An operation and maintenance index detection method based on double-layer feature enhancement and improved VAE

Abstract

The application provides an operation and maintenance index detection method based on double-layer feature enhancement and improved VAE in the technical field of IT operation and maintenance, and comprises the following steps: step S10, obtaining an operation and maintenance index, and performing time series feature enrichment preprocessing on the obtained operation and maintenance index; step S20, performing double-layer feature extraction on the preprocessed operation and maintenance index to construct a feature data set; step S30, creating an index anomaly detection model based on improved VAE; step S40, setting an anomaly threshold of the index anomaly detection model based on KDE; and step S50, performing anomaly detection on the feature data set by using the index anomaly detection model after the anomaly threshold is set. The application has the advantage that the recognition rate of operation and maintenance index anomaly detection is greatly improved.

Description

Technical Field

[0001] This invention relates to the field of IT operations and maintenance technology, and in particular to an operations and maintenance indicator detection method based on dual-layer feature enhancement and improved VAE. Background Technology

[0002] With the rapid development of artificial intelligence technology, the IT operations and maintenance (O&M) field is gradually entering a new era of intelligent O&M. Anomaly detection is a crucial part of IT O&M work, and it mostly targets anomalies in various O&M indicators, using time-series data. In actual O&M scenarios, the detection of various O&M indicators is carried out in a real-time monitoring manner. When an anomaly occurs at a certain moment, it is necessary to quickly and accurately detect that moment; that is, given O&M indicators from historical moments x1 to xt, it is necessary to determine whether there is an anomaly at moment xt.

[0003] Traditionally, there are three main methods for anomaly detection in operational metrics (time series data): 1. Statistical methods: These assume that the operational metrics follow a certain probability distribution and select an appropriate model to determine whether there are anomalies based on the distribution. However, this method tends to identify a large number of points as anomalies, resulting in poor detection performance. 2. Supervised learning methods: These methods label normal and anomaly points in historical operational metrics, extract relevant features, and build a classification model to identify anomalies in the data. However, this method relies on a large amount of labeled data, requires significant manpower, and demands high label accuracy. Furthermore, actual operational metrics often have fewer anomalies, leading to extreme sample imbalance in the classification model and poor detection performance. 3. Unsupervised learning and deep generative models: These methods focus on normal data, identifying potential normal regions through algorithms and determining whether data is anomaly by measuring the distance between other data and these normal regions. However, defining the anomaly distance is difficult, making it hard to control the effectiveness. Additionally, a single deep generative model cannot extract the time-series features from the operational metrics.

[0004] Therefore, how to provide a method for detecting operation and maintenance indicators based on dual-layer feature enhancement and improved VAE, so as to improve the recognition rate of abnormal operation and maintenance indicators, has become a technical problem that urgently needs to be solved. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a method for detecting operation and maintenance indicators based on dual-layer feature enhancement and improved VAE, so as to improve the recognition rate of anomaly detection of operation and maintenance indicators.

[0006] This invention is implemented as follows: a method for detecting operation and maintenance indicators based on dual-layer feature enhancement and improved VAE, comprising the following steps:

[0007] Step S10: Obtain operation and maintenance indicators, and perform time-series-rich preprocessing on the obtained operation and maintenance indicators;

[0008] Step S20: Perform two-layer feature extraction on the preprocessed operation and maintenance indicators to construct a feature dataset;

[0009] Step S30: Create an indicator anomaly detection model based on the improved VAE;

[0010] Step S40: Set the anomaly threshold of the anomaly detection model based on KDE;

[0011] Step S50: Use the indicator anomaly detection model with the set anomaly threshold to perform anomaly detection on the feature dataset.

[0012] Further, step S10 specifically includes:

[0013] Obtain operation and maintenance indicators, and perform time-series-rich preprocessing on the obtained operation and maintenance indicators through a first sliding window;

[0014] Let the length of the first sliding window be W, the step size be 1, and the length of the operation and maintenance indicator be N. Ultimately, N-W+1 first sliding windows are generated. The formula for the first sliding window is as follows:

[0015] NW i ={n i ,n i+1 ,...,n i+W-1};

[0016] Among them, NW i Represents the i-th first sliding window; n i NW i The first indicator; n i+W-1 NW i The last indicator.

[0017] Further, step S20 specifically includes:

[0018] Step S21: Perform a layer of feature extraction on the preprocessed operation and maintenance indicators to obtain S(NW) i ) and M2(NW i ):

[0019]

[0020] M2(NW i )=S(NW i )-S(NW i-1 );

[0021] Among them, S(NW iM2(NW) is a feature used to reflect changes in samples within the first sliding window; i () is a feature used to reflect the temporal relationship between the first sliding windows;

[0022] Step S22: Create a second sliding window with length b and step size b / 2, and perform S(NW) based on the second sliding window. i ) and M2(NW i Two-layer feature extraction is performed to obtain a feature dataset including mean, minimum, 25th percentile, median, 75th percentile, skewness, and kurtosis.

