An anomaly detection method, apparatus, device, medium

Abstract

The present disclosure provides an anomaly detection method, device, equipment and medium, which can be applied to the fields of big data technology and financial technology. The anomaly detection method comprises: obtaining system running real-time data, system running normal historical feature data and system running abnormal historical feature data from a database monitoring system; performing standardization processing on the real-time system running data to obtain real-time system running feature data; constructing a first feature data set, a second feature data set, a third feature data set and a fourth feature data set according to the historical system running normal feature data and the historical system running abnormal feature data; inputting the real-time system running feature data, the first feature data set and the second feature data set into a first classifier to obtain a first classification result; inputting the real-time system running feature data, the third feature data set and the fourth feature data set into a second classifier to obtain a second classification result; and generating an anomaly detection result according to the first classification result and the second classification result.

Description

Technical Field

[0001] This disclosure relates to the field of big data technology, and specifically to an anomaly detection method, apparatus, equipment, medium, and program product. Background Technology

[0002] Currently, evaluating the health of MySQL databases in data centers is one of the challenges. To a certain extent, the health of a database system can be reflected by a set of indicators. However, as database systems grow larger, more complex, and monitoring coverage improves, the volume of monitoring data increases dramatically, making it difficult for operations and maintenance personnel to quickly identify quality issues from massive amounts of data. At present, database health evaluation mainly relies on expert experience, requiring highly specialized database experts to assess and analyze data quality and fault processes based on their disciplinary characteristics and work experience, thereby establishing a unique evaluation system. This manual configuration is costly and lacks timeliness. Summary of the Invention

[0003] In view of the above problems, this disclosure provides an anomaly detection method, apparatus, equipment, medium and program product.

[0004] According to one aspect of this disclosure, an anomaly detection method is provided, comprising:

[0005] Obtain real-time system operation data, historical data showing normal system operation, and historical data showing abnormal system operation from the database monitoring system;

[0006] The real-time system operation data is standardized to obtain real-time system operation characteristic data.

[0007] Based on historical system normal operation feature data and historical system abnormal operation feature data, a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset are constructed. The first feature dataset includes first nearest neighbor sample data and historical system abnormal operation feature data, where the first nearest neighbor sample data represents the data that is closest to the historical abnormal operation feature data within the historical normal operation feature data. The second feature dataset includes the data remaining after removing the first nearest neighbor sample data from the historical normal operation feature data. The third feature dataset includes second nearest neighbor sample data. The fourth feature dataset includes historical system abnormal operation feature data, where the second nearest neighbor sample data represents the data that is closest to the historical abnormal operation feature data in the first feature dataset.

[0008] Input the real-time system running feature data, the first feature dataset, and the second feature dataset into the first classification model to obtain the first classification result;

[0009] The real-time system runtime feature data, the third feature dataset, and the fourth feature dataset are input into the second classification model to obtain the second classification result; and

[0010] Anomaly detection results are generated based on the first and second classification results.

[0011] According to embodiments of this disclosure, the training method for the first classification model includes:

[0012] The first feature dataset and the second feature dataset are input into the first initial classification model for training to obtain the first training classification result.

[0013] Based on the first training classification result, a first confusion matrix is ​​constructed, wherein the first confusion matrix includes first classification result data, second classification result data, and third classification result data; the first classification result data represents the number of historical abnormal feature data samples classified into the first feature dataset, the second classification result data represents the number of historical abnormal feature data samples classified into the second feature dataset, and the third classification result data represents the number of historical normal feature data samples classified into the first feature dataset.

[0014] Based on the first classification result data, the second classification result data, and the third classification result data, generate the first classification performance index data of the first initial classification model;

[0015] If the first classification performance index data meets the first preset conditions, the first classification model that has been trained is obtained.

[0016] According to embodiments of this disclosure, the training method for the second classification model includes:

[0017] The third and fourth feature datasets are input into the second initial classification model for training, and the second training classification result is obtained.

[0018] Based on the second training classification results, a second confusion matrix is ​​constructed, which includes the fourth classification result data, the fifth classification result data, and the sixth classification result data. The fourth classification result data represents the number of historical abnormal feature data samples classified into the fourth feature dataset, the fifth classification result data represents the number of historical abnormal feature data samples classified into the third feature dataset, and the sixth classification result data represents the number of historical normal feature data samples classified into the fourth feature dataset.

[0019] Based on the fourth, fifth, and sixth classification results, generate the second classification performance index data of the second initial classification model;

[0020] If the second classification performance index data meets the second preset condition, the trained second classification model is obtained.

[0021] According to embodiments of this disclosure, real-time system operation data is standardized to obtain real-time system operation characteristic data, including:

[0022] Based on the type of real-time system operation data, the real-time system operation data is classified to obtain M real-time system operation datasets, where M is a positive integer;

[0023] For each real-time system operation dataset, calculate the mean and standard deviation of the real-time system operation data in the dataset.

[0024] Based on the real-time system operation data, mean, and standard deviation in the real-time system operation dataset, generate real-time system operation feature data.

[0025] According to embodiments of this disclosure, a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset are constructed based on historical system normal operation feature data and historical system abnormal operation feature data, including:

[0026] Based on the K-nearest neighbor algorithm, the first nearest neighbor sample data is collected from the historical normal operation feature data according to the historical abnormal operation feature data;

[0027] Construct the first feature dataset based on the first nearest neighbor sample data and historical system operation anomaly feature data;

[0028] The first nearest neighbor sample data is removed from the historical system's normal operating feature data to obtain the second feature dataset.

