Abnormality detection method, device, equipment, storage medium and program

Abstract

The present application provides an anomaly detection method, apparatus, device, storage medium, and program. The method includes: in each grayscale stage of a first system change, determining whether the first operating indicator has suspected abnormal performance after the first system change based on monitoring data of the first operating indicator; if suspected abnormal performance exists, determining the indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator, and determining whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature and at least one historical feature stored in a preset database, the historical feature being used to describe the normal performance of the first system change; if the suspected abnormal performance is not a normal performance of the first system change, outputting an alarm message. This method can reduce the probability of false abnormality alarms, reduce the number of pauses in the grayscale change process, and improve the overall efficiency of the grayscale change process.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to an anomaly detection method, apparatus, device, storage medium, and program. Background Art

[0002] System changes may occur during operation, such as version upgrades, version rollbacks, and changes to system configuration parameters. These changes can introduce significant uncertainty into system operations, potentially leading to deterioration in system performance and even system failures. Therefore, ensuring the security of system changes is crucial.

[0003] For large systems deployed in clusters, a grayscale rollout is often used to minimize the impact of system changes. Grayscale rollouts are also known as multi-stage rollouts. The grayscale rollout process is as follows: First, the change is made on a small number of clusters or machines within a cluster. During the rollout, various metrics are monitored to determine if any abnormalities occur after the system change. If any abnormalities occur, an alarm is generated. In this case, the grayscale rollout is suspended, and professional personnel analyze the anomaly. Once the anomaly is resolved, the grayscale rollout is resumed.

[0004] However, in actual applications, there are often abnormal false alarms, and each abnormal false alarm will cause the grayscale change process to be suspended, making the overall efficiency of the grayscale change process low. Summary of the Invention

[0005] The embodiments of the present application provide an anomaly detection method, apparatus, device, storage medium, and program to reduce false alarms of anomalies during grayscale changes and improve the overall efficiency of the grayscale change process.

[0006] In a first aspect, an embodiment of the present application provides an anomaly detection method, comprising:

[0007] Determining, based on monitoring data of a first operating indicator of the system, whether the first operating indicator exhibits suspected abnormal performance after the first system is changed;

[0008] If there is a suspected abnormal performance, determining the indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator;

[0009] Determining whether the suspected abnormal behavior is a normal behavior of the first system change based on the indicator feature and at least one historical feature stored in a preset database, where the historical feature is used to describe the normal behavior of the first system change;

[0010] If the suspected abnormal behavior does not belong to the normal behavior of the first system change, an alarm message is output.

[0011] In one possible implementation, determining whether the suspected abnormal behavior is a normal behavior of the first system change based on the indicator feature and at least one historical feature stored in a preset database includes:

[0012] Obtaining a first historical feature corresponding to the first operating indicator from a first database, where the first historical feature is used to describe a common performance of the first operating indicator corresponding to different system changes;

[0013] Obtaining a second historical feature corresponding to the first operating indicator from a second database, where the second historical feature is used to describe an expected performance of the first operating indicator corresponding to the first system change;

[0014] Determine whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature, the first historical feature, and the second historical feature.

[0015] In one possible implementation, determining whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature, the first historical feature, and the second historical feature includes:

[0016] determining a first similarity between the indicator feature and the first historical feature, and determining a second similarity between the indicator feature and the second historical feature;

[0017] If at least one of the first similarity and the second similarity is greater than or equal to a preset threshold, it is determined that the suspected abnormal performance is a normal performance of the first system change;

[0018] If both the first similarity and the second similarity are smaller than the preset threshold, it is determined that the suspected abnormal behavior is not a normal behavior of the first system change.

[0019] In one possible implementation, determining whether the suspected abnormal behavior is a normal behavior of the first system change based on the indicator feature and at least one historical feature stored in a preset database includes:

[0020] Obtaining a first historical feature corresponding to the first operating indicator from a first database, where the first historical feature is used to describe a common performance of the first operating indicator corresponding to different system changes;

[0021] determining a first similarity between the indicator feature and the first historical feature;

[0022] If the first similarity is greater than or equal to a preset threshold, determining that the suspected abnormal behavior is a normal behavior of the first system change;

[0023] If the first similarity is less than the preset threshold, it is determined that the suspected abnormal behavior is not a normal behavior of the first system change.

[0024] In a possible implementation, after outputting the alarm information, the following steps are further included:

[0025] receiving instruction information;

[0026] If the indication information indicates that the suspected abnormal performance is a common performance corresponding to different system changes, storing the first operating indicator and the indicator feature in the first database;

[0027] or,

[0028] If the indication information is used to indicate that the suspected abnormal performance is an expected performance corresponding to the first system change, the first operating indicator and the indicator feature are stored in a second database.

[0029] In one possible implementation, determining, based on monitoring data of a first operating indicator of the system, whether the first operating indicator exhibits suspected abnormal behavior after the first system is changed includes:

[0030] Extracting monitoring data of a first time period and monitoring data of a second time period from the monitoring data of the first operating indicator, wherein the first time period is before the first system change and the second time period is after the first system change;

[0031] determining, based on the monitoring data within the first time period, whether the fluctuation type of the first operating indicator is a trending fluctuation type or a non-trending fluctuation type;

[0032] If the fluctuation type of the first operating indicator is a trendless fluctuation type, determining whether the first operating indicator has suspected abnormal performance after the first system change based on the monitoring data in the first time period and the monitoring data in the second time period;

[0033] or,

[0034] If the fluctuation type of the first operating indicator is a trend fluctuation type, the fluctuation trend model of the first operating indicator is determined based on the monitoring data in the first time period, and based on the fluctuation trend model, the monitoring data in the first time period and the monitoring data in the second time period, it is determined whether the first operating indicator has suspected abnormal performance after the first system is changed.

[0035] In one possible implementation, determining whether the first operating indicator has suspected abnormal performance after the first system is changed based on the monitoring data within the first time period and the monitoring data within the second time period includes:

[0036] Determining an indicator value distribution type of the first operating indicator based on the monitoring data within the first time period;

[0037] Determining an indicator value range of the first operating indicator according to the indicator value distribution type;

[0038] If any monitoring data in the second time period exceeds the indicator value range, it is determined that the first operating indicator has suspected abnormal performance after the first system change; or

[0039] If no monitoring data in the monitoring data within the second time period exceeds the indicator value range, it is determined that the first operating indicator does not have any suspected abnormal performance after the first system is changed.

[0040] In one possible implementation, determining whether the first operating indicator has suspected abnormal performance after the first system change based on the fluctuation trend model, the monitoring data in the first time period, and the monitoring data in the second time period includes:

[0041] Determining residual data within the first period based on the fluctuation trend model and the monitoring data within the first period, and determining residual data within the second period based on the fluctuation trend model and the monitoring data within the second period;

[0042] Determining a residual distribution type based on the residual data in the first time period, and determining a residual value range based on the residual distribution type;

[0043] If any residual data in the residual data within the second time period exceeds the residual value range, it is determined that the first operating indicator has suspected abnormal performance after the first system change; or

[0044] If no residual data in the residual data within the second time period exceeds the residual value range, it is determined that the first operating indicator does not have any suspected abnormal performance after the first system is changed.

