Server anomaly detection methods, devices, equipment, storage media, and program products

Abstract

This application relates to a server anomaly identification method, apparatus, device, storage medium, and program product. By acquiring the change completion time of the target server's basic data and the target node identifier corresponding to the target server, target basic data is collected over a collection period from the change completion time to the collection end time. Based on the data type of the basic data corresponding to the target node identifier, the target data type of the basic data is determined. When the target data type is dynamic data, anomaly identification of the target server is performed based on the collection end time and the target logistic regression model. This method collects the target server's basic data within the collection period after the change is completed, and identifies server anomalies based on the collection end time and the target logistic regression model. This eliminates the need for maintenance personnel to check for server anomalies, improving anomaly identification efficiency and saving manpower.

Description

Technical Field

[0001] This application relates to the field of big data technology, and in particular to a method, apparatus, device, storage medium and program product for server anomaly identification. Background Technology

[0002] With the application of distributed technologies, such as cloud platforms, distributed service framework platforms, and big data service platforms, the number of servers in the system has increased dramatically, with a single platform having tens of thousands of servers. Therefore, there is an urgent need to use intelligent operation and maintenance methods to improve monitoring and automatic verification capabilities to determine the health status of the system.

[0003] Currently, most industry-deployed monitoring systems utilize methods such as: availability monitoring by detecting the status of individual service processes; application monitoring by setting thresholds for transaction volume, response time, system and business success rates; and system monitoring by setting thresholds for CPU, memory, and disk usage. However, these existing monitoring deployment methods require frontline operations personnel to log into the server and check its functionality based on their own experience, which is time-consuming and labor-intensive. Summary of the Invention

[0004] Therefore, it is necessary to provide a server anomaly identification method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the efficiency of anomaly identification in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for identifying server anomalies, the method comprising:

[0006] Obtain the completion time of the change of the target basic data of the target server and the target node identifier corresponding to the target server;

[0007] Collect target basic data for the collection period from the time the change was completed to the time the collection ended;

[0008] The target data type of the target basic data is determined based on the data type of the basic data corresponding to the target node identifier;

[0009] If the target data type is dynamic data, then the target server is identified as abnormal based on the data collection end time and the target logistic regression model.

[0010] In one embodiment, if the target data type is dynamic data, then anomaly identification of the target server is performed based on the data collection end time and the target logistic regression model, including:

[0011] Based on the data collection end time and the target logistic regression model, a first probability value for the existence of the target basic data in the data collection period is obtained;

[0012] If the difference between the first probability value and 1 is less than a preset difference, and the target basic data is not present in the first basic data of the target node, then the target server is determined to be abnormal.

[0013] Wherein, the first basic data is the dynamic basic data of the target node corresponding to the collection period, and the target node is the target node identifier.

[0014] In one embodiment, the method further includes:

[0015] If the difference between the first probability value and 1 is greater than or equal to the preset difference, then the preset probability value is determined based on the first probability value.

[0016] Determine a second probability value for the existence of the target basic data in the first basic data;

[0017] If the second probability value is greater than the preset probability value, then the target server is determined to be normal.

[0018] In one embodiment, the method further includes:

[0019] If the target data type is static data, and the target basic data is different from the second basic data, then the target server is determined to be abnormal.

[0020] The second basic data is the static basic data of the target node corresponding to the acquisition period.

[0021] In one embodiment, the method further includes:

[0022] If the target basic data is the same as the second basic data, then the target server is determined to be normal.

[0023] In one embodiment, the method further includes:

[0024] Obtain the target basic data of the server for each collection cycle within a preset time period;

[0025] If the target basic data of the server is dynamic data, then the target basic data of the server is converted into matrix unit data;

[0026] Clustering algorithms are used to preprocess the matrix unit data to obtain each training data;

[0027] The target logistic regression model is obtained based on the training data, the end time of the training data collection, and the preset logistic regression model.

[0028] Secondly, this application also provides a server anomaly identification device, the device comprising:

[0029] The first acquisition module is used to acquire the change completion time of the target basic data of the target server and the target node identifier corresponding to the target server;

[0030] The data acquisition module is used to collect target basic data for the data acquisition period from the time the change was completed to the time the data acquisition ended.