[0029] Based on the K-nearest neighbor algorithm, second nearest neighbor sample data are collected from the first feature dataset according to the historical system operation anomaly feature data;

[0030] Construct a third feature dataset based on the second nearest neighbor sample data;

[0031] A fourth feature dataset is constructed based on historical system operation anomaly data.

[0032] According to embodiments of this disclosure, an anomaly detection result is generated based on a first classification result and a second classification result, including:

[0033] If the first classification result indicates that the running feature data is classified into the first feature dataset, and the second classification result indicates that the running feature data is classified into the fourth feature dataset, then the anomaly detection result is "system operation anomaly".

[0034] If the first classification result indicates that the running feature data is classified into the first feature dataset, and the second classification result indicates that the running feature data is classified into the third feature dataset, then the anomaly detection result is generated as "system is running normally".

[0035] If the first classification result indicates that the running feature data is classified into the second feature dataset, and the second classification result indicates that the running feature data is classified into the third feature dataset, then the anomaly detection result is generated as "system is running normally".

[0036] Another aspect of this disclosure provides an anomaly detection device, comprising: an acquisition module, a processing module, a construction module, a first classification module, a second classification module, and a generation module. The acquisition module is used to acquire real-time system operation data, historical system normal operation feature data, and historical system abnormal operation feature data from a database monitoring system. The processing module is used to standardize the real-time system operation data to obtain real-time system operation feature data. The construction module is used to construct a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset based on the historical system normal operation feature data and the historical system abnormal operation feature data; wherein the first feature dataset includes first nearest neighbor sample data and historical system abnormal operation feature data, the first nearest neighbor sample data representing data that is nearest to the historical system abnormal operation feature data in the historical system normal operation feature data; the second feature dataset includes the data remaining after removing the first nearest neighbor sample data from the historical system normal operation feature data; the third feature dataset includes second nearest neighbor sample data; and the fourth feature dataset includes historical system abnormal operation feature data, the second nearest neighbor sample data representing data that is nearest to the historical system abnormal operation feature data in the first feature dataset. The first classification module is used to input real-time system operation data, a first feature dataset, and a second feature dataset into the first classification model to obtain the first classification result. The second classification module is used to input real-time system operation data, a third feature dataset, and a fourth feature dataset into the second classification model to obtain the second classification result. The generation module is used to generate anomaly detection results based on the first and second classification results.

[0037] According to embodiments of this disclosure, the processing module includes a classification unit, a calculation unit, and a first generation unit. The classification unit is used to classify the real-time system operation data according to its type, obtaining M real-time system operation datasets, where M is a positive integer. The calculation unit is used to calculate the mean and standard deviation of the real-time system operation data in each dataset. The first generation unit is used to generate real-time system operation feature data based on the real-time system operation data, mean, and standard deviation in the dataset.

[0038] According to embodiments of this disclosure, the construction module includes a first acquisition unit, a first construction unit, a removal unit, a second acquisition unit, a second construction unit, and a third construction unit. The first acquisition unit is used to acquire first nearest neighbor sample data from historical normal system operation feature data based on the K-nearest neighbor algorithm and historical system operation anomaly feature data. The first construction unit is used to construct a first feature dataset based on the first nearest neighbor sample data and the historical system operation anomaly feature data. The removal unit is used to remove the first nearest neighbor sample data from the historical system operation normal feature data to obtain a second feature dataset. The second acquisition unit is used to acquire second nearest neighbor sample data from the first feature dataset based on the K-nearest neighbor algorithm and historical system operation anomaly feature data. The second construction unit is used to construct a third feature dataset based on the second nearest neighbor sample data. The third construction unit is used to construct a fourth feature dataset based on the historical system operation anomaly feature data.

[0039] According to embodiments of this disclosure, the generation module includes a second generation unit, a third generation unit, and a fourth generation unit. The second generation unit is configured to generate an anomaly detection result of "system operation abnormal" when the first classification result indicates that the running feature data is classified into a first feature dataset, and the second classification result indicates that the running feature data is classified into a fourth feature dataset. The third generation unit is configured to generate an anomaly detection result of "system operation normal" when the first classification result indicates that the running feature data is classified into a first feature dataset, and the second classification result indicates that the running feature data is classified into a third feature dataset. The fourth generation unit is configured to generate an anomaly detection result of "system operation normal" when the first classification result indicates that the running feature data is classified into a second feature dataset, and the second classification result indicates that the running feature data is classified into a third feature dataset.

[0040] Another aspect of this disclosure provides an electronic device, including: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the above-described anomaly detection method.

[0041] Another aspect of this disclosure provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the above-described anomaly detection method.

[0042] Another aspect of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the above-described anomaly detection method.

[0043] According to embodiments of this disclosure, a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset are constructed from historical abnormal operation feature data and historical normal operation feature data. Real-time system operation feature data, along with the first and second feature datasets, are input into a first classification model to obtain a first classification result. The real-time system operation feature data, along with the third and fourth feature datasets, are input into a second classification model to obtain a second classification result. Anomaly detection results are then generated based on the first and second classification results. Since the first feature dataset includes first nearest neighbor sample data collected from the historical normal operation feature dataset, and the third feature dataset includes second nearest neighbor sample data collected from the first feature dataset, the data class balance in the first and second classification models can be improved when performing anomaly detection on real-time system operation data. Simultaneously, the noise sample data introduced by oversampling is reduced, thereby improving the accuracy of system operation anomaly detection through classification. Attached Figure Description

[0044] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0045] Figure 1 The illustration shows an application scenario of anomaly detection methods, apparatus, devices, media, and program products according to embodiments of the present disclosure;

[0046] Figure 2 A flowchart illustrating an anomaly detection method according to an embodiment of the present disclosure is shown schematically.

