Bi-TCN and adversarial vae fusion-based kpi anomaly detection method

Abstract

The application discloses a KPI anomaly detection method fusing Bi-TCN and an adversarial VAE. The method comprises the following steps: S1, data preprocessing; S2, model initialization, random initialization and assignment of model parameters, and parameter setting; S3, model training; and S4, model testing, same data processing is performed on the test, a reconstructed error is obtained by inputting the trained model, and a threshold value generated by using an automatic threshold method is used to determine whether an anomaly exists. The application uses a variational autoencoder for adversarial training, the VAE is more robust to noise and abnormal values, and adversarial training can more efficiently amplify the reconstructed error of an input containing an anomaly to distinguish normal KPI data from abnormal KPI data.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of machine learning, in particular to a KPI anomaly detection method fusing Bi-TCN and adversarial VAE. BACKGROUND

[0002] AIOps refers to an operation and maintenance mode in which rules are learned and summarized from massive operation and maintenance data automatically by artificial intelligence algorithms such as machine learning, and decisions are made. Existing operation and maintenance data mainly includes log data, key performance indicators (KPIs), and call chains. KPI data is obtained from APM monitoring tools or log analysis, such as page access volume, server CPU utilization, router memory usage, and switch throughput. Close detection of KPI data can capture fault information in time, and then repair faults and reduce losses in time. KPI data has the characteristics of instability, diversity, complexity, and large data volume. However, anomaly detection of operation and maintenance data needs to accurately reflect the abnormal state of data in time. Therefore, the anomaly detection method relying on operation and maintenance personnel to check and analyze a large amount of operation and maintenance data cannot obtain effective analysis and detection. With the generation of massive operation and maintenance data, artificial intelligence technology is gradually applied to the data field, which automatically learns the internal relationship between data from operation and maintenance data and summarizes rules, and realizes the automation of KPI data anomaly detection.

[0003] KPI data is a kind of time series data obtained by periodic detection, which has the characteristics of multiple data instances and high dimensions. KPI data has different forms. At the Internet business level, it has the characteristics of regularity and periodicity, while at the machine level, it has irregular fluctuations and different forms. In addition, KPI data has a large number of missing values, which introduces noise, and is affected by a series of special events such as business changes and resource scheduling, which may cause concept drift phenomenon, affecting the anomaly detection result.

[0004] Currently, KPI-based anomaly detection methods can be divided into three categories: statistical methods, traditional machine learning methods, and deep learning methods. The statistical method is based on the autoregressive integrated moving average (ARIMA) model, which is based on three characteristics of the sequence: autoregression (AR), difference integration (I), and moving average (MA). The difference between the current value is predicted. The exponentially weighted moving average (EWMA) assigns a weight coefficient to each data point in the window, giving the most recent data point a higher weight and calculating the weighted moving average as the predicted value of the current value. The traditional machine learning method includes the supervised training model Opprentice based on the random forest algorithm, the semi-supervised model ADS and PUAD, which use the POCKA algorithm to cluster KPI time series. KPIs in the same cluster share label information, and the iRRCF model is based on unsupervised and active learning for practical white-box anomaly detection. The deep learning method Dount uses a variational autoencoder to perform unsupervised anomaly detection on periodic KPI time series. KPI-TSAD uses a variational autoencoder (VAE) oversampling model to solve the data imbalance problem and a deep model based on convolution and LSTM network for prediction. Buzz uses a VAE-based unsupervised model for adversarial training to detect anomalies in complex KPI data. OmniAnomaly is a robust anomaly detection method for multivariate time series based on a stochastic recurrent network. TadGAN is an unsupervised anomaly detection method based on a generative network and an LSTM recurrent network. SUMMARY

[0005] In order to enable the computer to automatically, efficiently and accurately perform KPI anomaly detection, there are still some problems in the existing KPI anomaly detection methods that need to be solved. The present application aims to solve the following problems:

[0006] With the increase in the latitude and length of KPI data, the current KPI anomaly detection method cannot effectively capture the complex correlation of KPI data, resulting in poor anomaly detection results.

[0007] Deep autoencoders have been widely used in anomaly detection, but the anomaly detection method based on autoencoders has limitations. For some unknown anomalies, there may be similar patterns with normal samples, resulting in missed detection. And the autoencoder is very sensitive to noise in the data, as KPI data contains a large number of missing values, which will introduce noise and affect the performance of the autoencoder.