[0031] The first determining module is used to determine the target data type of the target basic data based on the data type of the basic data corresponding to the target node identifier;

[0032] The identification module is used to identify anomalies in the target server based on the data collection end time and the target logistic regression model if the target data type is dynamic data.

[0033] Thirdly, this application also provides a computer device, the computer device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0034] Obtain the completion time of the change of the target basic data of the target server and the target node identifier corresponding to the target server;

[0035] Collect target basic data for the collection period from the time the change was completed to the time the collection ended;

[0036] The target data type of the target basic data is determined based on the data type of the basic data corresponding to the target node identifier;

[0037] If the target data type is dynamic data, then the target server is identified as abnormal based on the data collection end time and the target logistic regression model.

[0038] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0039] Obtain the completion time of the change of the target basic data of the target server and the target node identifier corresponding to the target server;

[0040] Collect target basic data for the collection period from the time the change was completed to the time the collection ended;

[0041] The target data type of the target basic data is determined based on the data type of the basic data corresponding to the target node identifier;

[0042] If the target data type is dynamic data, then the target server is identified as abnormal based on the data collection end time and the target logistic regression model.

[0043] Fifthly, this application also provides a computer program product, which includes a computer program that, when executed by a processor, performs the following steps:

[0044] Obtain the completion time of the change of the target basic data of the target server and the target node identifier corresponding to the target server;

[0045] Collect target basic data for the collection period from the time the change was completed to the time the collection ended;

[0046] The target data type of the target basic data is determined based on the data type of the basic data corresponding to the target node identifier;

[0047] If the target data type is dynamic data, then the target server is identified as abnormal based on the data collection end time and the target logistic regression model.

[0048] The aforementioned server anomaly identification method, apparatus, device, storage medium, and program products acquire the target server's target basic data change completion time and the target node identifier corresponding to the target server. They collect target basic data within a collection period from the change completion time to the collection end time. Based on the data type of the basic data corresponding to the target node identifier, the target data type of the target basic data is determined. When the target data type is dynamic data, anomaly identification of the target server is performed based on the collection end time and the target logistic regression model. This method collects the target server's target basic data within the collection period after the change is completed, and identifies server anomalies using the collection end time and the target logistic regression model. This eliminates the need for frontline maintenance personnel to rely on their experience to check for server anomalies, replacing a large amount of repetitive manual operation, improving server anomaly identification efficiency, and saving manpower. Attached Figure Description

[0049] Figure 1 This is a diagram illustrating the application environment of a server anomaly detection method in one embodiment.

[0050] Figure 2 This is a flowchart illustrating a server anomaly detection method in one embodiment;

[0051] Figure 3 This is a schematic diagram of the process for anomaly identification of the target server in one embodiment;

[0052] Figure 4 This is a flowchart illustrating the process of anomaly identification of the target server in another embodiment;

[0053] Figure 5 This is a flowchart illustrating the process of determining the target logistic regression model in one embodiment.

[0054] Figure 6 This is a structural block diagram of a server anomaly detection device in one embodiment;

[0055] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] The server anomaly identification method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown includes a computer device, which may be a server, and its internal structure diagram may be as follows. Figure 1 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores server-related data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a server anomaly detection method.

[0058] In one embodiment, such as Figure 2 As shown, a server anomaly identification method is provided, which can be applied to... Figure 1 Taking a computer device as an example, the explanation includes the following steps:

[0059] S201, obtain the completion time of the change of the target basic data of the target server and the target node identifier corresponding to the target server.

[0060] Optionally, the target base data can be directories / files, ports, processes, etc. By analyzing the target base data, the internal activity patterns of the target server can be discovered.

[0061] In this embodiment, the server types corresponding to the same node identifier are consistent. For example, the login nodes include server 1, server 2, server 3, server 4 and server 5. These five servers are of the same type and have the same function.

[0062] In this embodiment, the completion time of changes to the target basic data of the target server and the server list of the target server can be obtained through the sustainable delivery system. The server list includes the identifier of the target server, and the operation and maintenance management platform includes the correspondence between the server and node identifiers. Based on the server list and the operation and maintenance management platform, the nodes of the target server are matched to obtain the target node identifier of the target server.

