Method, electronic device and computer program product for training a model

Abstract

Embodiments of the present disclosure relate to a method, an electronic device, and a computer program product for training a model. The method includes obtaining a test set and a training set for training a model, the test set and the training set each including workload data associated with normal storage devices and workload data associated with abnormal storage devices; training a device detection model using the training set, the device detection model being used to classify a storage device as a normal storage device or an abnormal storage device according to a threshold degree, the threshold degree being within a range; determining a test result by applying the test set to the device detection model; and updating the range of the threshold degree if it is determined that the test result indicates that a performance of the device detection model does not reach a threshold performance. Through the method, a storage device can be accurately detected by the trained model.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure relate to the field of data management, and more particularly, to a method for training a model, an electronic device and a computer program product. BACKGROUND

[0002] With the development of information technology, more and more data is generated. The increase of data volume poses great challenges to the management of data, especially the storage of data. Abnormal storage device detection is a crucial aspect in the field of data storage, which makes it possible to discover abnormal storage devices in time and prevent the abnormal devices from affecting the storage system. However, there are many problems in the detection process of abnormal devices, for example, the accuracy of detection needs to be improved. SUMMARY

[0003] Embodiments of the present disclosure provide a method for training a model, an electronic device and a computer program product.

[0004] According to a first aspect of the present disclosure, a method for training a model is provided. The method comprises: obtaining a test set and a training set for training the model, the test set and the training set each comprising workload data associated with normal storage devices and workload data associated with abnormal storage devices; training a device detection model with the training set, the device detection model being used to classify a storage device as a normal storage device or an abnormal storage device according to a threshold degree, the threshold degree being in a range; determining a test result by applying the test set to the device detection model; and updating the range of the threshold degree if it is determined that the test result indicates that the performance of the device detection model does not reach a threshold performance.

[0005] According to a second aspect of the present disclosure, a method for processing data is provided. The method comprises: obtaining workload data associated with a storage device, the workload data comprising at least one of data access pattern and data access performance; and determining a detection result for the workload data by using a device detection model trained according to the method of the first aspect, the detection result indicating whether the storage device is an abnormal storage device.

[0006] According to a third aspect of the present disclosure, an electronic device is provided. The electronic device includes at least one processor; and a memory coupled to the at least one processor and having stored thereon instructions that, when executed by the at least one processor, cause the device to perform actions including: obtaining a test set and a training set for training a model, the test set and the training set each including workload data associated with normal storage devices and workload data associated with abnormal storage devices; training a device detection model with the training set, the device detection model being used to classify a storage device as a normal storage device or an abnormal storage device according to a threshold degree, the threshold degree being within a range; determining a test result by applying the test set to the device detection model; and updating the range of the threshold degree if it is determined that the test result indicates that a performance of the device detection model does not reach a threshold performance.

[0007] According to a fourth aspect of the present disclosure, an electronic device is provided. The electronic device includes at least one processor; and a memory coupled to the at least one processor and having stored thereon instructions that, when executed by the at least one processor, cause the device to perform actions including: obtaining workload data associated with a storage device, the workload data including at least one of data access patterns and data access performance; and determining a detection result for the workload data using a device detection model trained according to the electronic device of the third aspect, the detection result indicating whether the storage device is an abnormal storage device.

[0008] According to a fifth aspect of the present disclosure, a computer program product is provided, tangibly stored on a non-transitory computer readable medium and comprising machine executable instructions that, when executed by a machine, cause the machine to perform the steps of the method of the first aspect of the present disclosure.

[0009] According to a sixth aspect of the present disclosure, a computer program product is provided, tangibly stored on a non-transitory computer readable medium and comprising machine executable instructions that, when executed by a machine, cause the machine to perform the steps of the method of the second aspect of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0010] The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which like reference characters refer to like parts throughout the figures, and in which:

[0011] Figure 1 A schematic diagram illustrating an example of a data processing environment 100 in which some embodiments of the present disclosure can be implemented is shown;

[0012] Figure 2A schematic diagram showing an example of a training model environment 200 in which some embodiments of the present disclosure can be implemented is shown;

[0013] Figure 3 A flowchart showing an example method 300 for training a model according to some embodiments of the present disclosure is shown;

[0014] Figure 4 A flowchart showing an example method 400 for processing data according to some embodiments of the present disclosure is shown;

[0015] Figure 5 A schematic diagram showing a relationship 500 between a threshold degree and a first probability and a second probability according to some embodiments of the present disclosure is shown; and

[0016] Figure 6 A schematic block diagram showing an example device 600 that can be used to implement embodiments of the present disclosure is shown.