[0023] Further, step S30 specifically includes:

[0024] The BP neural network in VAE is replaced with an LSTM network with residual gates to create an indicator anomaly detection model.

[0025] Further, step S40 specifically includes:

[0026] Step S41: Calculate the anomaly score of each feature in the feature dataset using the anomaly detection model:

[0027]

[0028]

[0029] Where s represents the anomaly score; This represents the feature sequence predicted by the anomaly detection model at time t. Indicates to The feature sequence obtained by decoding and reconstruction; w t Represents the original feature sequence in the feature dataset; || ||2 represents the 2-norm;

[0030] Step S42: Calculate the probability density function of the outlier score based on KDE:

[0031]

[0032] Where p(s) represents the probability density function; n represents the number of samples in the feature dataset; h represents the parameter bandwidth in KDE; s i Let K represent the anomaly score of the i-th sample; K() represents the kernel function.

[0033] Step S43: Calculate the distribution function of the probability density function based on CDF:

[0034]

[0035] Where F(s) represents the distribution function; ds represents the integral over s;

[0036] Step S44: Set a significance level parameter α, and set the anomaly threshold s of the indicator anomaly detection model based on the significance level parameter α. α .

[0037] Furthermore, in step S42, K() is a Gaussian kernel function.

[0038] Furthermore, in step S44, the significance level parameter α is set to 0.05.

[0039] Further, in step S44, the abnormal threshold s α Satisfy F(s) α )=1-α.

[0040] Further, step S50 specifically includes:

[0041] The feature dataset is input into the anomaly detection model to calculate anomaly scores. It is then determined whether each anomaly score is greater than an anomaly threshold. If so, the index corresponding to the anomaly score is an anomaly index; otherwise, there is no anomaly index.

[0042] The advantages of this invention are:

[0043] The system first performs time-series feature-rich preprocessing on the operation and maintenance metrics through a sliding window, and then performs two-layer feature extraction on the preprocessed operation and maintenance metrics to fully explore the data characteristics of the operation and maintenance metrics. By improving the VAE, the BP neural network in the VAE is replaced with an LSTM network with residual gates, thereby creating an anomaly detection model for the metrics. This model can better encode and decode time-series data and effectively prevent gradient vanishing. The anomaly threshold is adaptively set according to the samples of the feature dataset using the KDE method, without relying on human experience, making the setting of the anomaly threshold more reasonable and ultimately greatly improving the recognition rate of operation and maintenance metrics anomaly detection. Attached Figure Description

[0044] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0045] Figure 1 This is a flowchart of an operation and maintenance indicator detection method based on dual-layer feature enhancement and improved VAE according to the present invention.

[0046] Figure 2 This is a schematic diagram of the dual-layer feature enhancement of the present invention.

[0047] Figure 3 This is a schematic diagram of the structure of the anomaly detection model of the present invention.

[0048] Figure 4 This is a schematic diagram of the residual LSTM structure of the present invention. Detailed Implementation

[0049] The overall approach of the technical solution in this application is as follows: A sliding window is used to enrich the temporal features of operation and maintenance indicators, and a two-layer feature extraction method is combined to fully explore the characteristics of data with temporal changes; by replacing the BP neural network in the VAE with an LSTM network with a residual gate, the encoding and decoding of time series data can be improved, effectively preventing gradient vanishing; the KDE method is used to adaptively set the anomaly threshold based on the samples of the feature dataset, making the setting of the anomaly threshold more reasonable, thereby improving the recognition rate of anomaly detection in operation and maintenance indicators.

[0050] Please refer to Figures 1 to 4 As shown, a preferred embodiment of the operation and maintenance indicator detection method based on dual-layer feature enhancement and improved VAE of the present invention includes the following steps:

[0051] Step S10: Obtain operation and maintenance indicators, and perform time-series-rich preprocessing on the obtained operation and maintenance indicators;

[0052] Step S20: Perform two-layer feature extraction on the preprocessed operation and maintenance indicators to construct a feature dataset;

[0053] Step S30: Create an indicator anomaly detection model based on the improved VAE;

[0054] Step S40: Set the anomaly threshold of the anomaly detection model based on KDE;

[0055] Step S50: Use the indicator anomaly detection model with the set anomaly threshold to perform anomaly detection on the feature dataset.