[0063] S202, Collect target basic data for the collection period from the change completion time to the collection end time.

[0064] The duration corresponding to the collection cycle can be equal to the preset duration.

[0065] In this embodiment, a day is divided according to the collection cycle. Assuming the collection cycle is 10 minutes and the change completion time is 02:00, the target basic data for the collection cycle from the change completion time to the collection end time is the target basic data from 02:00 to 02:10.

[0066] S203, determine the target data type of the target basic data based on the data type of the basic data corresponding to the target node identifier.

[0067] In this embodiment, since the server types corresponding to the same node identifier are consistent, the data type of the basic data corresponding to the target node identifier is used as the target data type of the target basic data. Assume that application A includes nodes 1, 2, 3, and 4. The data type of node 1 is dynamic data, the data type of node 2 is static data, the data type of node 3 is dynamic data, and the data type of node 4 is dynamic data. Since the target node identifier corresponding to the target server is node 1, the target data type of the target basic data is dynamic data.

[0068] S204. If the target data type is dynamic data, then anomaly identification of the target server is performed based on the data collection end time and the target logistic regression model.

[0069] In this embodiment, the target logistic regression model relates to the relationship between time and the probability of the existence of target basic data. When the target basic data type is dynamic data, the end time of the target basic data collection is input into the target logistic regression model to obtain the probability that the target basic data exists between the change completion time and the collection end time.

[0070] In this embodiment, the basic data corresponding to the target node identifier is consistent with the target basic data type. Anomaly identification of the target server can be performed by comparing the probability obtained from the target logistic regression model with the probability of the basic data corresponding to the target node identifier. If the probability obtained from the target logistic regression model is inconsistent with the probability of the basic data corresponding to the target node identifier, the target server is determined to be abnormal. Alternatively, if the difference between the probability obtained from the target logistic regression model and the probability of the basic data corresponding to the target node identifier is greater than a preset difference, the target server is determined to be abnormal.

[0071] Furthermore, when a server malfunction is detected, an alarm device can be triggered to alert frontline maintenance personnel to check the situation by setting a buzzer or popping up an error window.

[0072] In the aforementioned server anomaly identification method, the target server's basic data change completion time and the target node identifier corresponding to the target server are obtained. Target basic data is collected over a period from the change completion time to the collection end time. Based on the data type of the basic data corresponding to the target node identifier, the target data type of the basic data is determined. When the target data type is dynamic data, anomaly identification of the target server is performed based on the collection end time and the target logistic regression model. This method collects the target server's basic data within the collection period after the change is completed, and identifies server anomalies using the collection end time and the target logistic regression model. This eliminates the need for frontline maintenance personnel to rely on their experience to check for server anomalies, replacing a large amount of repetitive manual operation, improving server anomaly identification efficiency, and saving manpower.

[0073] Figure 3 This is a flowchart illustrating the process of anomaly detection for a target server in one embodiment, such as... Figure 3 As shown, this application embodiment relates to a possible implementation method for anomaly identification of a target server based on the data collection end time and the target logistic regression model, namely, the above-mentioned S204 includes the following steps:

[0074] S301, based on the data collection end time and the target logistic regression model, obtain the first probability value of the existence of the target basic data during the data collection period.

[0075] In this embodiment, the data collection end time is input into the target logistic regression model to obtain the first probability value of the existence of the target basic data during the collection period. Assuming the collection period is ten minutes and the change completion time is 00:30, the data collection end time is 00:40. The value 40 is directly input into the target logistic regression model to obtain the first probability value of the existence of the target basic data within the collection period of 00:30-00:40. If the change completion time is 01:10, the data collection end time is 01:20. The value 80 needs to be input into the target logistic regression model to obtain the first probability value of the existence of the target basic data within the collection period of 01:10-01:20.

[0076] S302, if the difference between the first probability value and 1 is less than the preset difference, and the target basic data is not present in the first basic data of the target node, then the target server is determined to be abnormal; wherein, the first basic data is the dynamic basic data of the target node corresponding to the collection period, and the target node is the target node identifier.