[0008] Therefore, it is necessary to provide a KPI anomaly detection method fusing Bi-TCN and adversarial VAE in view of the above technical problems. Bi-TCN, bidirectional temporal convolution network; VAE, Variational Auto-Encoder.

[0009] Specifically, the KPI anomaly detection method fusing Bi-TCN and adversarial VAE comprises the following steps.

[0010] S1, data preprocessing;

[0011] S2, model initialization, randomly initializing and assigning values to model parameters, and setting parameters;

[0012] S3, model training, inputting the processed data into a training module to learn a normal mode of a sequence, using a bidirectional temporal convolution network to capture KPI sequence information in an encoder part of a variational auto-encoder, reconstructing compressed data through two decoders, and forming an adversarial training between the two variational encoders to amplify reconstruction error of an input containing an anomaly;

[0013] S4, model testing, performing the same data processing on testing, inputting the trained model to obtain reconstruction error, and using a threshold generated by an automatic threshold method to determine whether it is abnormal.

[0014] Further, the specific steps of S1 are as follows:

[0015] S11, missing value processing, KPI data generally has a missing data at a certain moment, and a multiple imputation method is used to process the missing value in the preprocessing stage;

[0016] S12, data standardization, using Z-score to standardize KPI data;

[0017] S13, using a sliding window with a sliding window size W to process KPI data to obtain KPI sequences for learning KPI normal mode and anomaly detection.

[0018] Further, in S12, the following formula is used:

[0019]

[0020] wherein x is the original data, μ is the average value of the original data, and σ is the standard deviation of the original data.

[0021] Further, in S3, taking input X as an example, the Bi-TCN residual block is calculated according to formula (2-5), and the dilated convolution calculation formula is shown in formula (6-7), wherein d represents the dilated rate, which increases exponentially by 2 (d = 1, 2, 4...), and k represents the size of the convolution kernel:

[0022] Z`=Conv1(X) (2)

[0023] Z``=dropout(ReLU(WeightNorm(Dilatedconv(X,k,d)))) (3)

[0024] Z```=dropout(ReLU(WeightNorm(Dilatedconv(Z``,k,d)))) (4)

[0025] Z````=ReLU(Z`+Z```) (5)

[0026] padding=(k-1)*d / 2 (6)

[0027]

[0028] Further, in S3, the reconstruction error of the adversarial-based variational autoencoder loss function BTVAE is shown in formula (8-9), and the KL divergence is shown in formula (10), wherein n is the number of iterations of training, and BTVAE(X) represents the output of X after passing through the encoder and the decoder;

[0029]

[0030]

[0031]

[0032] Further, in S4, the test data is also subjected to missing value processing and standardization processing, and then the trained model is used to encode and decode the data to obtain the final anomaly score, as shown in the following formula, wherein α and β are the coefficients of the anomaly score for measuring the proportion of adversarial training, α + β = 1,

[0033] score(X)=α||X-BTVAE1(X)||2+β||X-BTVAE2(BTVAE1(X))||2(11);

[0034] The peak-over-threshold method is used as the threshold selection method, and the optimal threshold λ is selected through cross-validation; the anomaly determination formula is shown as follows: if the anomaly score is greater than or equal to the threshold value, it is determined to be abnormal, otherwise it is normal.

[0035]

[0036] According to another aspect of the present application, there is provided a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the KPI anomaly detection method of fusing Bi-TCN and adversarial VAE of the present application.

[0037] According to still another aspect of the present application, there is provided a computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the KPI anomaly detection method of fusing Bi-TCN and adversarial VAE of the present application when executing the program.

[0038] Compared with the prior art, the present application has at least the following beneficial effects:

[0039] Using multiple imputation and Z-score standardization for KPI data preprocessing can better process KPI data and reduce the introduction of noise. Multiple imputation can predict missing values by establishing a regression model based on the information of the complete data subset. Z-score standardization can consider the mean and standard deviation of sample data, thereby better reflecting the fluctuation of data.

[0040] Introducing bidirectional temporal convolution network as the basic architecture of variational autoencoder can better capture the long-term and short-term dependence of KPI data sequence. The number of parameters of the temporal convolution layer is usually less than that of the fully connected layer, so the complexity of the model can be reduced, and long KPI sequence data can be effectively processed.