[0056] This invention uses an unsupervised method for anomaly detection, eliminating the need for manual data annotation and greatly saving labor costs.

[0057] Step S10 specifically involves:

[0058] The operation and maintenance indicators are obtained, and the obtained operation and maintenance indicators are preprocessed with rich time-series features through the first sliding window; that is, the operation and maintenance indicators are sliced ​​through the first sliding window.

[0059] Let the length of the first sliding window be W, the step size be 1, and the length of the operation and maintenance indicator be N. Ultimately, N-W+1 first sliding windows are generated. The formula for the first sliding window is as follows:

[0060] NW i ={n i ,n i+1 ,...,ni+W-1};

[0061] Among them, NW i Represents the i-th first sliding window; n i NW i The first indicator; n i+W-1 NW i The last indicator.

[0062] Step S20 specifically includes:

[0063] Step S21: Perform a layer of feature extraction on the preprocessed operation and maintenance indicators to obtain S(NW) i ) and M2(NW i ):

[0064]

[0065] M2(NW i )=S(NW i )-S(NW i-1 );

[0066] Among them, S(NW i M2(NW) is a feature used to reflect changes in samples within the first sliding window; i () is a feature used to reflect the temporal relationship between the first sliding windows;

[0067] Step S22: Create a second sliding window with length b and step size b / 2, and perform S(NW) based on the second sliding window. i ) and M2(NW i Two-layer feature extraction is performed to obtain a feature dataset including mean, minimum, 25th percentile, median, 75th percentile, skewness, and kurtosis.

[0068] Step S30 specifically includes:

[0069] A new indicator anomaly detection model is created by replacing the BP neural network in the VAE with an LSTM network that includes residual gates. This model identifies outliers in the feature dataset by reconstructing errors.

[0070] Traditional VAE-based anomaly detection models encode and decode the original feature data, determining outliers based on reconstruction errors. However, they cannot effectively encode and decode temporal information in time-series data, and gradient vanishing may occur during feature extraction. Since LSTM networks are commonly used to process time-series data, this paper replaces the BP neural network in VAE with an LSTM network and adds a residual gate to the LSTM network to solve the gradient vanishing problem. Specifically, the input to the cell unit is added to the cell unit's output state through a residual gate. The formula for the residual gate is as follows:

[0071] r t =sigmoid(W r ·x t +b r ).

[0072] Step S40 specifically includes:

[0073] Step S41: Calculate the anomaly score of each feature in the feature dataset using the anomaly detection model:

[0074]

[0075]

[0076] Where s represents the outlier score, i.e., the score obtained by comparison. and w t This is used to calculate the reconstruction error and then mark abnormal behavior of operation and maintenance indicators; This represents the feature sequence predicted by the anomaly detection model at time t. Indicates to The feature sequence obtained by decoding and reconstruction; w t Represents the original feature sequence in the feature dataset; ||||2 represents the 2-norm;

[0077] Step S42: Calculate the probability density function of the outlier score based on KDE:

[0078]

[0079] Where p(s) represents the probability density function; n represents the number of samples in the feature dataset; h represents the parameter bandwidth in KDE; s i Let K represent the anomaly score of the i-th sample; K() represents the kernel function.

[0080] Step S43: Calculate the distribution function of the probability density function based on CDF:

[0081]

[0082] Where F(s) represents the distribution function; ds represents the integral over s;

[0083] Step S44: Set a significance level parameter α, and set the anomaly threshold s of the indicator anomaly detection model based on the significance level parameter α. α .

[0084] KDE is a nonparametric method for estimating the probability density function of a random variable. It does not require assumptions about the distribution function form of the variable under study. Therefore, outlier scores of normal data can be used as training data. KDE is used to estimate the probability density function of outlier scores of normal data. Then, CDF is used to obtain the probability distribution of all data less than or equal to a set threshold. The false positive rate and false negative rate of the model are balanced by the significance level.

[0085] In step S42, K() is the Gaussian kernel function.

[0086] In step S44, the significance level parameter α is set to 0.05. The larger the value of α, the lower the false alarm rate; the smaller the value of α, the lower the false alarm rate. In order to balance the false alarm rate and the false alarm rate, the value of α is set to 0.05.

[0087] In step S44, the abnormal threshold s α Satisfy F(s) α )=1-α.

[0088] Step S50 specifically involves:

[0089] The feature dataset is input into the anomaly detection model to calculate anomaly scores. It is then determined whether each anomaly score is greater than an anomaly threshold. If so, the index corresponding to the anomaly score is an anomaly index; otherwise, there is no anomaly index.