[0077] Optionally, the preset difference can be 0.01, 0.001, etc. This application embodiment does not limit this, as long as the preset difference is as small as possible.

[0078] In this embodiment, for example, if the preset difference is 0.001 and the first probability value is 0.9999, then the difference between the first probability value and 1 is less than the preset difference, which proves that the probability of the target basic data existing during the collection period between the change completion time and the collection end time is approximately 100%.

[0079] In this embodiment, the dynamic basic data of the target node corresponding to the collection period is the basic data corresponding to the collection period within the most recent preset time period. The dynamic basic data of the target node corresponding to the collection period belongs to the same node as the target server. For example, if the collection period is 01:10-01:20 and the first probability value is 0.9999, but the target basic file does not exist in the basic data corresponding to the collection period within the preset time period, then the target server is abnormal.

[0080] In this embodiment, based on the data collection end time and the target logistic regression model, a first probability value for the existence of target basic data during the data collection period is obtained. If the difference between the first probability value and 1 is less than a preset difference, and the target basic data is not present in the first basic data of the target node, then the target server is determined to be abnormal. This method predicts the existence probability of target basic data using a target logistic regression model, thereby identifying server anomalies based on the predicted first probability value. This improves intelligent operation and maintenance capabilities and reduces the pressure on frontline operation and maintenance personnel.

[0081] Figure 4This is a flowchart illustrating the process of anomaly detection for the target server in another embodiment, as shown below. Figure 4 As shown, this application embodiment relates to another possible implementation method for anomaly identification of the target server based on the data collection end time and the target logistic regression model, that is, the above S204 further includes the following steps:

[0082] S401, if the difference between the first probability value and 1 is greater than or equal to a preset difference, then the preset probability value is determined based on the first probability value.

[0083] In this embodiment, when the difference between the first probability value and 1 is greater than or equal to a preset difference (assuming the first probability value is 0.7 and the preset difference is 0.01), the difference between the first probability value and 1 is greater than 0.01. Therefore, the preset probability value is determined based on the first probability value. The first preset probability threshold can be 0.6, 0.5, or 0.75, etc. This embodiment does not limit this.

[0084] In this embodiment, determining the preset probability value based on the first probability value can also be understood as determining the preset probability value based on the weight of the target node in the collection period. As shown in Table 2 in S504, the weight of the target node in the collection period (i.e., the weight of the basic data of the target node server in the collection period) is positively correlated with the first probability value. Therefore, it can also be understood as determining the preset probability value based on the weight of the target node.

[0085] S402, determine the second probability value of the target basic data existing in the first basic data.

[0086] In this embodiment, the quotient of the number of times the first basic data is collected within the corresponding collection period and the number of times the target basic data exists can be used as the second probability value of the target basic data existing in the first basic data.

[0087] S403, if the second probability value is greater than the preset probability value, then the target server is determined to be normal.

[0088] In this embodiment, assuming a preset probability value of 0.6 and a second probability value of 0.65, the probability that the target basic file exists in the first basic data is greater than 0.6, proving that the target server is normal.

[0089] In this embodiment, when the difference between the first probability value and 1 is greater than or equal to a preset difference, a preset probability value is determined based on the first probability value, and a second probability value is determined based on the existence of the target basic data in the first basic data. If the second probability value is greater than the preset probability value, the target server is determined to be normal. This method determines the preset probability value by using the first probability value and compares the probability of the target basic data existing in the first basic data with the preset probability value. This improves the accuracy of server anomaly identification while ensuring the fault tolerance rate of server anomaly identification and enhancing the flexibility of server anomaly identification.

[0090] In one embodiment, when the target data type is static data, determining whether the target server is abnormal includes the following two methods:

[0091] The first approach: If the target data type is static data, and the target basic data is different from the second basic data, then the target server is determined to be abnormal; where the second basic data is the static basic data of the target node corresponding to the collection period.

[0092] In this embodiment, when the target basic data type is static data, it is only necessary to compare the target basic data with the second basic data of the target node corresponding to the target server. When the target basic data and the second basic data are inconsistent, the target server is abnormal.

[0093] The second method: If the target basic data is the same as the second basic data, then the target server is considered to be functioning normally.