[0017] In the various drawings, like or corresponding elements are denoted by like or corresponding reference numerals. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described below in greater detail with reference to the accompanying drawings. While certain embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be interpreted as being limited to the embodiments set forth herein, but rather, these embodiments are provided so that the present disclosure can be more thoroughly and completely understood. It is understood that the drawings of the present disclosure and the embodiments are for exemplary purposes only and are not intended to limit the scope of protection of the present disclosure.

[0019] In the description of embodiments of the present disclosure, the term "includes" and its derivatives are to be construed as open-ended, i.e., as "including, but not limited to." The term "based on" is to be construed as "based at least in part on." The term "one embodiment" or "an embodiment" are to be construed as "at least one embodiment." The terms "a first," "a second," etc. are to be construed as "different or identical" objects. Other explicitly and implicitly recited definitions can also be possible.

[0020] In embodiments of the present disclosure, the term “model” is capable of processing an input and providing a corresponding output. Taking a neural network model as an example, it generally includes an input layer, an output layer, and one or more hidden layers between the input layer and the output layer. Models used in deep learning applications (also referred to as “deep learning models”) generally include many hidden layers, thereby lengthening the depth of the network. The layers of a neural network model are connected in sequence such that the output of a previous layer is used as the input of a subsequent layer, with the input layer receiving the input of the neural network model and the output of the output layer serving as the final output of the neural network model. Each layer of a neural network model includes one or more nodes (also referred to as processing nodes or neurons), each of which processes input from the previous layer. In this document, the terms “neural network”, “model”, “network”, and “neural network model” are used interchangeably.

[0021] The principles of the present disclosure will now be described with reference to a number of example embodiments illustrated in the drawings. While the preferred embodiments of the present disclosure are shown in the drawings, it is understood that the embodiments are merely for the purpose of better understanding the present disclosure and facilitating the implementation thereof, and are not intended to limit the scope of the present disclosure in any way.

[0022] In conventional abnormal storage detection, detection is usually only performed in a case where the workload pattern of each storage device in a single redundant array of independent disks (RAID) is the same as that in a training model or a backup. However, the workload pattern of each storage device can be different even in the same RAID. In addition, in other storage scenarios, the workload pattern of a storage device is also often different. Therefore, the conventional abnormal storage detection method often fails to detect abnormal storage devices in various storage scenarios.

[0023] To solve the above and other potential problems, the present disclosure proposes a method for training a model. In the method, first, a test set and a training set for training the model are obtained, and each of the test set and the training set includes workload data associated with normal storage devices and abnormal storage devices. Then, a device detection model is trained using the training set, which can classify a storage device as a normal storage device or an abnormal storage device according to a threshold degree within a range. Next, the test set is applied to the device detection model to determine a test result. Finally, the performance of the model is tested according to the test result, and if the performance does not reach a threshold performance, the range of the threshold degree is updated. Through this method, the model can be accurately trained according to workload data. Further, adjusting the threshold degree for determining abnormal devices using the test set can further improve the performance of the trained model.

[0024] Figure 1 A schematic diagram showing an example of a data processing environment 100 in which some embodiments of the present disclosure can be implemented. As shown in FIG. 1, the data processing environment 100 includes one or more client devices 110, one or more servers 120, and a network 130 that connects the client devices 110 and the servers 120.Figure 1 As shown in FIG. 1, the data processing environment 100 includes a computing device 110. The computing device 110 can be any device having computing capability, such as a personal computer, a tablet computer, a wearable device, a cloud server, a mainframe computer, a distributed computing system, and the like.

[0025] The computing device 110 obtains an input 120. The input 120 can be, for example, an image, a video, an audio, a text, and / or a multimedia file, and the like. The computing device 110 can apply the input 120 to a network model 130 to generate a processing result 140 corresponding to the input 120 using the network model 130. The network model 130 can be implemented using any suitable network structure, including but not limited to a support vector machine (SVM) model, a Bayesian model, a random forest model, various deep learning / neural network models such as a convolutional neural network (CNN), a recurrent neural network (RNN), a deep neural network (DNN), a deep Q-network (DQN), and the like. The scope of the present disclosure is not limited in this respect.