[0047] Figure 3 A flowchart illustrating a training method for a first classification model according to an embodiment of the present disclosure is shown schematically.

[0048] Figure 4 A flowchart illustrating a training method for a second classification model according to an embodiment of the present disclosure is shown schematically.

[0049] Figure 5 A flowchart illustrating the process of obtaining real-time system operation characteristic data according to an embodiment of the present disclosure is shown.

[0050] Figure 6 A flowchart illustrating the construction of a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset according to embodiments of the present disclosure is shown.

[0051] Figure 7 A flowchart illustrating the generation of anomaly detection results according to an embodiment of this disclosure is shown schematically;

[0052] Figure 8A schematic block diagram of an anomaly detection apparatus according to an embodiment of the present disclosure is shown; and

[0053] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing an anomaly detection method according to an embodiment of the present disclosure. Detailed Implementation

[0054] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0055] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0056] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0057] When using expressions such as "at least one of A, B, and C", they should generally be interpreted in accordance with the meaning that is commonly understood by a person skilled in the art (e.g., "a system having at least one of A, B, and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B, and C, etc.).

[0058] It should be noted that the anomaly detection method and apparatus disclosed herein can be used in the fields of big data technology and financial technology, as well as in any field other than finance. The application fields of the anomaly detection method and apparatus disclosed herein are not limited.

[0059] The embodiments of this disclosure provide an anomaly detection method, comprising: acquiring real-time system operation data, historical normal system operation feature data, and historical abnormal system operation feature data from a database monitoring system; standardizing the real-time system operation data to obtain real-time system operation feature data; and constructing a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset based on the historical normal system operation feature data and the historical abnormal system operation feature data; wherein, the first feature dataset includes first nearest neighbor sample data and historical abnormal system operation feature data, and the first nearest neighbor sample data represents the data that is nearest to the historical abnormal system operation feature data in the historical normal system operation feature data; The second feature dataset includes the data remaining after removing the first nearest neighbor sample data from the historical normal system operation feature data; the third feature dataset includes the second nearest neighbor sample data; the fourth feature dataset includes the historical abnormal system operation feature data, and the second nearest neighbor sample data represents the data that is closest to the historical abnormal operation feature data in the first feature dataset; the real-time system operation feature data, the first feature dataset, and the second feature dataset are input into the first classification model to obtain the first classification result; the real-time system operation feature data, the third feature dataset, and the fourth feature dataset are input into the second classification model to obtain the second classification result; and anomaly detection results are generated based on the first classification result and the second classification result.

[0060] Figure 1 The diagram illustrates an application scenario of the anomaly detection method according to an embodiment of the present disclosure.

[0061] like Figure 1 As shown, application scenario 100 according to this embodiment may include terminal devices 101, 102, and 103, network 104, and server 105. Network 104 is used as a medium to provide a communication link between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0062] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on the database monitoring systems 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0063] Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0064] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using terminal devices 101, 102, and 103 (for example only). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0065] It should be noted that the anomaly detection method provided in this embodiment can generally be executed by server 105. Correspondingly, the anomaly detection device provided in this embodiment can generally be located in server 105. The anomaly detection method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105. Correspondingly, the anomaly detection device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with terminal devices 101, 102, 103 and / or server 105.

[0066] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0067] The following will be based on Figure 1 The described scene, through Figures 2-7 The anomaly detection method of the disclosed embodiments is described in detail.

[0068] Figure 2 A flowchart illustrating an anomaly detection method according to an embodiment of the present disclosure is shown schematically.

[0069] like Figure 2 As shown, the anomaly detection method of this embodiment includes operations S210 to S260.

[0070] During operation S210, real-time system operation data, historical characteristic data of normal system operation, and historical characteristic data of abnormal system operation are obtained from the database monitoring system.

[0071] According to embodiments of this disclosure, real-time system operation data may include operational data that reflects the health of the database system, such as: CPU utilization, connection utilization that reflects the percentage of the number of threads connecting to MySQL relative to the connection limit, disk bandwidth utilization that reflects the disk activity of the MySQL instance, the number of statements in InnoDB that are waiting due to lock contention, concurrency utilization that reflects the percentage of the number of concurrent threads executing in the database relative to the total limit, etc.

[0072] In operation S220, the real-time system operation data is standardized to obtain real-time system operation characteristic data.

[0073] According to embodiments of this disclosure, since there are many types of real-time system operation data, and the order of magnitude and units of each type of real-time system operation data are different, standardized real-time system operation characteristic data can be obtained by standardizing different types of real-time system operation data. For example, standardization can be performed through various methods such as dimensionality processing, normalization processing, and centralization processing.

[0074] In operation S230, based on historical system normal operation feature data and historical system abnormal operation feature data, a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset are constructed. The first feature dataset includes first nearest neighbor sample data and historical system abnormal operation feature data, where the first nearest neighbor sample data represents the data that is closest to the historical abnormal operation feature data in the historical normal operation feature data. The second feature dataset includes the data remaining after removing the first nearest neighbor sample data from the historical normal operation feature data. The third feature dataset includes second nearest neighbor sample data. The fourth feature dataset includes historical system abnormal operation feature data, where the second nearest neighbor sample data represents the data that is closest to the historical abnormal operation feature data in the first feature dataset.