[0094] In this embodiment, the target server is determined to be normal when the target basic data is the same as the second basic data. This can also be understood as the target server being normal if all the second basic data can be found within the target basic data.

[0095] In this embodiment, when the target data type is static data, the normality of the target server is determined by comparing whether the target basic data and the second basic data are consistent. If the target basic data and the second basic data are different, the target server is determined to be abnormal; if the target basic data and the second basic data are the same, the target server is determined to be normal. This method directly compares the target basic data with the data of the target node, which is simple and improves the efficiency of service anomaly identification.

[0096] Figure 5 This is a flowchart illustrating the process of determining the target logistic regression model in one embodiment, such as... Figure 5 As shown, this application embodiment relates to a possible implementation method for determining the target logistic regression model based on each training data, the end time of each training data collection, and a preset logistic regression model, including the following steps:

[0097] S501, acquire the target basic data of the server for each collection cycle within a preset time period.

[0098] In this embodiment, for servers under the same node, one server is randomly selected, and the target basic data of the server is obtained for each collection period within a preset time period. As shown in Table 1 below, the preset time period is 30 days, and the collection period is 10 minutes, obtaining data for directories / files, ports, and processes within 30 days. When naming files / directories, the file / directory path & filename (for files named with AA + date, only the filename AA is retained) & modification time (for files of the same type, only the most recent modification time is retained).

[0099] Table 1

[0100]

[0101] S502, if the target basic data of the server is dynamic data, then the target basic data of the server is converted into matrix unit data.

[0102] In this embodiment, taking the above embodiment as an example, if the target basic data of the server does not change within 30 days, the target basic data is static data; if it changes within 30 days, the target basic data is dynamic data.

[0103] In this embodiment, when the target basic data is static data, the target basic data of the server can be directly stored as the basic data of the node, and the static data can be used as the data type of the basic data of the node.

[0104] In this embodiment, if the target basic data of the server is dynamic data, when converting the target basic data into matrix unit data, the target basic data can be converted into 30*144 matrix unit data (collected once every 10 minutes, for a total of 144 collections within 24 hours). Target basic data that changes within every 10 minutes is marked as 1, and target basic data that does not change is marked as 0. Alternatively, the target basic data can be converted into 144*30 matrix unit data, or other types of matrix unit data. This embodiment of the application does not limit this.

[0105] S503 uses a clustering algorithm to preprocess the matrix unit data to obtain each training data.

[0106] In this embodiment, a density-based clustering algorithm can be used to remove noise. The obtained matrix unit data is set as an object set. Any target basic data is taken as an object. By setting (ε, m), for a given data m (m is an integer), ε is defined as the radius (in minutes). If the object contains m target basic data within a region of radius ε, then the object is defined as a core object, and a new cluster is created. Target basic data not in any cluster are defined as noise. Finally, training data for every ten minutes is obtained. Hierarchical clustering algorithms, partitioning clustering algorithms, etc., can also be used to remove noise and obtain each training data set. This embodiment does not limit the specific methods used.

[0107] S504. Based on each training data, the end time of each training data collection, and the preset logistic regression model, determine the target logistic regression model.

[0108] In this embodiment, the training data within 30 days are statistically analyzed according to Table 2 below. Table 2 shows the training data from 0 to 40 minutes, where n i m represents the number of samples collected every 10 minutes over 30 days. i This indicates the number of items marked as 1. If m is in every 10 minutes... i If the value is 0, then no regression analysis will be performed on the target base data (training data) for that ten minutes, that is, the corresponding 10 minutes of data will be removed.

[0109] Table 2

[0110]

[0111] In this embodiment, the preset logistic regression model is: c represents the serial number in Table 2 above, β0 is a constant coefficient, and β i These are partial regression coefficients. Based on n... i and m i The probability of the training data existing within that ten-minute period is obtained. The collection end time corresponding to the above four numbers (0-10 minutes is denoted as 10, 10-20 minutes as 20, and so on) and the probability value corresponding to the collection period (p) are then assigned. i =m i / n i Substituting this into the pre-defined logistic regression model, we obtain β. i The magnitude of is used to determine the target logistic regression model, which is a time-related model.