[0026] The environment 100 can further include a training data obtaining device, a model training device, and a model applying device (not shown). In some embodiments, the above-mentioned devices can be implemented in different physical computing devices respectively. Alternatively, at least a portion of the above-mentioned devices can be implemented in the same computing device. For example, the training data obtaining device, the model training device, and the model applying device can be implemented in the same computing device, while the model applying device can be implemented in another computing device.

[0027] In some embodiments, in a model training stage, the training data obtaining device can obtain the input 120 and provide it to the model. The input 120 can be a test set, and the network model 130 is a model to be trained. The model training device can train the network model 130 based on the input. The processing result 140 can be a measure of the error of the model on the training samples, and the computing device 110 can adjust the training parameters (e.g., weights and biases, etc.) of the network model 130 through different constraints so that the error of the model on the training samples is reduced.

[0028] Alternatively, in some embodiments, in a final stage of model training, the input can be a training set, and the processing result 140 can be a measure of the performance (e.g., accuracy) of the trained network model 130.

[0029] The training model environment 200 is described in detail below with reference to FIG. 2. The environment 200 can include a training set 122 and a test set 124 as the input 120, although there can be multiple training sets and test sets, which the present disclosure does not limit in this respect.

[0030] The computing device 110 can use the training set 122 to train a model to obtain a device detection model 132. In some embodiments, the model to be trained can be an isolation forest model, in which abnormal samples can be isolated by fewer random feature segmentations compared to normal samples. Any suitable algorithm or model to be trained can also be used to obtain the device detection model 132, and this disclosure is not limited thereto.

[0031] The computing device 110 can use the test set 122 to test the trained device detection model 132, and further adjust the severity threshold 134 of the device detection model 132 based on the test results.

[0032] Return to reference Figure 1 The trained network model can be provided to a model application device. The model application device can acquire the trained model and input 120, and determine the processing result 140 for input 120. In the model application phase, input 120 can be input data to be processed (e.g., workload data), network model 130 is a trained model (e.g., device detection model 132), and processing result 140 can be a prediction result corresponding to input 120 (e.g., workload data) (e.g., whether the device is a normal storage device or an abnormal storage device).

[0033] It should be understood that Figure 1 Environment 100 shown and Figure 2 The environment 200 shown is merely one example of an embodiment that can be implemented within this disclosure and is not intended to limit the scope of this disclosure. Embodiments of this disclosure are equally applicable to other systems or architectures.

[0034] The following combination Figure 3 This will further describe the detailed process of training the model. Figure 3 A flowchart of an example method 300 for training a model according to an embodiment of the present disclosure is illustrated. Example method 300 can be provided by... Figure 1 The computing device 110 in the middle is used for implementation. For ease of description, reference will be made to... Figure 1 and Figure 2 Let's describe example method 300.

[0035] exist Figure 3 At box 310, computing device 110 acquires test set 122 and training set 124 for training the model. Test set 122 and training set 124 each include workload data associated with normal storage devices and workload data associated with abnormal storage devices. For example, computing device 110 can acquire workload data of storage devices in different storage scenarios as test set 122 and training set 124.

[0036] In some embodiments, the workload data indicates at least one of data access pattern and data access performance. For example, the computing device 110 can obtain the workload data of the storage device within a predetermined time period (e.g., 3 seconds).

[0037] For data access pattern, the computing device 110 can obtain different data access pattern data, for example, can obtain at least one of the following: number of read requests, number of write requests, average data amount of read requests, average data amount of write requests, random access rate, and number of non-accesses. For example, the computing device 110 can obtain the number of read requests, the number of write requests, the average data amount of read requests, and the average data amount of write requests within 3 seconds. The random access rate can represent the ratio of the number of random accesses to the total number of accesses, where a random access can refer to the distance between the starting address of the current access and the starting address of the previous access exceeding a threshold distance (e.g., 2K of storage space). The number of non-accesses refers to the number of other operations in addition to data reading and writing. Since this other operation can also affect the read / write requests in the storage device, it is beneficial to collect this number of non-accesses as training and test data for model training.

[0038] For data access performance, the computing device 110 can obtain different access performance data, for example, can obtain at least one of the following: average time of requests, average time of write requests, maximum time of read requests, maximum time of write requests, number of read requests greater than a threshold time, and number of write requests greater than a threshold time. For example, the computing device 110 can obtain the average time of requests, the average time of write requests, the maximum time of read requests, the maximum time of write requests, the number of read requests greater than a threshold time (e.g., 100ms), and the number of write requests greater than a threshold time (e.g., 100ms) within 3 seconds. Among them, if the read / write request is greater than the threshold time, it indicates that the storage device associated with the read / write request can have an anomaly.