[0045] In one possible implementation, determining, based on the monitoring data of the first operating indicator, an indicator feature corresponding to the first operating indicator includes:

[0046] Extracting, from the monitoring data of the first operating indicator, monitoring data within a first time period, monitoring data within a second time period, and monitoring data within a third time period, wherein the third time period is a time period corresponding to the execution process of the first system change, the first time period is before the third time period, and the second time period is after the third time period;

[0047] determining a first statistical feature based on the monitoring data within the first time period and the monitoring data within the second time period, where the first statistical feature is used to indicate a difference in an indicator value of the first operating indicator before and after the first system is changed;

[0048] determining a second statistical feature based on the monitoring data within the third time period, wherein the second statistical feature is used to indicate a change in an indicator value of the first operating indicator during the execution of the first system change;

[0049] An indicator feature corresponding to the first operating indicator is determined based on the first statistical feature and the second statistical feature.

[0050] In a second aspect, an embodiment of the present application provides an anomaly detection device, comprising:

[0051] a first determining module, configured to determine, based on monitoring data of a first operating indicator of the system, whether the first operating indicator has suspected abnormal performance after the first system is changed;

[0052] a second determining module, configured to determine, if there is a suspected abnormal performance, an indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator;

[0053] a third determining module, determining whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature and at least one historical feature stored in a preset database, wherein the historical feature is used to describe the normal performance of the first system change;

[0054] An output module is used to output an alarm message if the suspected abnormal behavior does not belong to the normal behavior of the first system change.

[0055] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory and at least one processor, wherein the memory stores a computer program, and the computer program is configured to be executed by the processor to implement the method as described in any one of the first aspects.

[0056] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method as described in any one of the first aspects is implemented.

[0057] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method as described in any one of the first aspects.

[0058] The embodiment of the present application provides an abnormality detection method, apparatus, device, storage medium and program, the method comprising: in each grayscale stage of the first system change, based on the monitoring data of the first operating indicator, determining whether the first operating indicator has suspected abnormal performance after the first system change, if there is suspected abnormal performance, then determining the indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator, and determining whether the suspected abnormal performance belongs to the normal performance of the first system change based on the indicator feature and at least one historical feature stored in a preset database, the historical feature is used to describe the normal performance of the first system change; if the suspected abnormal performance does not belong to the normal performance of the first system change, then outputting an alarm message. It can be seen that after identifying the existence of suspected abnormal performance of the first operating indicator, the present application further identifies whether the suspected abnormal performance belongs to the normal performance of the first system change. Only when it is determined that the suspected abnormal performance does not belong to the normal performance of the first system change, the alarm information is output, so that the probability of abnormal false alarms can be greatly reduced, the number of pauses in the grayscale change process can be reduced, and the overall efficiency of the grayscale change process can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1A A schematic diagram of a grayscale change process provided in an embodiment of the present application;

[0060] Figure 1B A schematic diagram of another grayscale change process provided in an embodiment of the present application;

[0061] Figure 2 A flowchart of an anomaly detection method provided in an embodiment of the present application;

[0062] Figure 3 A flowchart of determining whether a suspected abnormal behavior is a normal behavior of a first system change provided in an embodiment of the present application;

[0063] Figure 4 A schematic diagram of identifying whether a suspected abnormal behavior is a normal behavior of a first system change based on similarity provided in an embodiment of the present application;

[0064] Figure 5 A schematic diagram of another system grayscale change process provided in an embodiment of the present application;

[0065] Figure 6 A schematic diagram of a process for identifying whether a first operating indicator exhibits suspected abnormal performance according to an embodiment of the present application;

[0066] Figure 7 A schematic diagram of the structure of an anomaly detection device provided in an embodiment of the present application;

[0067] Figure 8A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0068] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0069] The terms "first," "second," and the like in the description, claims, and accompanying drawings of the embodiments of the present application are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, such that the embodiments of the present application described herein can be practiced in an order other than that illustrated or described herein.

[0070] It should be understood that the terms "include" and "have" and any variations thereof as used herein are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus that includes a series of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, product or apparatus.

[0071] In the description of the embodiments of the present application, the term "corresponding" may indicate a direct or indirect correspondence between the two, or an association relationship between the two, or a relationship between indication and being indicated, configuration and being configured, etc.

[0072] In order to facilitate understanding of the technical solution of the present application, the concepts and terms involved in the embodiments of the present application are first explained.

[0073] System changes refer to modifications to the system itself, including but not limited to system version upgrades, system version rollbacks, and changes to system configuration parameters. System changes alter some system behaviors. Typically, system changes can be completed while maintaining normal user service.

[0074] Operational indicators refer to parameter data that can reflect the quality / performance of system operation, including but not limited to: read and write latency, resource (such as CPU, memory, I / O, etc.) occupancy information, processing queue length, etc. In the embodiments of the present application, operational indicators can also be referred to as key performance indicators (KPIs).

[0075] Grayscale changes: To minimize the impact of unexpected system changes, changes are typically first implemented on a small number of machines with minimal impact. After a period of observation, if the changes are confirmed to be normal, the scope of the changes is gradually expanded to ensure safety. This process is called a grayscale change.

[0076] Figure 1A This is a schematic diagram of a grayscale change process provided by an embodiment of the present application. Figure 1A As shown, the system can be deployed across multiple machines in a cluster. Considering that system changes can introduce significant uncertainty into system operation, such as deteriorating system performance indicators and potentially causing system failures, to minimize the impact of system changes, the entire cluster system can be gradually modified in phases. Each phase is called a grayscale rollout.

[0077] See also Figure 1A Taking the three grayscale stages as an example, the machines in the cluster can be divided into three groups. In the first grayscale stage, the first group of machines undergoes a change operation and monitors their performance indicators, for example, to see if the indicator values ​​exceed the preset range. If no abnormal indicator performance is detected, the change operation proceeds to the second grayscale stage. In the second grayscale stage, the second group of machines undergoes a change operation and monitors their performance indicators. If no abnormal indicator performance is observed, the change operation proceeds to the third grayscale stage.

[0078] Figure 1B This is a schematic diagram of another grayscale change process provided by an embodiment of the present application. Figure 1B As shown, the system can be deployed in multiple clusters. When making system changes, you can also use the grayscale change method. Figure 1B Taking the three grayscale stages as an example, assuming that the system is deployed on 1,000 clusters, the 1,000 clusters can be divided into three groups, each of which includes multiple clusters. In the first stage, change operations are performed on the first group of clusters, and the indicator performance of the first group of clusters is monitored, for example, whether the indicator value exceeds the preset range. If no abnormal indicator performance is detected, the change operation of the second grayscale stage is continued. In the second grayscale stage, change operations are performed on the second group of clusters, and the indicator performance of the second group of clusters is monitored. If no abnormal indicator performance is observed, the change operation of the third grayscale stage is continued.

[0079] In the above Figure 1A and Figure 1B In each grayscale stage shown, if abnormal performance of an indicator is monitored, the grayscale change process will be suspended, and professionals will analyze the cause of the abnormal indicator. The grayscale change process will be resumed after the abnormality is resolved.

[0080] The applicant of this application has found in actual applications that there are often abnormal false alarms in the above-mentioned grayscale change process, and each abnormal false alarm will cause the grayscale change process to be suspended, making the overall efficiency of the grayscale change process low. In order to solve the above-mentioned technical problems, the applicant has found through further research that in the above-mentioned grayscale change process, anomalies are mainly identified by monitoring the performance of operating indicators. Specifically, if the indicator value of the operating indicator exceeds the preset range, it is considered that an abnormality exists. However, in fact, the system change itself will also cause changes in the performance of the operating indicator.