[0112] In this embodiment, the weight of the server target basic data in the corresponding collection period is calculated based on the number of collections and the probability. The weight is used to verify the probability of the target basic data existing in the collection period. It can be seen that there is a positive correlation between the weight and the probability of the server target basic data.

[0113] In this embodiment, target basic data of the server is acquired for each collection period within a preset time period. When the target basic data is dynamic, it is converted into matrix unit data. Further preprocessing of the matrix unit data yields training data, thereby determining the target logistic regression model. Logistic regression models are computationally fast. This method trains the logistic regression model using the target basic data, laying the foundation for subsequent judgment of abnormal server states based on the logistic regression model and improving the efficiency of the judgment.

[0114] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0115] Based on the same inventive concept, this application also provides a server anomaly identification device for implementing the server anomaly identification method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more server anomaly identification device embodiments provided below can be found in the limitations of the server anomaly identification method described above, and will not be repeated here.

[0116] In one embodiment, such as Figure 6 As shown, a server anomaly identification device is provided, comprising: a first acquisition module 11, a collection module 12, a first determination module 13, and an identification module 14, wherein:

[0117] The first acquisition module 11 is used to acquire the change completion time of the target basic data of the target server and the target node identifier corresponding to the target server;

[0118] The data acquisition module 12 is used to collect target basic data for the data acquisition period from the change completion time to the data acquisition end time.

[0119] The first determining module 13 is used to determine the target data type of the target basic data based on the data type of the basic data corresponding to the target node identifier;

[0120] The identification module 14 is used to identify anomalies in the target server based on the data collection end time and the target logistic regression model if the target data type is dynamic data.

[0121] In one embodiment, the identification module includes:

[0122] The first determining unit is used to obtain the first probability value of the existence of the target basic data during the collection period based on the collection end time and the target logistic regression model.

[0123] The second determining unit is used to determine that the target server is abnormal if the difference between the first probability value and 1 is less than a preset difference and the target basic data does not exist in the first basic data of the target node.

[0124] Among them, the first basic data is the dynamic basic data of the target node corresponding to the collection cycle, and the target node is the target node identifier.

[0125] In one embodiment, the identification module further includes:

[0126] The third determining unit is used to determine the preset probability value based on the first probability value if the difference between the first probability value and 1 is greater than or equal to the preset difference.

[0127] The fourth determining unit is used to determine the second probability value of the existence of the target basic data in the first basic data;

[0128] The fifth determining unit is used to determine that the target server is normal if the second probability value is greater than the preset probability value.

[0129] In one embodiment, a server anomaly detection device is provided, the device further comprising:

[0130] The second determination module is used to determine that the target server is abnormal if the target data type is static data and the target basic data is different from the second basic data.

[0131] The second set of basic data consists of static basic data of the target node corresponding to the collection cycle.

[0132] In one embodiment, a server anomaly detection device is provided, the device further comprising:

[0133] The third determination module is used to determine that the target server is normal if the target basic data is the same as the second basic data.

[0134] In one embodiment, a server anomaly detection device is provided, the device further comprising:

[0135] The second acquisition module is used to acquire the target basic data of the server for each acquisition cycle within a preset time period;

[0136] The conversion module is used to convert the target basic data of the server into matrix unit data if the target basic data of the server is dynamic data.

[0137] The processing module is used to preprocess the matrix unit data using a clustering algorithm to obtain each training data.

[0138] The fourth determination module is used to determine the target logistic regression model based on each training data, the end time of each training data collection, and the preset logistic regression model.

[0139] Each module in the aforementioned server anomaly detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0140] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a server anomaly detection method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0141] Those skilled in the art will understand that Figure 7The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0142] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0143] Obtain the completion time of the change to the target basic data of the target server and the target node identifier corresponding to the target server;

[0144] Collect target basic data for the collection period from the time the change was completed to the time the collection ended;

[0145] The target data type of the target basic data is determined based on the data type of the basic data corresponding to the target node identifier;

[0146] If the target data type is dynamic data, then anomaly identification of the target server is performed based on the data collection end time and the target logistic regression model.

[0147] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0148] Based on the end time of data collection and the target logistic regression model, the first probability value of the existence of the target basic data during the data collection period is obtained.