[0039] Alternatively, in some embodiments, the computing device 110 can obtain workload data of other scenarios (e.g., file cleaning, verification, etc.) in addition to the storage scenario. By obtaining workload data in various scenarios, i.e., the above-mentioned access pattern data and access performance data, the accuracy and generalization of the model trained with this data can be improved, and in turn, the abnormal storage devices in various different scenarios can be detected.

[0040] In Figure 3At block 320, the computing device 110 trains the device detection model 132 using the training set 122, the device detection model 132 being configured to classify a storage device as a normal storage device or an abnormal storage device according to a threshold degree 134, the threshold degree 134 being within a range. For example, the computing device 110 can train a model according to the training set 122 described above to obtain the device detection model 132.

[0041] In some embodiments, the computing device 110 can train an Isolation Forest (iForest) model according to various data described above to obtain the device detection model 132. The Isolation Forest (iForest) model is a model suitable for anomaly detection of continuous data. The model defines an anomaly as an "easily isolatable outlier", i.e., an anomaly point is a point that is sparsely distributed and far away from a high-density cluster. A sparsely distributed area indicates that the data occurring in this area has a very low probability, and thus the data falling in these areas can be considered as abnormal. It can be understood that, by collecting the workload data in various scenarios described above and using the characteristics of the Isolation Forest (iForest) model, the trained device detection model 132 can accurately determine the abnormal storage device. The above model is only exemplary, and any suitable model can be used to obtain the device detection model, which is not limited in the present disclosure.

[0042] The obtained device detection model 132 can classify a storage device as a normal storage device or an abnormal storage device according to a threshold degree 134 associated with the degree of device abnormality, and the threshold degree 134 is within a predetermined range. How to determine the range to make the performance of the device detection model 132 stable (i.e., greater than a threshold performance) will be described below.

[0043] In Figure 3 At block 330, the computing device 110 determines a test result by applying the test set 124 to the device detection model 132. For example, the computing device 110 can apply the test data to the device detection model 132 trained above to determine a test result of the device detection model 132 for the test set 124.

[0044] In some embodiments, the computing device 110 determines that a storage device associated with the first workload data is an abnormal storage device if the device detection model 132 determines that a first degree of device abnormality based on the first workload data is greater than the threshold degree 134. The computing device 110 determines that the storage device associated with the second workload data is a normal storage device if the device detection model determines that a second degree of device abnormality based on the second workload data is less than the threshold degree. For example, the device detection model 132 can determine the degree of abnormality of the workload data in the input test set 124 and compare the degree of abnormality with the threshold degree 134.

[0045] Understandably, the threshold level of 134 can be dynamically adjusted. A high threshold level of 134 may result in more abnormal devices being detected (higher true positive rate), but it may also lead to too many normal devices being falsely detected as abnormal devices (higher false positive rate). Conversely, a lower threshold level of 134 can result in a lower false positive rate, but it will also result in a lower true positive rate. The following section describes how to determine the range of this threshold level to ensure the model's performance is stable.

[0046] exist Figure 3 At box 340, if the computing device 110 determines that the test result indicates that the performance of the device detection model 132 has not reached the threshold performance, it updates the range of the threshold level 134. This will be combined with... Figure 5 Describe step 340.

[0047] In some embodiments, the threshold performance includes a first threshold probability associated with correctly detecting an anomalous storage device and a second threshold probability associated with incorrectly detecting an anomalous storage device. That is, the first threshold probability may indicate the true positive rate expected by the device detection model 132, and the second threshold probability may indicate the false positive rate expected by the device detection model 132. The computing device 110 can determine the first and second probabilities associated with the threshold levels based on the test results, whereby the first probability indicates the probability that an anomalous storage device is identified as an anomalous storage device by the model, and the second probability indicates the probability that a normal storage device is identified as an anomalous storage device by the model.

[0048] For example, test set 124 may include 100 storage devices (labeled as normal or abnormal, indicating 10 abnormal devices and 90 normal devices) and associated workload data. For instance, based on threshold level 0, device detection model 132 detects 9 of the 10 abnormal devices and falsely detects 2 of the 90 normal devices as abnormal. The first probability (true positive rate) is then 0.9, and the second probability (false positive rate) is 0.022. If the first threshold probability is 0.8 and the second threshold probability is 0.1, then threshold level 0 satisfies the model's performance requirements.