[0075] According to embodiments of this disclosure, in historical real-time system operation characteristic data, historical system operation anomaly characteristic data belongs to the minority class of sample data, while historical system normal characteristic data belongs to the majority class of sample data. Historical system operation anomaly characteristic data may include n data points, for example: (a1, a2, a3...a ......a......a......a......a......a n Historical system normal characteristic data can include m data points, for example: (b1, b2, b3...b... m ), where m is greater than n.

[0076] According to embodiments of this disclosure, based on the K-nearest neighbor algorithm, K1 nearest neighbor data points that are adjacent to the abnormal operation feature data of the historical system can be collected from the normal feature data of the historical system to obtain the first nearest neighbor sample data, such as (b1, b2, b3...b...). k1 If the first feature dataset is (a1, a2, a3...a...), then the first feature dataset can be (a1, a2, a3...a...). n b1, b2, b3...b k1 The second feature dataset can be (b) k1+1 b k1+2 b k1+3 ...b m The fourth feature dataset can be (a1, a2, a3...a...). n ).

[0077] According to embodiments of this disclosure, based on the K-nearest neighbor algorithm, K2 nearest neighbor data points that are adjacent to historical system abnormal operation feature data can be collected from the first feature dataset to obtain second nearest neighbor sample data, for example: (b1, b2, b3...b k2 If the third feature dataset can be: (b1, b2, b3...b...), then the dataset can be: (b1, b2, b3...b...). k2 ).

[0078] In operation S240, the real-time system running feature data, the first feature dataset, and the second feature dataset are input into the first classification model to obtain the first classification result.

[0079] According to embodiments of this disclosure, real-time system operating characteristic data can be represented as (p1, p2, p3...p... i ), where i can represent i types of indicator data that can reflect the health of the database in the real-time system operation characteristic data.

[0080] According to embodiments of this disclosure, the first classification result may include real-time system operation feature data, a first feature dataset, and second feature data processed by a first classification model, with the real-time system operation feature data being classified into the first feature dataset or the second feature dataset.

[0081] When operating S250, the real-time system running feature data, the third feature dataset, and the fourth feature dataset are input into the second classification model to obtain the second classification result.

[0082] According to embodiments of this disclosure, the second classification result may include real-time system operation feature data, a third feature dataset, and a fourth feature dataset being classified into the third feature dataset or the fourth feature dataset by the second classification model.

[0083] In operation S260, anomaly detection results are generated based on the first classification result and the second classification result.

[0084] According to embodiments of this disclosure, for example: a first classification result indicates that the real-time system operation feature data is classified into a first feature dataset, meaning that the real-time system operation feature data belongs to a minority class dataset. A second classification result indicates that the real-time system operation feature data is classified into a fourth feature dataset, meaning that the real-time system operation feature data is abnormal operation feature data, and the generated anomaly detection result may include the current database system operation anomaly.

[0085] According to embodiments of this disclosure, a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset are constructed from historical abnormal operation feature data and historical normal operation feature data. Real-time system operation feature data, along with the first and second feature datasets, are input into a first classification model to obtain a first classification result. The real-time system operation feature data, along with the third and fourth feature datasets, are input into a second classification model to obtain a second classification result. Anomaly detection results are then generated based on the first and second classification results. Since the first feature dataset includes first nearest neighbor sample data collected from the historical normal operation feature dataset, and the third feature dataset includes second nearest neighbor sample data collected from the first feature dataset, the data class balance in the first and second classification models can be improved when performing anomaly detection on real-time system operation data. Simultaneously, the noise sample data introduced by oversampling is reduced, thereby improving the accuracy of system operation anomaly detection through classification.

[0086] Figure 3 A flowchart illustrating a training method for a first classification model according to an embodiment of the present disclosure is shown schematically.

[0087] like Figure 3 As shown, the training method of the first classification model in this embodiment includes operations S310 to S340.

[0088] In operation S310, the first feature dataset and the second feature dataset are input into the first initial classification model for training, and the first training classification result is obtained.

[0089] In operation S320, a first confusion matrix is ​​constructed based on the first training classification result. The first confusion matrix includes first classification result data, second classification result data, and third classification result data. The first classification result data represents the number of historical abnormal feature data samples classified into the first feature dataset, the second classification result data represents the number of historical abnormal feature data samples classified into the second feature dataset, and the third classification result data represents the number of historical normal feature data samples classified into the first feature dataset.

[0090] According to embodiments of this disclosure, in traditional classification problems, accuracy is typically used as an evaluation metric for model performance. However, accuracy is not suitable for imbalanced classification tasks. For example, consider a dataset containing 99% majority class samples and only 1% minority class samples. If all samples are classified as majority class, the classifier accuracy reaches 99%, but the accuracy for minority class samples is 0%. Therefore, embodiments of this disclosure use the classification accuracy of minority class samples as the evaluation metric for model training during the classification model training process.

[0091] In operation S330, the first classification performance index data of the first initial classification model is generated based on the first classification result data, the second classification result data, and the third classification result data.

[0092] According to embodiments of this disclosure, the first category performance index data F1 can be as shown in equation (1):

[0093]

[0094] Where F1 represents the first classification performance metric; Recall1 represents the first recall rate; and Precision1 represents the first precision rate.

[0095] According to embodiments of this disclosure, the first recall rate Recall1 represents the proportion of minority class samples that are correctly classified as minority class, as shown in equation (2):

[0096]

[0097] Wherein, TP1 represents the first classification result data; FN1 represents the third classification result data.