[0081] This mainly manifests itself in the following two situations:

[0082] Case 1: System changes can cause changes in operational indicators. For example, in a version upgrade scenario, version optimization can reduce resource usage and improve performance. Another example is when a new feature is added to the upgraded version, which consumes more resources.

[0083] Case 2: The actions associated with the system change process can cause changes in the performance of the operating indicators. That is, regardless of the content of the system change, the primary operating indicator will show similar changes each time the system change is executed. For example, a system change may require a reboot, which can cause changes in memory usage.

[0084] The performance of the operating indicators in the two cases described above is actually normal for system changes and does not require professional analysis or a pause in the grayscale change process. However, existing anomaly detection methods would identify the performance of the operating indicators in these two cases as abnormal, resulting in false alarms.

[0085] To this end, the embodiments of the present application provide an anomaly detection method, apparatus, equipment, storage medium and program. In any grayscale stage, when a suspected abnormal performance is detected in a certain operating indicator, it is possible to further identify whether the suspected abnormal performance is a normal performance of the system change. Only when it is determined that the suspected abnormal performance is not a normal performance of the system change, an alarm message is output so that the grayscale change process can be suspended and analyzed by professionals. In the case where the suspected abnormal performance is a normal performance of the system change, there is no need to suspend the grayscale change process. In this way, the probability of abnormal false alarms can be greatly reduced, the number of pauses in the grayscale change process can be reduced, and the overall efficiency of the grayscale change can be improved.

[0086] The technical solutions provided by the embodiments of the present application are described in detail below through specific embodiments. It should be noted that the technical solutions provided by the embodiments of the present application may include part or all of the following contents, and the following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0087] Figure 2 This is a flow chart of an anomaly detection method provided in an embodiment of the present application. Figure 2 As shown, the method of this embodiment includes:

[0088] S201: Determine, based on monitoring data of a first operating indicator of the system, whether the first operating indicator has suspected abnormal performance after the first system is changed.

[0089] The embodiments of the present application can be applied to any grayscale stage of multiple grayscale stages of system change.

[0090] During the current grayscale phase, the acquisition device can monitor the first operating indicator of the machine involved in the grayscale phase change to obtain monitoring data for the first operating indicator. The acquisition device then transmits this monitoring data to the anomaly detection device, which then executes the anomaly detection method provided in this embodiment based on the monitoring data for the first operating indicator. The acquisition device and anomaly detection device can be deployed in the same electronic device or in different electronic devices, and this embodiment does not limit this.

[0091] The system may include multiple operating indicators, including but not limited to: resource occupancy information, read / write latency information, processing queue length, etc. The resource occupancy information includes but is not limited to: central processing unit (CPU) occupancy information, memory occupancy information, input / output (I / O) occupancy information, etc. The first operating indicator may be any one of the multiple operating indicators.

[0092] The monitoring data of the first operating indicator includes: multiple collection moments in the current grayscale stage, and the indicator value corresponding to each collection period. In other words, the monitoring data of the first operating indicator is time series data.

[0093] The existence of suspected abnormal performance of the first operating indicator after the first system is changed means that the indicator value of the first operating indicator after the first system is changed is different from the indicator value before the first system is changed. Exemplarily, the indicator value of the first operating indicator after the first system is changed is significantly improved or significantly reduced compared to the indicator value before the first system is changed. More specifically, if the difference between the indicator value of the first operating indicator after the first system is changed and the indicator value before the first system is changed is greater than or equal to a preset threshold value, it means that the first operating indicator has suspected abnormal performance after the first system is changed. If the difference between the indicator value of the first operating indicator after the first system is changed and the indicator value before the first system is changed is less than the preset threshold value, it means that there is no suspected abnormal performance of the first operating indicator before the first system is changed.

[0094] For example, assuming that the first operating indicator is CPU usage, if the average CPU usage before the first system change is 70% and the average CPU usage after the first system change is 90%, it can be seen that the average CPU usage after the first system change is significantly improved compared with the CPU usage before the first system change. It can be considered that this indicator has suspected abnormal performance after the first system change.

[0095] It should be understood that the purpose of step S201 in this embodiment is to identify abnormal behavior in the first operating indicator. Based on the above analysis, this behavior may be a normal manifestation of the first system change, rather than a true abnormal behavior. Therefore, in this embodiment of the application, the abnormal behavior of the first operating indicator identified in step S201 is referred to as suspected abnormal behavior.

[0096] If it is determined that the first operating indicator exhibits suspected abnormal behavior, the following steps S202 to S204 are executed to further determine whether the suspected abnormal behavior is a true abnormal behavior or a normal behavior of the first system change. It should be understood that if it is determined that the first operating indicator exhibits no suspected abnormal behavior, the subsequent steps S202 to S204 do not need to be executed.

[0097] S202: If there is a suspected abnormal performance, determine the indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator.

[0098] For example, feature extraction can be performed on the monitoring data of the first operating indicator to obtain an indicator feature corresponding to the first operating indicator. The indicator feature reflects the change characteristics of the first operating indicator in the current grayscale stage.

[0099] In a possible time limit method, the indicator feature corresponding to the first operating indicator can be determined in the following manner:

[0100] (1) From the monitoring data of the first operating indicator, the monitoring data within the first time period, the monitoring data within the second time period, and the monitoring data within the third time period are extracted.

[0101] A grayscale phase typically includes three time periods: the period before the first system change is executed, the period corresponding to the execution of the first system change, and the period after the execution of the first system change. In this embodiment, the period corresponding to the execution of the first system change is referred to as the third period, the period before the first system change is referred to as the first period, and the period after the first system change is referred to as the second period. The first period is before the third period, and the second period is after the third period.

[0102] The monitoring data for the first time period includes: multiple first collection moments before the first system change and the indicator value at each first collection moment. The monitoring data for the second time period includes: multiple second collection moments after the first system change and the indicator value at each second collection moment. The monitoring data for the third time period includes: multiple third collection moments during the execution of the first system change and the indicator value at each third collection moment.

[0103] For example, assuming that the time period corresponding to the change operation (ie, the third time period) is 8:00 to 9:00, the first time period may be 7:00 to 7:59, or 7:00 to 7:30, and the second time period may be 9:01 to 10:00, or 9:30 to 10:00.

[0104] (2) Determine a first statistical feature based on the monitoring data in the first time period and the monitoring data in the second time period, where the first statistical feature is used to indicate a difference in the index value of the first operating index before and after the first system is changed.

[0105] Exemplarily, based on the monitoring data in the first time period, the indicator statistical information of the first operating indicator before the first system change is performed, such as the degree of change in the mean, variance, slope, and fluctuation period, etc., is determined. Based on the monitoring data in the second time period, the indicator statistical information of the first operating indicator after the first system change is performed, such as the degree of change in the mean, variance, slope, and fluctuation period, etc., is determined. Furthermore, based on the indicator statistical information of the first operating indicator after the first system change and the indicator statistical information of the first operating indicator before the first system change, a first statistical feature is determined, and the first statistical feature is used to indicate the difference in the indicator value of the first operating indicator before and after the first system change. For example, the difference between the indicator statistical information of the first operating indicator after the first system change and the indicator statistical information of the first operating indicator before the first system change is used as the first statistical feature.

[0106] (3) Determining a second statistical feature based on the monitoring data within the third time period, where the second statistical feature is used to indicate a change in the indicator value of the first operating indicator during the execution of the first system change.