[0049] If the computing device 110 determines that the first probability is less than a first threshold probability or the second probability is greater than a second threshold probability, it removes values ​​corresponding to the threshold level from the range. For example, ... Figure 5As shown, each threshold level between -0.075 and 0.01 is associated with a first probability and a second probability. The computing device can remove values ​​from the range -0.075 and 0.01 corresponding to the following threshold levels: the first probability is less than the first threshold probability, or the second probability is greater than the second threshold probability. That is, from... Figure 5 It can be concluded that when the threshold level 134 is within the range of -0.01 and 0.01, the performance of the device detection model 132 is stable. Therefore, a stable performance model can be obtained.

[0050] Please note that the different values ​​mentioned above are merely examples, and different thresholds can be set according to the needs of the model and scenario. This disclosure does not impose any restrictions on these values.

[0051] According to embodiments of this disclosure, this method allows for accurate training of the model based on the workload. Furthermore, adjusting the model's alignment with the threshold for identifying anomalous devices using a test set can further improve the performance of the trained model.

[0052] The training process of the model has been described above; the application of the model will be described below. Figure 4 A flowchart of an example method 400 for processing data according to some embodiments of the present disclosure is shown.

[0053] exist Figure 4 At box 410, computing device 110 acquires workload data associated with the storage device. The workload data includes at least one of data access mode and data access performance. The acquisition of workload data has been described in detail above and will not be repeated here.

[0054] exist Figure 4 At frame 420, computing device 110 uses device detection model 132 trained according to the method of steps 310-340 above to determine the detection result for workload data. The detection result indicates whether the storage device is an abnormal storage device.

[0055] In some embodiments, the computing device 110 can present to the user a visual representation of the relationship between the threshold degree 134 and the first probability and the second probability, the first probability indicating a probability that an abnormal storage device is determined as an abnormal storage device by the trained model, and the second probability indicating a probability that a normal storage device is determined as an abnormal storage device by the trained model. For example, the computing device 110 can present to the user through a user interface (e.g., a display) a relationship 500 between the threshold degree and the first probability and the second probability. It can be appreciated that different users are involved in different storage scenarios, and the threshold degree can be set differently according to different storage scenarios. Some users prefer a higher first probability (true positive rate), and they can set the threshold degree to a higher value (e.g., 0.01). Some other users prefer a lower second probability (false positive rate), and they can set the threshold degree to a lower value (e.g., -0.01). The computing device 110 can then receive an input from the user regarding the threshold degree 134. And adjust the threshold degree 134 based on the input from the user. By accepting the user input to dynamically adjust the threshold degree, abnormal storage devices can be accurately detected in different application scenarios.

[0056] In one example, if the computing device 100 determines that the prediction result indicates that the storage device is an abnormal storage device, at least one of the following is performed: an alert is issued, a log is collected, and a data access operation is performed by a normal storage device associated with the abnormal storage device. For example, for an identified abnormal storage device, the computing device 110 can cause an alert to be sent to a technical support team, trigger log collection associated with the abnormal storage device, or facilitate data access associated with the abnormal storage device by means of a RAID mechanism.

[0057] In some embodiments, after detecting an abnormal storage device, if the computing device 110 determines that there is a read request for the abnormal storage device, the computing device 110 can use other normal storage devices in the same RAID group to implement recovery of the required data.

[0058] Alternatively, in some other embodiments, after detecting an abnormal storage device, if the computing device 110 determines that there is a write request for the abnormal storage device, the computing device 110 can first update the bitmap associated with the abnormal storage device without writing data to the abnormal storage device. When it is determined that the failure in the abnormal storage device is recovered, it can resynchronize the bitmap in the storage device.

[0059] By taking different strategies after detecting an abnormal device, the impact of the abnormal storage device can be minimized as much as possible, and the user experience can be improved.

[0060] Figure 6 A schematic block diagram of an example device 600 that can be used to implement embodiments of the present disclosure is shown. For example, as shown in FIG. 6, the device 600 includes a processor 602, a memory 604, a storage 606, an input device 608, a display 610, and a communication interface 612.Figure 1 The storage manager 130 shown can be implemented by the device 600. As shown, the device 600 includes a central processing unit CPU 601 that can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory ROM 602 or loaded into a random access memory RAM 603 from a storage unit 608. Various programs and data required for operation of the device 600 can also be stored in the RAM 603. The CPU 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output I / O interface 605 is also connected to the bus 604.