[0149] If the difference between the first probability value and 1 is less than the preset difference, and the target basic data does not exist in the first basic data of the target node, then the target server is determined to be abnormal.

[0150] Among them, the first basic data is the dynamic basic data of the target node corresponding to the collection cycle, and the target node is the target node identifier.

[0151] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0152] If the difference between the first probability value and 1 is greater than or equal to a preset difference, then the preset probability value is determined based on the first probability value.

[0153] Determine the second probability value of the target basic data existing in the first basic data;

[0154] If the second probability value is greater than the preset probability value, then the target server is determined to be normal.

[0155] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0156] If the target data type is static data, and the target base data is different from the second base data, then the target server is determined to be abnormal.

[0157] The second set of basic data consists of static basic data of the target node corresponding to the collection cycle.

[0158] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0159] If the target data is the same as the second basic data, then the target server is determined to be normal. In one embodiment, the processor, when executing the computer program, also performs the following steps:

[0160] Obtain the target basic data of the server for each collection cycle within a preset time period;

[0161] If the target basic data of the server is dynamic data, then the target basic data of the server will be converted into matrix unit data;

[0162] Clustering algorithms are used to preprocess the matrix unit data to obtain each training data;

[0163] Based on the training data, the end time of each training data collection, and the preset logistic regression model, the target logistic regression model is determined.

[0164] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0165] Obtain the completion time of the change to the target basic data of the target server and the target node identifier corresponding to the target server;

[0166] Collect target basic data for the collection period from the time the change was completed to the time the collection ended;

[0167] The target data type of the target basic data is determined based on the data type of the basic data corresponding to the target node identifier;

[0168] If the target data type is dynamic data, then anomaly identification of the target server is performed based on the data collection end time and the target logistic regression model.

[0169] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0170] Based on the end time of data collection and the target logistic regression model, the first probability value of the existence of the target basic data during the data collection period is obtained.

[0171] If the difference between the first probability value and 1 is less than the preset difference, and the target basic data does not exist in the first basic data of the target node, then the target server is determined to be abnormal.

[0172] Among them, the first basic data is the dynamic basic data of the target node corresponding to the collection cycle, and the target node is the target node identifier.

[0173] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0174] If the difference between the first probability value and 1 is greater than or equal to a preset difference, then the preset probability value is determined based on the first probability value.

[0175] Determine the second probability value of the target basic data existing in the first basic data;

[0176] If the second probability value is greater than the preset probability value, the target server is determined to be normal. In one embodiment, when the computer program is executed by the processor, it further implements the following steps:

[0177] If the target data type is static data, and the target base data is different from the second base data, then the target server is determined to be abnormal.

[0178] The second set of basic data consists of static basic data of the target node corresponding to the collection cycle.

[0179] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0180] If the target basic data is the same as the second basic data, then the target server is determined to be normal. In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0181] Obtain the target basic data of the server for each collection cycle within a preset time period;

[0182] If the target basic data of the server is dynamic data, then the target basic data of the server will be converted into matrix unit data;

[0183] Clustering algorithms are used to preprocess the matrix unit data to obtain each training data;

[0184] Based on the training data, the end time of each training data collection, and the preset logistic regression model, the target logistic regression model is determined.

[0185] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0186] Obtain the completion time of the change to the target basic data of the target server and the target node identifier corresponding to the target server;

[0187] Collect target basic data for the collection period from the time the change was completed to the time the collection ended;

[0188] The target data type of the target basic data is determined based on the data type of the basic data corresponding to the target node identifier;

[0189] If the target data type is dynamic data, then anomaly identification of the target server is performed based on the data collection end time and the target logistic regression model.

[0190] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0191] Based on the end time of data collection and the target logistic regression model, the first probability value of the existence of the target basic data during the data collection period is obtained.

[0192] If the difference between the first probability value and 1 is less than the preset difference, and the target basic data does not exist in the first basic data of the target node, then the target server is determined to be abnormal.

[0193] Among them, the first basic data is the dynamic basic data of the target node corresponding to the collection cycle, and the target node is the target node identifier.