[0090] Compared with traditional VAE anomaly detection models, this invention reduces the false alarm rate by 1.9% and the false negative rate by 1.3%, both higher than traditional VAE anomaly detection models. False alarm rate = total number of data points that are actually normal but detected as abnormal / actual number of normal data points; False negative rate = total number of data points that are actually abnormal but detected as normal / actual number of abnormal data points.

[0091] In summary, the advantages of this invention are:

[0092] The system first performs time-series feature-rich preprocessing on the operation and maintenance metrics through a sliding window, and then performs two-layer feature extraction on the preprocessed operation and maintenance metrics to fully explore the data characteristics of the operation and maintenance metrics. By improving the VAE, the BP neural network in the VAE is replaced with an LSTM network with residual gates, thereby creating an anomaly detection model for the metrics. This model can better encode and decode time-series data and effectively prevent gradient vanishing. The anomaly threshold is adaptively set according to the samples of the feature dataset using the KDE method, without relying on human experience, making the setting of the anomaly threshold more reasonable and ultimately greatly improving the recognition rate of operation and maintenance metrics anomaly detection.

[0093] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting operation and maintenance indicators based on dual-layer feature enhancement and improved VAE, characterized in that: Includes the following steps: Step S10: Obtain operation and maintenance indicators, and perform time-series-rich preprocessing on the obtained operation and maintenance indicators; Step S20: Perform two-layer feature extraction on the preprocessed operation and maintenance indicators to construct a feature dataset; Step S30: Create an indicator anomaly detection model based on the improved VAE; Step S40: Set the anomaly threshold of the anomaly detection model based on KDE; Step S50: Use the indicator anomaly detection model with the set anomaly threshold to perform anomaly detection on the feature dataset; Step S10 specifically involves: Obtain operation and maintenance indicators, and perform time-series-rich preprocessing on the obtained operation and maintenance indicators through a first sliding window; Let the length of the first sliding window be The step size is 1, and the length of the operation and maintenance indicator is... Finally generated A first sliding window, the formula for which the first sliding window is expressed is: ; in, Indicates the first The first sliding window; express The first indicator; express The last indicator; Step S20 specifically includes: Step S21: Perform a layer of feature extraction on the preprocessed operation and maintenance indicators to obtain... as well as : ; ; in, It is a feature used to reflect changes in samples within the first sliding window; It is a feature used to reflect the temporal relationship between the first sliding windows; Step S22: Create a second sliding window with length b and step size b / 2, and then perform operations based on the second sliding window. and Two-layer feature extraction is performed to obtain a feature dataset including mean, minimum, 25th percentile, median, 75th percentile, skewness, and kurtosis; Step S30 specifically includes: The BP neural network in VAE is replaced with an LSTM network with residual gates to create an indicator anomaly detection model.

2. The operation and maintenance indicator detection method based on dual-layer feature enhancement and improved VAE as described in claim 1, characterized in that: Step S40 specifically includes: Step S41: Calculate the anomaly score of each feature in the feature dataset using the anomaly detection model: ; ; in, Indicates anomaly scores; This represents the feature sequence predicted by the anomaly detection model at time t. Indicates to The feature sequence obtained by decoding and reconstruction; This represents the original feature sequence in the feature dataset; Represents the 2-norm; Step S42: Calculate the probability density function of the outlier score based on KDE: ; in, Represents the probability density function; This indicates the number of samples in the feature dataset; This represents the bandwidth parameter in KDE; Indicates the first Anomaly scores for each sample; Represents the kernel function; Step S43: Calculate the distribution function of the probability density function based on CDF: ; in, Represents the distribution function; Indicates to Integrate points; Step S44: Set a significance level parameter Based on the significance level parameter Set the anomaly threshold for the indicator anomaly detection model .

3. The operation and maintenance indicator detection method based on dual-layer feature enhancement and improved VAE as described in claim 2, characterized in that: In step S42 This is the Gaussian kernel function.

4. The operation and maintenance indicator detection method based on dual-layer feature enhancement and improved VAE as described in claim 2, characterized in that: In step S44, the significance level parameter The value is 0.

05.

5. The operation and maintenance indicator detection method based on dual-layer feature enhancement and improved VAE as described in claim 2, characterized in that: In step S44, the abnormal threshold satisfy .

6. The operation and maintenance indicator detection method based on dual-layer feature enhancement and improved VAE as described in claim 1, characterized in that: Step S50 specifically involves: The feature dataset is input into the anomaly detection model to calculate anomaly scores. It is then determined whether each anomaly score is greater than an anomaly threshold. If so, the index corresponding to the anomaly score is an anomaly index; otherwise, there is no anomaly index.

Images