[0098] According to embodiments of this disclosure, the first precision 1 represents the proportion of samples correctly classified as minority classes among those classified as minority classes, and can be expressed as shown in equation (3):

[0099]

[0100] Wherein, TP1 represents the first classification result data; FP1 represents the second classification result data.

[0101] When operating S340, if the first classification performance index data meets the first preset condition, the first classification model that has been trained is obtained.

[0102] According to embodiments of this disclosure, to verify the stability of the first classification model, a five-fold cross-validation method can be used to further evaluate its performance. For example, the original training dataset can be randomly shuffled and split into five groups, each with the same data distribution as the original dataset. For each group, that group is used as the validation set, and the remaining groups are used as the training set. The model is fitted on the training set and evaluated on the validation set. The evaluation score is retained, and the model is discarded. A first preset condition can be that the model with the highest evaluation score is the first classification model with the highest performance evaluation score.

[0103] According to embodiments of this disclosure, by constructing a confusion matrix of the classification training results, the model evaluation index is determined using the precision and recall of minority class sample classification. For training datasets with fewer abnormal data in the system, a first classification model with high accuracy and good stability can be obtained.

[0104] Figure 4 A flowchart illustrating a training method for a second classification model according to an embodiment of the present disclosure is shown.

[0105] like Figure 4 As shown, the training method of the second classification model in this embodiment includes operations S410 to S440.

[0106] In operation S410, the third feature dataset and the fourth feature dataset are input into the second initial classification model for training, and the second training classification result is obtained.

[0107] In operation S440, a second confusion matrix is ​​constructed based on the second training classification results. The second confusion matrix includes fourth classification result data, fifth classification result data, and sixth classification result data. The fourth classification result data represents the number of historical abnormal feature data samples classified into the fourth feature dataset, the fifth classification result data represents the number of historical abnormal feature data samples classified into the third feature dataset, and the sixth classification result data represents the number of historical normal feature data samples classified into the fourth feature dataset.

[0108] In operation S430, based on the fourth classification result data, the fifth classification result data, and the sixth classification result data, the second classification performance index data of the second initial classification model is generated.

[0109] According to embodiments of this disclosure, the second category performance index data F2 can be as shown in equation (4):

[0110]

[0111] Where F2 represents the second classification performance metric; Recall2 represents the second recall rate; and Precision2 represents the second precision rate.

[0112] According to embodiments of this disclosure, the second recall rate Recall1 represents the proportion of minority class samples that are correctly classified as minority class, as shown in equation (5):

[0113]

[0114] In this context, TP2 represents the fourth category result data; FN2 represents the sixth category result data.

[0115] According to embodiments of this disclosure, the second precision 2 represents the proportion of samples correctly classified as minority classes among those classified as minority classes, as shown in equation (6):

[0116]

[0117] In this context, TP2 represents the fourth category result data; FP2 represents the fifth category result data.

[0118] When operating S440, if the second classification performance index data meets the second preset conditions, the trained second classification model is obtained.

[0119] According to embodiments of this disclosure, to verify the stability of the second classification model, a five-fold cross-validation method can be used to further evaluate the performance of the second classification model. The specific evaluation steps are the same as those for evaluating the first classification model, and will not be repeated here. The second preset condition can also be the highest evaluation score.

[0120] According to embodiments of this disclosure, by constructing a confusion matrix of the classification training results, the model evaluation index is determined using the precision and recall of minority class sample classification. For training datasets with fewer abnormal data in the system, a second classification model with high accuracy and good stability can be obtained.

[0121] Figure 5 A flowchart illustrating the process of obtaining real-time system operation characteristic data according to an embodiment of the present disclosure is shown.

[0122] like Figure 5 As shown, the method for extracting real-time system operation feature data in this embodiment includes operations S510 to S530.

[0123] When operating S510, the real-time system operation data is classified according to its type, resulting in M ​​real-time system operation datasets, where M is a positive integer.

[0124] According to embodiments of this disclosure, real-time system operation data may include: CPU utilization, connection utilization, disk bandwidth utilization, and concurrency utilization. Based on the type of real-time system operation data, four real-time system operation datasets can be obtained: CPU utilization dataset, connection utilization dataset, disk bandwidth utilization dataset, and concurrency utilization dataset.

[0125] When operating S520, for each real-time system operation dataset, calculate the mean and standard deviation of the real-time system operation data in the real-time system operation dataset.

[0126] According to embodiments of this disclosure, taking a CPU utilization dataset as an example, the CPU utilization dataset can be represented as (x1, x2, x3...x...). n ).

[0127] When operating S530, real-time system operation feature data is generated based on the real-time system operation data, average value, and standard deviation in the real-time system operation dataset.

[0128] According to embodiments of this disclosure, real-time system operating characteristic data can be represented as shown in equation (7):

[0129]

[0130] Where Z represents the real-time system operation characteristic data, x represents the real-time system operation data, μ represents the average value of all data in the real-time system operation dataset, and σ represents the standard deviation of all data in the real-time system operation dataset.

[0131] According to embodiments of this disclosure, by calculating the average value and standard deviation of real-time system operation data, different types of real-time system operation data are transformed into standard feature data for training classification models, thereby reducing the impact of data type on model parameters.

[0132] Figure 6 The flowchart illustrating the construction of a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset according to embodiments of the present disclosure is shown in the illustration.

[0133] like Figure 6 As shown, the method for constructing a feature dataset in this embodiment includes operations S610 to S660.