[0194] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0195] If the difference between the first probability value and 1 is greater than or equal to a preset difference, then the preset probability value is determined based on the first probability value.

[0196] Determine the second probability value of the target basic data existing in the first basic data;

[0197] If the second probability value is greater than the preset probability value, the target server is determined to be normal. In one embodiment, when the computer program is executed by the processor, it further implements the following steps:

[0198] If the target data type is static data, and the target base data is different from the second base data, then the target server is determined to be abnormal.

[0199] The second set of basic data consists of static basic data of the target node corresponding to the collection cycle.

[0200] In one embodiment, when the computer program is executed by a processor, it further performs the following steps:

[0201] If the target basic data is the same as the second basic data, then the target server is determined to be normal. In one embodiment, when the computer program is executed by the processor, it further performs the following steps:

[0202] Obtain the target basic data of the server for each collection cycle within a preset time period;

[0203] If the target basic data of the server is dynamic data, then the target basic data of the server will be converted into matrix unit data;

[0204] Clustering algorithms are used to preprocess the matrix unit data to obtain each training data;

[0205] Based on the training data, the end time of each training data collection, and the preset logistic regression model, the target logistic regression model is determined.

[0206] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0207] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0208] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0209] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for identifying server anomalies, characterized in that, The method includes: Obtain the completion time of the change of the target basic data of the target server and the target node identifier corresponding to the target server; Collect target basic data for the collection period from the time the change was completed to the time the collection ended; The target data type of the target basic data is determined based on whether the basic data corresponding to the target node identifier changes within a preset time period. If the target data type is dynamic data, then based on the collection end time and the target logistic regression model, a first probability value for the existence of the target basic data in the collection period is obtained; if the difference between the first probability value and 1 is less than a preset difference, and the target basic data is not present in the first basic data of the target node, then the target server is determined to be abnormal; wherein, the first basic data is the dynamic basic data of the target node corresponding to the collection period, and the target node is the target node identifier corresponding to it; The method further includes: Obtain the target basic data of the server for each collection cycle within a preset time period; If the target basic data of the server is dynamic data, then the target basic data of the server is converted into matrix unit data; Clustering algorithms are used to preprocess the matrix unit data to obtain each training data; The target logistic regression model is determined based on the training data, the end time of the training data collection, and the preset logistic regression model.

2. The method according to claim 1, characterized in that, The method further includes: If the difference between the first probability value and 1 is greater than or equal to the preset difference, then the preset probability value is determined based on the first probability value. Determine a second probability value for the existence of the target basic data in the first basic data; If the second probability value is greater than the preset probability value, then the target server is determined to be normal.

3. The method according to claim 1, characterized in that, The method further includes: If the target data type is static data, and the target basic data is different from the second basic data, then the target server is determined to be abnormal. The second basic data is the static basic data of the target node corresponding to the acquisition period.

4. The method according to claim 3, characterized in that, The method further includes: If the target basic data is the same as the second basic data, then the target server is determined to be normal.

5. A server anomaly detection device, characterized in that, The device includes: The first acquisition module is used to acquire the change completion time of the target basic data of the target server and the target node identifier corresponding to the target server; The data acquisition module is used to collect target basic data for the data acquisition period from the time the change was completed to the time the data acquisition ended. The first determining module is used to determine the target data type of the target basic data based on whether the basic data corresponding to the target node identifier has changed within a preset time period. The identification module is used to determine the target server is abnormal if the target data type is dynamic data, based on the collection end time and the target logistic regression model, the existence of the target basic data in the collection period; if the difference between the first probability value and 1 is less than a preset difference, and the target basic data is not present in the first basic data of the target node; wherein, the first basic data is the dynamic basic data of the target node corresponding to the collection period, and the target node is the target node identifier corresponding to the target node. The second acquisition module is used to acquire the target basic data of the server for each acquisition cycle within a preset time period; The conversion module is used to convert the target basic data of the server into matrix unit data if the target basic data of the server is dynamic data. The processing module is used to preprocess the matrix unit data using a clustering algorithm to obtain each training data. The fourth determining module is used to determine the target logistic regression model based on each training data, the end time of the collection of each training data, and the preset logistic regression model.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images