[0107] For example, based on the monitoring data in the third time period, statistical information of indicators during the execution of the first system change, such as mean, variance, slope, number of structural feature mutations, etc., can be determined. These statistical information of indicators during the execution of the first system change is used as the second statistical feature.

[0108] (4) Determine an indicator feature corresponding to the first operating indicator based on the first statistical feature and the second statistical feature.

[0109] Exemplarily, the indicator feature corresponding to the first operating indicator includes: the first statistical feature and the second statistical feature. For example, the first statistical feature and the second statistical feature may be dimensionally concatenated to obtain the indicator feature corresponding to the first operating indicator.

[0110] In this embodiment, the indicator features corresponding to the first operating indicator include both the indicator value difference features before and after the first system change, as well as the indicator value change features during the execution of the first system change, making the indicator features corresponding to the first operating indicator more comprehensive and accurate. Furthermore, in subsequent steps, the indicator features corresponding to the first operating indicator are used to identify whether suspected abnormal performance is a normal manifestation of the first system change, resulting in a highly accurate identification result.

[0111] S203: Determine whether the suspected abnormal behavior is a normal behavior of the first system change based on the indicator feature and at least one historical feature stored in a preset database, where the historical feature is used to describe the normal behavior of the first system change.

[0112] In this embodiment, one or more historical features are stored in the preset database, and the historical features are used to describe the normal performance of the first system change. These historical features can be obtained during the previous system change process, or they can be obtained during the historical grayscale stage of this system change. Each historical feature is used to describe the common performance of different system changes, or to describe the expected performance of the first system change. The indicator feature corresponding to the first operating indicator can be matched with each historical feature stored in the preset database to identify whether the suspected abnormal performance is a normal performance of the first system change.

[0113] S204: If the suspected abnormal behavior does not belong to the normal behavior of the first system change, output an alarm message.

[0114] In this embodiment, the alarm information may be output in any one or more of the following ways: displaying the alarm information, playing the alarm information by voice, and sending the alarm information to a preset device. Optionally, displaying the alarm information may include: displaying the alarm information in a visual manner.

[0115] Optionally, the alarm information may include one or more of the following: an identifier of the first operating indicator, an indicator feature corresponding to the first operating indicator, and monitoring data of the first operating indicator.

[0116] In this embodiment, if the suspected abnormal performance does not belong to the normal performance of the first system change, it is considered that the suspected abnormal performance requires analysis and processing by professionals. Therefore, an alarm message is output in this case to suspend the grayscale change process and allow professionals to analyze the suspected abnormal performance.

[0117] If the suspected abnormal behavior is a normal manifestation of the first system abnormality, it is considered that the suspected abnormal behavior does not require professional analysis and processing. In this case, no alarm information is output, and thus the grayscale change process will not be suspended.

[0118] It should be noted that this embodiment describes the process of detecting anomalies for the first operating indicator. In actual application, the method of this embodiment can be executed separately for each operating indicator of the system. If, after traversing all operating indicators, no alarm information is required for any of them, it means that no anomalies have been detected in the current grayscale stage, and the next grayscale stage can be executed.

[0119] The anomaly detection method provided by this embodiment determines whether the first operating indicator has suspected abnormal performance after the first system change based on the monitoring data of the first operating indicator in each grayscale stage of the first system change. If there is suspected abnormal performance, the indicator feature corresponding to the first operating indicator is determined based on the monitoring data of the first operating indicator, and the indicator feature and at least one historical feature stored in the preset database are used to determine whether the suspected abnormal performance belongs to the normal performance of the first system change. The historical feature is used to describe the normal performance of the first system change; if the suspected abnormal performance does not belong to the normal performance of the first system change, an alarm message is output. It can be seen that after identifying the existence of suspected abnormal performance of the first operating indicator, this embodiment further identifies whether the suspected abnormal performance belongs to the normal performance of the first system change. Only when it is determined that the suspected abnormal performance does not belong to the normal performance of the first system change, the alarm message is output. In this way, the probability of false alarms can be greatly reduced, the number of pauses in the grayscale change process can be reduced, and the overall efficiency of the grayscale change process can be improved.

[0120] In the above Figure 2 Based on the illustrated embodiment, in some possible implementations, in order to facilitate accurate and rapid identification of whether a suspected abnormal behavior is a normal behavior of the first system change in S203, the following two databases may be maintained:

[0121] The first database is used to store the first historical features corresponding to different operating indicators. The number of first historical features corresponding to each operating indicator can be one or more. The first historical feature corresponding to an operating indicator describes the common performance of the operating indicator corresponding to multiple different system changes, or in other words, it describes the expected performance of the operating indicator due to the behavior accompanying the execution process of the system change. The performance of the operating indicator described by the first historical feature is independent of the content of the system change, that is, the same or similar performance will be presented for all system changes. The first historical feature can also be called the common performance of different system changes.

[0122] The second database is used to store the second historical features corresponding to different operating indicators. The number of second historical features corresponding to each operating indicator can be one or more. The second historical feature corresponding to an operating indicator describes the expected performance of the operating indicator corresponding to the first system change (i.e., this system change), or in other words, it describes the expected performance of the operating indicator caused by the content of the first system change. The performance of the operating indicator described by the second historical feature is related to the content of the first system change, that is, for the first system change, the same or similar performance will be presented in its multiple grayscale stages. The second historical feature can also be called the unique expected performance of this system change.

[0123] It can be seen that the above two databases can be used to identify the normal performance of the first system change, wherein the first database can be used to identify the common performance of different system changes, and the second database can be used to identify the expected performance of the first system change. Therefore, in S203 of the above embodiment, a comparison with the above two databases can be used to determine whether the suspected abnormal performance belongs to the normal performance of the first system change. Figure 3 Give an example.

[0124] Figure 3 The flowchart of determining whether the suspected abnormal performance is a normal performance of the first system change is provided in the embodiment of the present application. The method of this embodiment can be used as a possible implementation of S203. Figure 3 As shown, the method of this embodiment includes:

[0125] S301: Acquire a first historical feature corresponding to the first operating indicator from a first database, where the first historical feature is used to describe common performance of the first operating indicator corresponding to different system changes.

[0126] In this embodiment, the first historical feature corresponding to the first operating indicator may or may not exist in the first database. The identifier of the first operating indicator can be used to query the first database for the presence of the first historical feature corresponding to the first operating indicator. If so, the first historical feature corresponding to the first operating indicator can be retrieved from the first database. The number of first historical features retrieved may be one or more. If the first historical feature corresponding to the first operating indicator does not exist in the first database, the first historical feature retrieved in this step can be considered empty.

[0127] S302: Acquire a second historical feature corresponding to the first operating indicator from a second database, where the second historical feature is used to describe an expected performance of the first operating indicator corresponding to the first system change.

[0128] In this embodiment, the second historical feature corresponding to the first operating indicator may or may not exist in the second database. The identifier of the first operating indicator can be used to query the second database for the presence of the second historical feature corresponding to the first operating indicator. If so, the second historical feature corresponding to the first operating indicator can be retrieved from the second database. The number of retrieved second historical features may be one or more. If the second historical feature corresponding to the first operating indicator does not exist in the second database, the second historical feature retrieved in this step can be considered empty.

[0129] In this way, whether the suspected abnormal behavior is a normal behavior of the first system change can be determined based on the indicator feature corresponding to the first operating indicator, the first historical feature, and the second historical feature. For details, please refer to the detailed description of S303 to S306.