[0134] When operating the S610, based on the K-nearest neighbor algorithm, the first nearest neighbor sample data is collected from the historical normal operation feature data according to the historical abnormal operation feature data.

[0135] In operation S620, a first feature dataset is constructed based on the first nearest neighbor sample data and historical system operation anomaly feature data.

[0136] In operation S630, the first nearest neighbor sample data in the historical system's normal operating feature data is removed to obtain the second feature dataset.

[0137] When operating the S640, based on the K-nearest neighbor algorithm, second nearest neighbor sample data is collected from the first feature dataset according to the historical system operation anomaly feature data.

[0138] In operation S650, a third feature dataset is constructed based on the second nearest neighbor sample data.

[0139] When operating the S660, a fourth feature dataset is constructed based on historical system operation anomaly feature data.

[0140] According to embodiments of this disclosure, historical system operation anomaly characteristic data may include (a1, a2, a3...a ......a......a......a......a......a......a......a......a......a......a... n Based on the K-nearest neighbor algorithm, K1 nearest neighbor data points that are adjacent to the abnormal operation feature data of the historical system are collected from the normal feature data of the historical system to obtain the first nearest neighbor sample data, for example (b1, b2, b3...b... k1 If the first feature dataset is (a1, a2, a3...a...), then the first feature dataset can be (a1, a2, a3...a...). n b1, b2, b3...b k1 The second feature dataset can be (b) k1+1 b k1+2 b k1+3 ...b m The fourth feature dataset can be (a1, a2, a3...a...). n ).

[0141] According to embodiments of this disclosure, based on the K-nearest neighbor algorithm, K2 nearest neighbor data points that are adjacent to historical system abnormal operation feature data can be collected from the first feature dataset to obtain second nearest neighbor sample data, for example: (b1, b2, b3...b k2 If the third feature dataset can be: (b1, b2, b3...b...), then the dataset can be: (b1, b2, b3...b...). k2 ).

[0142] According to embodiments of this disclosure, by collecting first nearest neighbor sample data from historical system normal operation feature data and combining it with historical system abnormal operation feature data to form a first feature dataset, the problem of introducing noisy samples during random sampling and increasing classification difficulty can be avoided. Then, second nearest neighbor sample data is collected from the first feature dataset. Without synthesizing new sample data, the imbalance of the sample data is improved, thereby enhancing classification performance.

[0143] Figure 7 A flowchart illustrating the generation of anomaly detection results according to an embodiment of this disclosure is shown schematically.

[0144] like Figure 7 As shown, the method for generating anomaly detection results in this embodiment includes operations S710 to S730.

[0145] When operating S710, if the first classification result is that the real-time system operation feature data is classified into the first feature dataset, and the second classification result is that the real-time system operation feature data is classified into the fourth feature dataset, the anomaly detection result is generated as system operation anomaly.

[0146] When operating S720, if the first classification result is that the real-time system operation feature data is classified into the first feature dataset, and the second classification result is that the real-time system operation feature data is classified into the third feature dataset, the anomaly detection result is generated as the system is operating normally.

[0147] When operating S730, if the first classification result is that the real-time system operation feature data is classified into the second feature dataset, and the second classification result is that the real-time system operation feature data is classified into the third feature dataset, the anomaly detection result is generated as the system is operating normally.

[0148] According to embodiments of this disclosure, a system operation feature is considered abnormal only when it is classified into a first feature dataset by a first classification model and into a fourth feature dataset by a second classification model. Otherwise, the system is considered to be operating normally.

[0149] According to embodiments of this disclosure, anomaly detection results are generated based on the first classification result and the second classification result, enabling automatic and accurate detection of database anomalies, reducing manual intervention and alleviating the workload of maintenance personnel.

[0150] Based on the above-described anomaly detection method, this disclosure also provides an anomaly detection device. The following will be combined with... Figure 8 The device is described in detail.

[0151] Figure 8 A schematic block diagram of an anomaly detection apparatus according to an embodiment of the present disclosure is shown.

[0152] like Figure 8 As shown, the anomaly detection device 800 of this embodiment includes an acquisition module 810, a processing module 820, a construction module 830, a first classification module 840, a second classification module 850, and a generation module 860.

[0153] The acquisition module 810 is used to acquire real-time system operation data, historical characteristic data of normal system operation, and historical characteristic data of abnormal system operation from the database monitoring system. In one embodiment, the acquisition module 810 can be used to perform the operation S210 described above, which will not be repeated here.

[0154] The processing module 820 is used to standardize the real-time system operation data to obtain real-time system operation characteristic data. In one embodiment, the processing module 820 can be used to perform the operation S220 described above, which will not be repeated here.

[0155] The construction module 830 is used to construct a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset based on historical system normal operation feature data and historical system abnormal operation feature data. The first feature dataset includes first nearest neighbor sample data and historical system abnormal operation feature data, where the first nearest neighbor sample data represents the data that is closest to the historical system abnormal operation feature data in the historical normal operation feature data. The second feature dataset includes the data remaining after removing the first nearest neighbor sample data from the historical system normal operation feature data. The third feature dataset includes second nearest neighbor sample data. The fourth feature dataset includes historical system abnormal operation feature data, where the second nearest neighbor sample data represents the data that is closest to the historical system abnormal operation feature data in the first feature dataset. In one embodiment, the construction module 830 can be used to perform the operation S230 described above, which will not be repeated here.