[0061] Various components in the device 600 are connected to the I / O interface 605, including an input unit 606, such as a keyboard, a mouse, etc., an output unit 607, such as various types of displays, speakers, etc., a storage unit 608, such as a magnetic disk, a magneto-optical disk, etc., and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0062] The various processes and processes described above, such as the methods 300 and 400, can be performed by the processing unit 601. For example, in some embodiments, the methods 300 and 400 can be implemented as a computer software program that is tangibly embodied in a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the CPU 601, one or more actions of the methods 300 and 400 described above can be performed.

[0063] The present disclosure can be a method, apparatus, system and / or computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for performing various aspects of the present disclosure.

[0064] Computer readable storage media can be tangible storage media which can retain and store instructions for use by an instruction execution device. Computer readable storage media can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer readable storage media, in non-exhaustive list, include: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or punched-tape, a

[0065] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0066] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer, for example, through the Internet using an Internet Service Provider. In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0067] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0068] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0069] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0070] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0071] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative, and not restrictive, of the disclosed embodiments. Many modifications and variations of the described embodiments are possible, and all such modifications and variations are intended to be within the scope of the described embodiments. The description used herein is intended to be illustrative, and not restrictive, of the described embodiments. The scope of the described embodiments is not limited to the examples and / or embodiments described herein but only by the claims and their equivalents.

Claims

1. A method for training a model, comprising: obtaining a test set and a training set for training a model, the test set and the training set each including workload data associated with normal storage devices and workload data associated with abnormal storage devices; training a device detection model with the training set, the device detection model for classifying a storage device as a normal storage device or an abnormal storage device according to a threshold degree, the threshold degree within a range; determining a test result by applying the test set to the device detection model; and if it is determined that the test result indicates that a performance of the device detection model does not reach a threshold performance, updating the range of the threshold degree, wherein the threshold performance includes a first threshold probability associated with correctly detecting an abnormal storage device and a second threshold probability associated with falsely detecting an abnormal storage device, and wherein updating the range of the threshold degree includes: determining, based on the test result, a first probability and a second probability associated with the threshold degree, the first probability indicating a probability that an abnormal storage device is determined as an abnormal storage device by the device detection model, and the second probability indicating a probability that a normal storage device is determined as an abnormal storage device by the device detection model; and if it is determined that the first probability is less than the first threshold probability or the second probability is greater than the second threshold probability, obtaining an updated range for maintaining the performance of the device detection model stable by removing a value corresponding to the threshold degree from the range, wherein the threshold degree is set to a higher value in response to the first probability indicating that a true positive rate for storage device detection in a corresponding storage scenario is higher, the corresponding storage scenario corresponding to consecutive workload data for a storage device, and the threshold degree is set to a lower value in response to the second probability indicating that a false positive rate for storage device detection in the corresponding storage scenario is lower.

2. The method of claim 1, wherein determining the test result includes: determining a storage device associated with first workload data as an abnormal storage device if a first device abnormality degree determined by the device detection model based on the first workload data is greater than the threshold degree; and determining the storage device associated with second workload data as a normal storage device if a second device abnormality degree determined by the device detection model based on the second workload data is less than the threshold degree.

3. The method of claim 1, wherein the workload data indicates at least one of a data access pattern and a data access performance.

4. The method of claim 3, wherein the data access pattern includes at least one of a number of read requests, a number of write requests, an average data amount of read requests, an average data amount of write requests, a random access rate, and a number of non-accesses. ​ ​ 5. The method of claim 3, wherein the data access performance comprises at least one of: an average time of requests, an average time of write requests, a maximum time of read requests, a maximum time of write requests, a number of read requests greater than a threshold time, and a number of write requests greater than a threshold time.

6. A method for processing data, comprising: obtaining workload data associated with a storage device, the workload data comprising at least one of a data access pattern and a data access performance; and determining, using a device detection model trained according to any one of claims 1-5, a detection result for the workload data, the detection result indicating whether the storage device is an abnormal storage device.

7. The method of claim 6, further comprising: presenting, to a user, a visual representation of a relationship between the threshold degree and a first probability and a second probability, the first probability indicating a probability that an abnormal storage device is determined to be an abnormal storage device by the trained model, the second probability indicating a probability that a normal storage device is determined to be an abnormal storage device by the trained model; receiving an input from the user regarding the threshold degree, and adjusting the threshold degree based on the input from the user.