[0130] S303: Determine a first similarity between the indicator feature corresponding to the first operating indicator and the first historical feature, and determine a second similarity between the indicator feature corresponding to the first operating indicator and the second historical feature.

[0131] Exemplarily, when the first historical feature is empty, it can be determined that the first similarity is infinite.

[0132] When the number of the first historical feature is one, the first similarity may be determined according to the distance between the indicator feature and the first historical feature.

[0133] When there are multiple first historical features, the first similarity can be determined using any of the following methods:

[0134] Method 1 uses a K-nearest neighbor distance method, where K first historical features closest to the indicator feature are determined from among the multiple first historical features, and a first similarity is determined based on the distances between the indicator feature and the K first historical features.

[0135] Method 2 uses an average distance method. The distance between the indicator feature and each first historical feature is calculated separately to obtain multiple distances. The average of the multiple distances is calculated to obtain the first similarity.

[0136] It should be understood that the second similarity is determined in a similar manner to the first similarity, and is not described in detail here.

[0137] S304: If at least one of the first similarity and the second similarity is greater than or equal to a preset threshold, determine that the suspected abnormal behavior is a normal behavior of the first system change.

[0138] Exemplarily, if the first similarity is greater than or equal to a preset threshold, it is determined that the suspected abnormal behavior is a normal behavior of the first system change; or, if the second similarity is greater than or equal to the preset threshold, it is determined that the suspected abnormal behavior is a normal behavior of the first system change; or, if the first similarity is greater than or equal to the preset threshold and the second similarity is greater than or equal to the preset threshold, it is determined that the suspected abnormal behavior is a normal behavior of the first system change.

[0139] S305: If both the first similarity and the second similarity are smaller than the preset threshold, it is determined that the suspected abnormal behavior is not a normal behavior of the first system change.

[0140] Exemplarily, if the first similarity is less than a preset threshold and the second similarity is less than a preset threshold, it indicates that the suspected abnormal behavior is neither a common behavior of different system changes nor an expected behavior of the first system change. Therefore, it is determined that the suspected abnormal behavior is not a normal behavior of the first system change.

[0141] The following combination Figure 4 Give an example. Figure 4 This is a schematic diagram of an embodiment of the present application for identifying whether a suspected abnormal performance is a normal performance of the first system change based on similarity. Figure 4 As shown, each triangle represents a first historical feature, that is, 7 first historical features are obtained from the first database. Each five-pointed star represents a second historical feature, that is, 6 second historical features are obtained from the second database. The circle represents the indicator feature corresponding to the first operating indicator.

[0142] Taking K=3 nearest neighbors as an example, the three first historical features closest to the indicator feature are selected from the multiple first historical features, and the first similarity is determined based on the sum (or average) of the distances between the indicator feature and the three first historical features. The three second historical features closest to the indicator feature are selected from the multiple second historical features, and the second similarity is determined based on the sum (or average) of the distances between the indicator feature and the three second historical features. Figure 4 In the example shown, since the first similarity is less than the preset threshold and the second similarity is greater than or equal to the preset threshold, it indicates that the suspected abnormal behavior is a common manifestation of different system changes. Therefore, it is determined that the suspected abnormal behavior is a normal manifestation of the first system change.

[0143] In this embodiment, by matching indicator features with the first database and the second database, it is possible to identify whether the suspected abnormal performance is a normal performance of the first system change. There is no need to pre-train the recognition model, the implementation is simple, and the accuracy is high.

[0144] In some possible implementations, the data stored in the first database may be accumulated over the course of historical system changes. The historical system changes refer to other system changes executed before the first system change. The content of the changes corresponding to the historical system changes may be the same as or different from the content of the changes corresponding to the first system change.

[0145] In some possible implementations, the data stored in the second database may be accumulated over the historical grayscale stages of the first system change. The historical grayscale stages refer to grayscale stages of the first system change that precede the current grayscale stage. The changes corresponding to the historical grayscale stages are the same as those corresponding to the current grayscale stage. It should be understood that during the first grayscale stage of the first system change, the second database is empty.

[0146] The following combination Figure 5 This article provides an example to illustrate the complete anomaly detection process in system grayscale changes.

[0147] Figure 5 This is a schematic diagram of another system grayscale change process provided by the embodiment of the present application. Figure 5 As shown, three grayscale stages are taken as an example for explanation.

[0148] (1) Grayscale stage 1.

[0149] Based on the monitoring data of the first operating indicator, determine whether the first operating indicator exhibits suspected abnormal performance after the system change. If suspected abnormal performance is determined, determine an indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator. Obtain a first historical feature corresponding to the first operating indicator from a first database. Determine a first similarity between the indicator feature and the first historical feature.

[0150] If the first similarity is greater than or equal to the preset threshold, it is determined that the suspected abnormal behavior is a normal behavior of this system change (i.e., a common normal behavior of different system changes). In this case, there is no need to output an alarm message or suspend the grayscale change process.

[0151] If the first similarity is less than a preset threshold, the suspected abnormal behavior is determined to be not normal for this system change. In this case, an alarm message is output to suspend the grayscale change process so that professionals can conduct an abnormality analysis and determine the cause of the suspected abnormal behavior.

[0152] It should be understood that in the first grayscale phase, the second database is empty. Therefore, when identifying whether a suspected abnormal behavior is a normal behavior of this system change, it is only necessary to match it with the first database.

[0153] Furthermore, after outputting the alarm information, it also includes: receiving indication information, where the indication information is used to indicate that the suspected abnormal performance is a common performance corresponding to different system changes, or to indicate that the suspected abnormal performance is an expected performance corresponding to this system change.

[0154] If the indication information indicates that the suspected abnormal performance is a common performance corresponding to different system changes, the first operating indicator and the indicator feature corresponding to the first operating indicator are stored in the first database. Alternatively, if the indication information indicates that the suspected abnormal performance is an expected performance corresponding to the current system change, the first operating indicator and the indicator feature corresponding to the first operating indicator are stored in the second database.

[0155] Exemplarily, the above-mentioned indication information may be input to the abnormality detection device after professionals analyze the suspected abnormal performance and determine that the suspected abnormal performance is a common performance corresponding to different system changes, or is an expected performance corresponding to this system change.

[0156] (2) Grayscale stage 2.

[0157] Based on the monitoring data of the first operating indicator, determine whether the first operating indicator exhibits suspected abnormal performance after the system change. If suspected abnormal performance is determined, determine an indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator. Obtain a first historical feature corresponding to the first operating indicator from a first database, and obtain a second historical feature corresponding to the second operating indicator from a second database. Determine a first similarity between the indicator feature and the first historical feature, and determine a second similarity between the indicator feature and the second historical feature.

[0158] If at least one of the first similarity and the second similarity is greater than or equal to a preset threshold, the suspected abnormal behavior is determined to be a normal behavior of the current system change (i.e., the suspected abnormal behavior is a common behavior of different system changes, or is an expected behavior of the current system change). In this case, there is no need to output an alarm message or pause the grayscale change process.

[0159] If both the first and second similarities are less than a preset threshold, the suspected abnormal behavior is determined to be not a normal behavior for this system change. In this case, an alarm message is output to suspend the grayscale change process so that professionals can conduct an abnormality analysis and determine the cause of the suspected abnormal behavior.