[0156] The first classification module 840 is used to input the real-time system running feature data, the first feature dataset, and the second feature dataset into the first classifier to obtain the first classification result. The first classification module 840 can be used to perform the operation S240 described above, which will not be repeated here.

[0157] The second classification module 850 is used to input the real-time system operation feature data, the third feature dataset, and the fourth feature dataset into the second classifier to obtain the second classification result. The second classification module 850 can be used to perform the operation S250 described above, which will not be repeated here.

[0158] The generation module 860 is used to generate anomaly detection results based on the first classification result and the second classification result. The generation module 860 can be used to perform the operation S260 described above, which will not be repeated here.

[0159] According to embodiments of this disclosure, the processing module includes a classification unit, a calculation unit, and a first generation unit. The classification unit is used to classify the real-time system operation data according to its type, obtaining M real-time system operation datasets, where M is a positive integer. The calculation unit is used to calculate the mean and standard deviation of the real-time system operation data in each dataset. The first generation unit is used to generate real-time system operation feature data based on the real-time system operation data, mean, and standard deviation in the dataset.

[0160] According to embodiments of this disclosure, the construction module includes a first acquisition unit, a first construction unit, a removal unit, a second acquisition unit, a second construction unit, and a third construction unit. The first acquisition unit is used to acquire first nearest neighbor sample data from historical normal system operation feature data based on the K-nearest neighbor algorithm and historical system operation anomaly feature data. The first construction unit is used to construct a first feature dataset based on the first nearest neighbor sample data and the historical system operation anomaly feature data. The removal unit is used to remove the first nearest neighbor sample data from the historical system operation normal feature data to obtain a second feature dataset. The second acquisition unit is used to acquire second nearest neighbor sample data from the first feature dataset based on the K-nearest neighbor algorithm and historical system operation anomaly feature data. The second construction unit is used to construct a third feature dataset based on the second nearest neighbor sample data. The third construction unit is used to construct a fourth feature dataset based on the historical system operation anomaly feature data.

[0161] According to embodiments of this disclosure, the generation module includes a second generation unit, a third generation unit, and a fourth generation unit. The second generation unit is configured to generate an anomaly detection result of "system operation abnormal" when the first classification result indicates that the running feature data is classified into a first feature dataset, and the second classification result indicates that the running feature data is classified into a fourth feature dataset. The third generation unit is configured to generate an anomaly detection result of "system operation normal" when the first classification result indicates that the running feature data is classified into a first feature dataset, and the second classification result indicates that the running feature data is classified into a third feature dataset. The fourth generation unit is configured to generate an anomaly detection result of "system operation normal" when the first classification result indicates that the running feature data is classified into a second feature dataset, and the second classification result indicates that the running feature data is classified into a third feature dataset.

[0162] According to embodiments of this disclosure, any plurality of modules among the acquisition module 810, processing module 820, construction module 830, first classification module 840, second classification module 850, and generation module 860 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the acquisition module 810, processing module 820, construction module 830, first classification module 840, second classification module 850, and generation module 860 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the acquisition module 810, processing module 820, construction module 830, first classification module 840, second classification module 850 and generation module 860 may be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0163] Figure 9 A block diagram schematically illustrates an electronic device suitable for implementing an anomaly detection method according to an embodiment of the present disclosure.

[0164] like Figure 9 As shown, an electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage portion 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0165] RAM 903 stores various programs and data required for the operation of electronic device 900. Processor 901, ROM 902, and RAM 903 are interconnected via bus 904. Processor 901 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 902 and / or RAM 903. It should be noted that the programs may also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0166] According to embodiments of this disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to a bus 904. The electronic device 900 may also include one or more of the following components connected to the I / O interface 905: an input section 906 including a keyboard, mouse, etc.; an output section 907 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 908 including a hard disk, etc.; and a communication section 909 including a network interface card such as a LAN card, modem, etc. The communication section 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 910 as needed so that computer programs read from it can be installed into the storage section 908 as needed.

[0167] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0168] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 902 and / or RAM 903 and / or one or more memories other than ROM 902 and RAM 903 described above.

[0169] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to cause the computer system to implement the methods described above in the embodiments of this disclosure.

[0170] When the computer program is executed by the processor 901, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0171] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 909, and / or installed from a removable medium 911. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0172] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0173] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0174] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0175] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0176] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of this disclosure is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. An anomaly detection method, comprising: Obtain real-time system operation data, historical normal system operation characteristic data, and historical abnormal system operation characteristic data from the database monitoring system; The real-time system operation data is standardized to obtain real-time system operation characteristic data. Based on the historical system normal operation feature data and the historical system abnormal operation feature data, a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset are constructed. The first feature dataset includes first nearest neighbor sample data and the historical system abnormal operation feature data, where the first nearest neighbor sample data represents the data in the historical system normal operation feature data that is adjacent to the historical system abnormal operation feature data. The second feature dataset includes the data remaining in the historical system normal operation feature data after removing the first nearest neighbor sample data. The third feature dataset includes second nearest neighbor sample data. The fourth feature dataset includes the historical system abnormal operation feature data, where the second nearest neighbor sample data represents the data in the first feature dataset that is adjacent to the historical system abnormal operation feature data. The real-time system operation feature data, the first feature dataset, and the second feature dataset are input into the first classification model to obtain the first classification result; The real-time system operation feature data, the third feature dataset, and the fourth feature dataset are input into the second classification model to obtain the second classification result; If the first classification result indicates that the real-time system operation feature data is classified into the first feature dataset, and the second classification result indicates that the real-time system operation feature data is classified into the fourth feature dataset, then an anomaly detection result is generated as system operation anomaly. If the first classification result indicates that the real-time system operation feature data is classified into the first feature dataset, and the second classification result indicates that the real-time system operation feature data is classified into the third feature dataset, then the anomaly detection result is generated as "system is operating normally". If the first classification result indicates that the real-time system operation feature data is classified into the second feature dataset, and the second classification result indicates that the real-time system operation feature data is classified into the third feature dataset, then the anomaly detection result is generated as "system is operating normally".