8. The method of claim 6, further comprising: if the detection result indicates that the storage device is an abnormal storage device, causing at least one of: issuing an alert, collecting a log, and performing a data access operation by a normal storage device associated with the abnormal storage device.

9. An electronic device, the electronic device comprising: at least one processor; and memory coupled to the at least one processor and having stored thereon instructions which, when executed by the at least one processor, cause the device to perform actions comprising: obtaining a test set and a training set for a model, the test set and the training set each comprising workload data associated with normal storage devices and workload data associated with abnormal storage devices; training a device detection model using the training set, the device detection model for classifying a storage device as a normal storage device or an abnormal storage device according to a threshold degree, the threshold degree being within a range; determining a test result by applying the test set to the device detection model; and if it is determined that the test result indicates that a performance of the device detection model does not meet a threshold performance, updating the range of the threshold degree, wherein the threshold performance comprises a first threshold probability associated with correctly detecting an abnormal storage device and a second threshold probability associated with incorrectly detecting an abnormal storage device, and wherein updating the range of the threshold degree comprises: determining, based on the test result, a first probability and a second probability associated with the threshold degree, the first probability indicating a probability that an abnormal storage device is determined to be an abnormal storage device by the device detection model, and the second probability indicating a probability that a normal storage device is determined to be an abnormal storage device by the device detection model; and ​ if it is determined that the first probability is less than the first threshold probability or the second probability is greater than the second threshold probability, obtaining an updated range for maintaining the stability of the performance of the device detection model by removing a value corresponding to the threshold degree from the range, wherein, in response to the first probability indicating that a true positive rate for storage device detection in a respective storage scenario is high, the threshold degree is set to a higher value, the respective storage scenario corresponding to consecutive workload data for a storage device, and in response to the second probability indicating that a false positive rate for storage device detection in the respective storage scenario is low, the threshold degree is set to a lower value.

10. The electronic device of claim 9, wherein determining the test result comprises: determining that a storage device associated with first workload data is an abnormal storage device if a first degree of device abnormality determined by the device detection model based on the first workload data is greater than the threshold degree; and and determining that the storage device associated with second workload data is a normal storage device if a second degree of device abnormality determined by the device detection model based on the second workload data is less than the threshold degree.

11. The electronic device of claim 9, wherein the workload data indicates at least one of a data access pattern and a data access performance.

12. The electronic device of claim 11, wherein the data access pattern comprises at least one of a number of read requests, a number of write requests, an average data amount of read requests, an average data amount of write requests, a random access rate, and a number of non-accesses.

13. The electronic device of claim 11, wherein the data access performance comprises at least one of an average time of requests, an average time of write requests, a maximum time of read requests, a maximum time of write requests, a number of read requests greater than a threshold time, and a number of write requests greater than a threshold time.

14. An electronic device, the electronic device comprising: at least one processor; and memory coupled to the at least one processor and having stored thereon instructions which, when executed by the at least one processor, cause the device to perform actions comprising: obtaining workload data associated with a storage device, the workload data comprising at least one of a data access pattern and a data access performance; and determining a test result for the workload data using a device detection model trained by the electronic device of any one of claims 9-13, the test result indicating whether the storage device is an abnormal storage device.

15. The electronic device of claim 14, further comprising: causing a visual representation of a relationship between the threshold degree and a first probability and a second probability to be presented to a user, the first probability indicating a probability that an abnormal storage device is determined to be an abnormal storage device by the trained model, the second probability indicating a probability that a normal storage device is determined to be an abnormal storage device by the trained model; receiving an input from the user regarding the threshold degree, and adjusting the threshold degree based on the input from the user.

16. The electronic device of claim 14, further comprising: causing at least one of the following to be performed if the detection result indicates that the storage device is an abnormal storage device: issuing an alert, collecting a log, and performing a data access operation through a normal storage device associated with the abnormal storage device.

17. A computer program product tangibly stored on a non-transitory computer- readable medium and comprising machine-executable instructions that, when executed, cause a machine to perform the steps of the method of any one of claims 1 to 5.

18. A computer program product tangibly stored on a non-transitory computer- readable medium and comprising machine-executable instructions that, when executed, cause a machine to perform the steps of the method of any one of claims 6 to 8.

Images