[0160] Furthermore, after outputting the alarm information, it also includes: receiving indication information, where the indication information is used to indicate that the suspected abnormal performance is a common performance corresponding to different system changes, or to indicate that the suspected abnormal performance is an expected performance corresponding to this system change.

[0161] If the indication information indicates that the suspected abnormal performance is a common performance corresponding to different system changes, the first operating indicator and the indicator feature corresponding to the first operating indicator are stored in the first database. Alternatively, if the indication information indicates that the suspected abnormal performance is an expected performance corresponding to the current system change, the first operating indicator and the indicator feature corresponding to the first operating indicator are stored in the second database.

[0162] (3) Grayscale stage 3.

[0163] It should be understood that the specific implementation process of grayscale stage 3 is similar to that of grayscale stage 2 and will not be repeated here.

[0164] In this embodiment, by continuously accumulating the common performance of the operating indicators found in each system change into the first database, and continuously accumulating the expected performance of the operating indicators found in each grayscale stage during this system change into the second database, in subsequent system changes / subsequent grayscale stages, the first database and the second database can be used to identify whether the suspected abnormal performance is the normal performance of this system change. In this way, the probability of abnormal false alarms can be effectively reduced, the number of pauses in the grayscale change process can be reduced, and the overall efficiency of the grayscale change process can be improved. It should be understood that when using the abnormality detection method of this embodiment, although there may be abnormal false alarms in the initial grayscale stage, as the second database is continuously improved, the false alarms in the subsequent grayscale stages will be greatly reduced. In this way, as the number of grayscale stages experienced increases, the abnormality identification results will become more and more accurate, and the abnormal false alarms will become less and less.

[0165] Based on any of the above embodiments, Figure 6 Describe in detail how to determine whether the first operating indicator has suspected abnormal performance.

[0166] Figure 6 This is a flow chart of identifying whether the first operating indicator has suspected abnormal performance provided by the embodiment of the present application. Figure 2 A possible implementation of S201 in the embodiment shown is shown. Figure 6 As shown, the method of this embodiment includes:

[0167] S601: Extract monitoring data within a first time period and monitoring data within a second time period from monitoring data of a first operating indicator, wherein the first time period is before a first system change and the second time period is after the first system change.

[0168] The monitoring data in the first period includes: multiple first collection moments before the first system change and the index value at each first collection moment. The monitoring data in the second period includes: multiple second collection moments after the first system change and the index value at each second collection moment.

[0169] S602: Determine, based on monitoring data within a first time period, whether the fluctuation type of the first operating indicator is a trend fluctuation type or a non-trend fluctuation type.

[0170] Exemplarily, a trend test algorithm can be used to process the monitoring data within the first time period to determine whether the fluctuation type of the first operating indicator is a trend fluctuation type or a non-trend fluctuation type. Optionally, the above-mentioned trend test algorithm can be a Mann-Kendall trend test algorithm. The trend fluctuation type refers to the fact that the indicator value of the operating indicator fluctuates according to a certain pattern over time. The non-trend fluctuation type refers to the fact that the indicator value of the operating indicator does not fluctuate according to a certain pattern over time.

[0171] S603: If the fluctuation type of the first operating indicator is a trendless fluctuation type, determine whether the first operating indicator has suspected abnormal performance after the first system is changed based on the monitoring data in the first time period and the monitoring data in the second time period.

[0172] In this embodiment, for the non-trend fluctuation type, it can be determined whether there is suspected abnormal performance based on the distribution of the monitoring data in the first time period and the monitoring data in the second time period.

[0173] In one possible implementation, the indicator value distribution type of the first operating indicator can be determined based on the monitoring data in the first time period. Exemplarily, the KS (Kolmogorov Smirnov) verification algorithm can be used to process the monitoring data in the first time period to obtain the indicator value distribution type of the first operating indicator. The indicator distribution type includes but is not limited to one of the following: normal distribution, beta distribution, Poisson distribution, etc. Furthermore, based on the indicator value distribution type, the indicator value range of the first operating indicator is determined. By comparing the monitoring data in the second time period with the above-mentioned indicator value range, it is determined whether the first operating indicator has suspected abnormal performance.

[0174] Exemplarily, if any monitoring data in the second time period exceeds the indicator value range, that is, the indicator values ​​at one or more second collection moments in the monitoring data in the second time period exceed the indicator value range, then it is determined that the first operating indicator has suspected abnormal performance. If no monitoring data in the second time period exceeds the indicator value range, that is, the indicator values ​​at all second collection moments in the second time period do not exceed the indicator value range, then it is determined that the first operating indicator has no suspected abnormal performance.

[0175] S604: If the fluctuation type of the first operating indicator is a trend fluctuation type, determine the fluctuation trend model of the first operating indicator based on the monitoring data in the first time period, and determine whether the first operating indicator has suspected abnormal performance after the first system is changed based on the fluctuation trend model, the monitoring data in the first time period, and the monitoring data in the second time period.

[0176] In this embodiment, for trended fluctuations, a fluctuation trend model for the first operating indicator can be obtained by performing trend fitting on the monitoring data within the first time period. Furthermore, based on this fluctuation trend model, the monitoring data within the first time period and the monitoring data within the second time period are processed into residual data for trendless fluctuations. Based on this residual data, it is then determined whether the first operating indicator exhibits suspected abnormal behavior.

[0177] In one possible implementation, the residual data within the first time period can be determined based on the fluctuation trend model and the monitoring data within the first time period, and the residual data within the second time period can be determined based on the fluctuation trend model and the monitoring data within the second time period. In this way, the residual data within the first time period is trendless data, and the residual data within the second time period is trendless data. Furthermore, the residual distribution type is determined based on the residual data within the first time period, and the residual value range is determined based on the residual distribution type. By comparing the residual data within the second time period with the residual value range, it is determined whether the first operating indicator has suspected abnormal performance.

[0178] Exemplarily, if any residual data in the residual data within the second time period exceeds the residual value range, it is determined that the first operating indicator has suspected abnormal performance. If no residual data in the residual data within the second time period exceeds the residual value range, it is determined that the first operating indicator has no suspected abnormal performance.

[0179] In this embodiment, suspected abnormal performance is identified based on the monitoring data in the first time period (i.e., the time period before the change operation) and the monitoring data in the second time period (i.e., the time period after the change operation). Its essence is to identify suspected abnormal performance based on the difference in the first operating indicator before and after the change operation. This is different from the related technology of identifying suspected abnormal performance based on the changes in the indicator values ​​during the execution of the change operation. This can improve the accuracy of the identification results, thereby further reducing the probability of false alarms.

[0180] The above describes the anomaly detection method provided by the embodiment of the present application. The following describes the anomaly detection device provided by the embodiment of the present application.

[0181] The embodiments of the present application can divide the abnormality detection device into functional modules according to the above method embodiments. For example, each functional module can be divided into corresponding functional modules, or two or more functions can be integrated into a single processing module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0182] It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. In actual implementation, there may be other division methods. The following uses the example of dividing each functional module according to each function to illustrate.

[0183] Figure 7 This is a schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application. Figure 7 As shown, the anomaly detection device 700 provided in this embodiment includes: a first determination module 701 , a second determination module 702 , a third determination module 703 and an output module 704 .