2. The method of claim 1, wherein, The training methods for the first classification model include: The first feature dataset and the second feature dataset are input into the first initial classification model for training to obtain the first training classification result; Based on the first training classification result, a first confusion matrix is ​​constructed, wherein the first confusion matrix includes first classification result data, second classification result data, and third classification result data; the first classification result data represents the number of samples of historical abnormal feature data classified into the first feature dataset, the second classification result data represents the number of samples of historical abnormal feature data classified into the second feature dataset, and the third classification result data represents the number of samples of historical normal feature data classified into the first feature dataset. Based on the first classification result data, the second classification result data, and the third classification result data, the first classification performance index data of the first initial classification model is generated; If the first classification performance index data meets the first preset condition, the first classification model that has been trained is obtained.

3. The method according to claim 1, wherein, The training methods for the second classification model include: The third feature dataset and the fourth feature dataset are input into the second initial classification model for training to obtain the second training classification result; Based on the second training classification result, a second confusion matrix is ​​constructed, wherein the second confusion matrix includes fourth classification result data, fifth classification result data, and sixth classification result data; the fourth classification result data represents the number of samples of historical abnormal feature data classified into the fourth feature dataset, the fifth classification result data represents the number of samples of historical abnormal feature data classified into the third feature dataset, and the sixth classification result data represents the number of samples of historical normal feature data classified into the fourth feature dataset; Based on the fourth classification result data, the fifth classification result data, and the sixth classification result data, the second classification performance index data of the second initial classification model is generated; If the second classification performance index data meets the second preset conditions, the trained second classification model is obtained.

4. The method according to claim 1, wherein, The process of standardizing the real-time system operation data to obtain real-time system operation characteristic data includes: Based on the type of the real-time system operation data, the real-time system operation data is classified to obtain M real-time system operation datasets, where M is a positive integer; For each real-time system operation dataset, calculate the mean and standard deviation of the real-time system operation data in the dataset. The real-time system operation feature data is generated based on the real-time system operation data in the real-time system operation dataset and the average value and the standard deviation.

5. The method according to claim 1, wherein, Based on the historical system normal operation characteristic data and the historical system abnormal operation characteristic data, a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset are constructed, including: Based on the K-nearest neighbor algorithm, the first nearest neighbor sample data is collected from the historical system normal operation feature data according to the historical system operation abnormal feature data; The first feature dataset is constructed based on the first nearest neighbor sample data and the historical system operation anomaly feature data; The first nearest neighbor sample data is removed from the historical system normal operation feature data to obtain the second feature dataset. Based on the K-nearest neighbor algorithm, second nearest neighbor sample data are collected from the first feature dataset according to the historical system operation anomaly feature data; The third feature dataset is constructed based on the second nearest neighbor sample data; The fourth feature dataset is constructed based on the historical system operation anomaly feature data.

6. An anomaly detection device, comprising: The acquisition module is used to acquire real-time system operation data, historical system normal operation characteristic data, and historical system abnormal operation characteristic data from the database monitoring system. The processing module is used to standardize the real-time system operation data to obtain real-time system operation characteristic data; A construction module is used to construct a first feature dataset, a second feature dataset, a third feature dataset, and a fourth feature dataset based on the historical system normal operation feature data and the historical system abnormal operation feature data. The first feature dataset includes first nearest neighbor sample data and the historical system abnormal operation feature data, where the first nearest neighbor sample data represents data that is nearest to the historical system abnormal operation feature data in the historical system normal operation feature data. The second feature dataset includes the data remaining after removing the first nearest neighbor sample data from the historical system normal operation feature data. The third feature dataset includes second nearest neighbor sample data. The fourth feature dataset includes the historical system abnormal operation feature data, where the second nearest neighbor sample data represents data that is nearest to the historical system abnormal operation feature data in the first feature dataset. The first classification module is used to input the real-time system operation feature data, the first feature dataset, and the second feature dataset into the first classification model to obtain the first classification result; The second classification module is used to input the real-time system operation feature data, the third feature dataset, and the fourth feature dataset into the second classification model to obtain the second classification result; and The generation module is configured to generate an anomaly detection result of "system operation abnormal" when the first classification result indicates that the real-time system operation feature data is classified into the first feature dataset, and the second classification result indicates that the real-time system operation feature data is classified into the fourth feature dataset; generate an anomaly detection result of "system operation normal" when the first classification result indicates that the real-time system operation feature data is classified into the first feature dataset, and the second classification result indicates that the real-time system operation feature data is classified into the third feature dataset; and generate an anomaly detection result of "system operation normal" when the first classification result indicates that the real-time system operation feature data is classified into the second feature dataset, and the second classification result indicates that the real-time system operation feature data is classified into the third feature dataset.

7. An electronic device, comprising: One or more processors; Storage device for storing one or more programs. Wherein, when the one or more programs are executed by the one or more processors, the one or more processors perform the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to perform the method according to any one of claims 1 to 5.

9. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1 to 5.

Images