal score value included in the outlier host principal component analysis information to generate abnormal host information.

10. A host information processing device, comprising: an analyzing unit configured to perform principal component analysis on each host information in the host information set to generate host principal component analysis information and obtain a host principal component analysis information set, wherein the host information in the host information set refers to current operating information of a host; a clustering unit configured to perform outlier clustering processing on the host principal component analysis information set to generate an outlier host principal component analysis information group, wherein the outlier host principal component analysis information includes principal component variables and an anomaly score value, the principal component variables include a host indicator feature vector, and the anomaly score value represents the probability of a single host generated in the outlier clustering process being clustered into an outlier cluster; The first generating unit is configured to generate an abnormal host information group based on the outlier host principal component analysis information group, comprising: for each piece of outlier host principal component analysis information in the outlier host principal component analysis information group, generating abnormal host information based on a host indicator characteristic coefficient in a host indicator characteristic vector included in the outlier host principal component analysis information and the abnormality score value, wherein the outlier host principal component analysis information in the outlier host principal component analysis information group corresponds to the abnormal host information in the abnormal host information group; The second generating unit is configured to generate a host anomaly score value group based on the target historical host information group set and the abnormal host information group, wherein the target historical host information group in the target historical host information group set corresponds to the abnormal host information in the abnormal host information group, the abnormal host information in the abnormal host information group corresponds to the host anomaly score value in the host anomaly score value group, and the target historical host information group in the target historical host information group set refers to the operation information of the host corresponding to the abnormal host information within a preset historical time period.

11. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 9.

12. A computer-readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images