[0184] The first determining module 701 is configured to determine, based on monitoring data of a first operating indicator of the system, whether the first operating indicator has a suspected abnormal performance after the first system is changed;

[0185] A second determining module 702 is configured to determine, if there is a suspected abnormal performance, an indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator;

[0186] A third determining module 703 determines whether the suspected abnormal behavior is a normal behavior of the first system change based on the indicator feature and at least one historical feature stored in a preset database, where the historical feature is used to describe the normal behavior of the first system change;

[0187] The output module 704 is configured to output an alarm message if the suspected abnormal behavior does not belong to the normal behavior of the first system change.

[0188] In a possible implementation, the third determining module 703 is specifically configured to:

[0189] Obtaining a first historical feature corresponding to the first operating indicator from a first database, where the first historical feature is used to describe a common performance of the first operating indicator corresponding to different system changes;

[0190] Obtaining a second historical feature corresponding to the first operating indicator from a second database, where the second historical feature is used to describe an expected performance of the first operating indicator corresponding to the first system change;

[0191] Determine whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature, the first historical feature, and the second historical feature.

[0192] In a possible implementation, the third determining module 703 is specifically configured to:

[0193] determining a first similarity between the indicator feature and the first historical feature, and determining a second similarity between the indicator feature and the second historical feature;

[0194] If at least one of the first similarity and the second similarity is greater than or equal to a preset threshold, it is determined that the suspected abnormal performance is a normal performance of the first system change;

[0195] If both the first similarity and the second similarity are smaller than the preset threshold, it is determined that the suspected abnormal behavior is not a normal behavior of the first system change.

[0196] In a possible implementation, the third determining module 703 is specifically configured to:

[0197] Obtaining a first historical feature corresponding to the first operating indicator from a first database, where the first historical feature is used to describe a common performance of the first operating indicator corresponding to different system changes;

[0198] determining a first similarity between the indicator feature and the first historical feature;

[0199] If the first similarity is greater than or equal to a preset threshold, determining that the suspected abnormal behavior is a normal behavior of the first system change;

[0200] If the first similarity is less than the preset threshold, it is determined that the suspected abnormal behavior is not a normal behavior of the first system change.

[0201] In a possible implementation, the device further includes: a receiving module;

[0202] A receiving module, configured to receive instruction information;

[0203] a storage module, configured to store the first operating indicator and the indicator feature in the first database if the indication information indicates that the suspected abnormal performance is a common performance corresponding to different system changes;

[0204] or,

[0205] If the indication information is used to indicate that the suspected abnormal performance is an expected performance corresponding to the first system change, the first operating indicator and the indicator feature are stored in a second database.

[0206] In a possible implementation, the first determining module 701 is specifically configured to:

[0207] Extracting monitoring data of a first time period and monitoring data of a second time period from the monitoring data of the first operating indicator, wherein the first time period is before the first system change and the second time period is after the first system change;

[0208] determining, based on the monitoring data within the first time period, whether the fluctuation type of the first operating indicator is a trending fluctuation type or a non-trending fluctuation type;

[0209] If the fluctuation type of the first operating indicator is a trendless fluctuation type, determining whether the first operating indicator has suspected abnormal performance after the first system change based on the monitoring data in the first time period and the monitoring data in the second time period;

[0210] or,

[0211] If the fluctuation type of the first operating indicator is a trend fluctuation type, the fluctuation trend model of the first operating indicator is determined based on the monitoring data in the first time period, and based on the fluctuation trend model, the monitoring data in the first time period and the monitoring data in the second time period, it is determined whether the first operating indicator has suspected abnormal performance after the first system is changed.

[0212] In a possible implementation, the first determining module 701 is specifically configured to:

[0213] Determining an indicator value distribution type of the first operating indicator based on the monitoring data within the first time period;

[0214] Determining an indicator value range of the first operating indicator according to the indicator value distribution type;

[0215] If any monitoring data in the second time period exceeds the indicator value range, it is determined that the first operating indicator has suspected abnormal performance after the first system change; or

[0216] If no monitoring data in the monitoring data within the second time period exceeds the indicator value range, it is determined that the first operating indicator does not have any suspected abnormal performance after the first system is changed.

[0217] In a possible implementation, the first determining module 701 is specifically configured to:

[0218] Determining residual data within the first period based on the fluctuation trend model and the monitoring data within the first period, and determining residual data within the second period based on the fluctuation trend model and the monitoring data within the second period;

[0219] Determining a residual distribution type based on the residual data in the first time period, and determining a residual value range based on the residual distribution type;

[0220] If any residual data in the residual data within the second time period exceeds the residual value range, it is determined that the first operating indicator has suspected abnormal performance after the first system change; or

[0221] If no residual data in the residual data within the second time period exceeds the residual value range, it is determined that the first operating indicator does not have any suspected abnormal performance after the first system is changed.

[0222] In a possible implementation, the second determining module 702 is specifically configured to:

[0223] Extracting, from the monitoring data of the first operating indicator, monitoring data within a first time period, monitoring data within a second time period, and monitoring data within a third time period, wherein the third time period is a time period corresponding to the execution process of the first system change, the first time period is before the third time period, and the second time period is after the third time period;

[0224] determining a first statistical feature based on the monitoring data within the first time period and the monitoring data within the second time period, where the first statistical feature is used to indicate a difference in an indicator value of the first operating indicator before and after the first system is changed;

[0225] determining a second statistical feature based on the monitoring data within the third time period, wherein the second statistical feature is used to indicate a change in an indicator value of the first operating indicator during the execution of the first system change;

[0226] An indicator feature corresponding to the first operating indicator is determined based on the first statistical feature and the second statistical feature.

[0227] The anomaly detection device provided in this embodiment can execute the anomaly detection method provided in any of the above method embodiments. Its implementation principles and technical effects are similar and will not be described in detail here.

[0228] Figure 8 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present application. Figure 8 As shown, the electronic device 800 provided in this embodiment includes: a memory 801 and at least one processor 802; the memory 801 stores a computer program, and the computer program is configured to be executed by the processor 802 to implement the anomaly detection method provided by any of the above method embodiments. The implementation principles and technical effects are similar and will not be repeated here.

[0229] Optionally, the memory 801 can be independent or integrated with the processor 802. When the memory 801 is a device independent of the processor 802, the electronic device 800 further includes a bus 803 for connecting the memory 801 and the processor 802.

[0230] An embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored. The computer program is executed by a processor to implement an anomaly detection method as provided in any of the aforementioned method embodiments. The implementation principles and technical effects are similar and are not described in detail here.

[0231] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the anomaly detection method provided by any of the aforementioned method embodiments. The implementation principles and technical effects are similar and are not described in detail here.

[0232] An embodiment of the present application further provides a chip including: a memory and a processor, wherein the memory stores a computer program, and the processor runs the computer program to implement the anomaly detection method provided by any of the above method embodiments. The implementation principles and technical effects are similar and will not be repeated here.

[0233] It should be understood that the processor described above may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), or application-specific integrated circuits (ASICs). A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly executed by a hardware processor or by a combination of hardware and software modules within the processor.

[0234] The memory may include a high-speed RAM memory, and may also include non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk.

[0235] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be classified into address buses, data buses, and control buses. For ease of illustration, the buses in the drawings of this application are not limited to just one bus or just one type of bus.

[0236] The storage medium may be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium may be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0237] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be an integral part of the processor. The processor and storage medium can be located in an application-specific integrated circuit (ASIC). Of course, the processor and storage medium can also exist as discrete components in an electronic device.

[0238] Those skilled in the art will appreciate that all or part of the steps in the above-described method embodiments can be implemented using hardware associated with program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0239] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting anomalies, characterized in that: include: Determining, based on monitoring data of a first operating indicator of the system, whether the first operating indicator exhibits suspected abnormal performance after the first system is changed; If there is a suspected abnormal performance, determining the indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator; Determining whether the suspected abnormal behavior is a normal behavior of the first system change based on the indicator feature and at least one historical feature stored in a preset database, where the historical feature is used to describe the normal behavior of the first system change; If the suspected abnormal behavior does not belong to the normal behavior of the first system change, output an alarm message; Determining, based on monitoring data of a first operating indicator of the system, whether the first operating indicator exhibits suspected abnormal performance after the first system is changed includes: Extracting, from the monitoring data of the first operating indicator, monitoring data within a first time period and monitoring data within a second time period, where the first time period is before the first system change and the second time period is after the first system change; determining, based on the monitoring data within the first time period, whether a fluctuation type of the first operating indicator is a trending fluctuation type or a non-trending fluctuation type; If the fluctuation type of the first operating indicator is a trendless fluctuation type, determine whether the first operating indicator has suspected abnormal performance after the first system is changed based on the monitoring data in the first time period and the monitoring data in the second time period; or, if the fluctuation type of the first operating indicator is a trend fluctuation type, determine the fluctuation trend model of the first operating indicator based on the monitoring data in the first time period, and determine whether the first operating indicator has suspected abnormal performance after the first system is changed based on the fluctuation trend model, the monitoring data in the first time period, and the monitoring data in the second time period.

2. The method according to claim 1, characterized in that Determining whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature and at least one historical feature stored in a preset database includes: Obtaining a first historical feature corresponding to the first operating indicator from a first database, where the first historical feature is used to describe a common performance of the first operating indicator corresponding to different system changes; Obtaining a second historical feature corresponding to the first operating indicator from a second database, where the second historical feature is used to describe an expected performance of the first operating indicator corresponding to the first system change; Determine whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature, the first historical feature, and the second historical feature.

3. The method according to claim 2, characterized in that Determining whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature, the first historical feature, and the second historical feature includes: determining a first similarity between the indicator feature and the first historical feature, and determining a second similarity between the indicator feature and the second historical feature; If at least one of the first similarity and the second similarity is greater than or equal to a preset threshold, it is determined that the suspected abnormal performance is a normal performance of the first system change; If both the first similarity and the second similarity are smaller than the preset threshold, it is determined that the suspected abnormal behavior is not a normal behavior of the first system change.

4. The method according to claim 1, wherein Determining whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature and at least one historical feature stored in a preset database includes: Obtaining a first historical feature corresponding to the first operating indicator from a first database, where the first historical feature is used to describe a common performance of the first operating indicator corresponding to different system changes; determining a first similarity between the indicator feature and the first historical feature; If the first similarity is greater than or equal to a preset threshold, determining that the suspected abnormal behavior is a normal behavior of the first system change; If the first similarity is less than the preset threshold, it is determined that the suspected abnormal behavior is not a normal behavior of the first system change.

5. The method according to any one of claims 2 to 4, characterized in that After outputting the alarm information, it also includes: receiving instruction information; If the indication information indicates that the suspected abnormal performance is a common performance corresponding to different system changes, storing the first operating indicator and the indicator feature in the first database; or, If the indication information is used to indicate that the suspected abnormal performance is an expected performance corresponding to the first system change, the first operating indicator and the indicator feature are stored in a second database.

6. The method according to any one of claims 1 to 4, characterized in that Determining whether the first operating indicator has suspected abnormal performance after the first system change based on the monitoring data within the first time period and the monitoring data within the second time period includes: Determining an indicator value distribution type of the first operating indicator based on the monitoring data within the first time period; Determining an indicator value range of the first operating indicator according to the indicator value distribution type; If any monitoring data in the second time period exceeds the indicator value range, it is determined that the first operating indicator has suspected abnormal performance after the first system change; or If no monitoring data in the monitoring data within the second time period exceeds the indicator value range, it is determined that the first operating indicator does not have any suspected abnormal performance after the first system is changed.

7. The method according to any one of claims 1 to 4, characterized in that Determining whether the first operating indicator has suspected abnormal performance after the first system change based on the fluctuation trend model, the monitoring data in the first time period, and the monitoring data in the second time period includes: Determining residual data within the first period based on the fluctuation trend model and the monitoring data within the first period, and determining residual data within the second period based on the fluctuation trend model and the monitoring data within the second period; Determining a residual distribution type based on the residual data in the first time period, and determining a residual value range based on the residual distribution type; If any residual data in the residual data within the second time period exceeds the residual value range, it is determined that the first operating indicator has suspected abnormal performance after the first system change; or If no residual data in the residual data within the second time period exceeds the residual value range, it is determined that the first operating indicator does not have any suspected abnormal performance after the first system is changed.

8. The method according to any one of claims 1 to 4, characterized in that Determining, based on the monitoring data of the first operating indicator, an indicator feature corresponding to the first operating indicator, includes: Extracting, from the monitoring data of the first operating indicator, monitoring data within a first time period, monitoring data within a second time period, and monitoring data within a third time period, wherein the third time period is a time period corresponding to the execution process of the first system change, the first time period is before the third time period, and the second time period is after the third time period; determining a first statistical feature based on the monitoring data within the first time period and the monitoring data within the second time period, where the first statistical feature is used to indicate a difference in an indicator value of the first operating indicator before and after the first system is changed; determining a second statistical feature based on the monitoring data within the third time period, wherein the second statistical feature is used to indicate a change in an indicator value of the first operating indicator during the execution of the first system change; An indicator feature corresponding to the first operating indicator is determined based on the first statistical feature and the second statistical feature.

9. An abnormality detection device, characterized in that: include: a first determining module, configured to determine, based on monitoring data of a first operating indicator of the system, whether the first operating indicator has suspected abnormal performance after the first system is changed; a second determining module, configured to determine, if there is a suspected abnormal performance, an indicator feature corresponding to the first operating indicator based on the monitoring data of the first operating indicator; a third determining module, determining whether the suspected abnormal performance is a normal performance of the first system change based on the indicator feature and at least one historical feature stored in a preset database, wherein the historical feature is used to describe the normal performance of the first system change; an output module, configured to output an alarm message if the suspected abnormal behavior does not correspond to a normal behavior of the first system change; The first determining module is specifically configured to: Extracting, from the monitoring data of the first operating indicator, monitoring data within a first time period and monitoring data within a second time period, where the first time period is before the first system change and the second time period is after the first system change; determining, based on the monitoring data within the first time period, whether a fluctuation type of the first operating indicator is a trending fluctuation type or a non-trending fluctuation type; If the fluctuation type of the first operating indicator is a trendless fluctuation type, determine whether the first operating indicator has suspected abnormal performance after the first system is changed based on the monitoring data in the first time period and the monitoring data in the second time period; or, if the fluctuation type of the first operating indicator is a trend fluctuation type, determine the fluctuation trend model of the first operating indicator based on the monitoring data in the first time period, and determine whether the first operating indicator has suspected abnormal performance after the first system is changed based on the fluctuation trend model, the monitoring data in the first time period, and the monitoring data in the second time period.

10. An electronic device, characterized in that: include: memory and at least one processor; A computer program is stored in the memory, and the computer program is configured to be executed by the at least one processor to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that The method comprises a computer program, which implements the method according to any one of claims 1 to 8 when the computer program is executed by a processor.

Images