[0041] Using variational autoencoder for adversarial training, VAE is more robust to noise and outliers, and adversarial training can more efficiently amplify the reconstruction error of the input containing outliers to distinguish normal KPI data and abnormal KPI data. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 Schematic diagram for training model of the present application;

[0043] Figure 2 Schematic diagram for Bi-TCN residual block and dilated convolution of the present application;

[0044] Figure 3 Schematic diagram for training algorithm of the present application;

[0045] Figure 4 Schematic diagram for detection algorithm of the present application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical scheme and advantages of the present application clearer, the present application will be further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and not to limit the present application.

[0047] Embodiment 1:

[0048] In one embodiment, as shown in Figures 1-4 A KPI anomaly detection method combining Bi-TCN and adversarial VAE is provided, comprising the following steps:

[0049] S1, data preprocessing.

[0050] S11, missing value processing: in real application scenarios, KPI data is usually incomplete and contains noise. In order to eliminate the influence of data on the algorithm, multiple imputation method is used to process the missing values of KPI data. The basic steps of multiple imputation method are as follows: first, identify and record all missing values in the data set, and randomly select a variable containing missing values in the data set as the target variable, and regard it as the response variable. Use other variables without missing values as predictor variables, establish a regression model between them to predict the missing values in the target variable, and then compare with the actual observation value to calculate the prediction error. Different target variables are selected for multiple predictions each time, and all predicted values are combined to obtain the final imputed value by using the average value.

[0051] S12, data standardization: data standardization is one of the basic operations in data mining. When performing data analysis, different evaluation indicators usually have different measurement units and dimensions, which may affect the accuracy of the results. In order to solve the influence of the dimension difference between indicators on data analysis, it is necessary to standardize the data to eliminate the influence of the measurement units and dimensions between different indicators, ensure their comparability and improve the accuracy of the analysis results. Considering the factors of KPI time series, such as seasonal factors, trend factors, etc., Z-Score method is used for standardization processing, which converts the original data into a standard normal distribution with zero mean and unit variance to make the data comparable, considering the mean and standard deviation of the sample data, so as to better reflect the fluctuation of the data. The formula is shown below, where x is the original data, μ is the mean of the original data, and σ is the standard deviation of the original data.

[0052]

[0053] S13, sliding window: in order to improve the accuracy of KPI data, the present application uses sliding window to process KPI sequence. Using sliding window can increase the data sample size, and can capture the local characteristics of data within the time window, such as short-term fluctuations, seasonal changes and trend changes.

[0054] S2, model initialization. The number of model training rounds is set to 100 rounds, the window size w is 20, and the learning rate is set to 0.002. The encoder part contains four layers of Bi-TCN residual blocks, and the convolution kernel size k is set to 3, and the dropout is set to 0.2. The decoder part uses a symmetric time convolution layer to perform an inverse convolution operation on the latent vector, so that it is restored to the original data form.

[0055] S3, model training. The bidirectional time convolution-based variational autoencoder is referred to as BTVAE, which includes an encoder and two decoders. Model training is divided into a variational autoencoder training stage and an adversarial training stage.

[0056] In the variational autoencoder training stage, the KPI data preprocessing input data X is sent to the bidirectional time convolution-based encoder, and the time convolution layer can perform convolution operation on the input KPI time series data to extract its time series features, thereby obtaining the latent vector Z obeying the normal distribution, and then the decoder is used to obtain the reconstruction output result, so that the encoder learns the normal KPI sequence pattern. Bidirectional time convolution is obtained by expanding the time convolution network, and a series of different size convolution kernels can capture the long-term and short-term context dependence relationship of each data from the KPI sequence context information, thereby effectively enhancing the context representation. In addition, the number of parameters of the time convolution layer is usually less than that of the fully connected layer, so the complexity of the model can be reduced. The encoder part contains four layers of Bi-TCN residual blocks, each block contains two layers of dilated convolution and nonlinear mapping, and WeightNorm and Dropout are also added in each layer to regularize the network, residual connection is used to optimize the back propagation of the gradient, and dilated convolution is used to construct the residual block to make it have a larger receptive field. Taking input X as an example, the Bi-TCN residual block is as shown in formula (2-5), the dilated convolution calculation formula is as shown in formula (6-7), where d represents the dilated rate, which increases exponentially by 2 (d=1, 2, 4...), and k represents the size of the convolution kernel:

[0057] Z`=Conv1(X) (2)

[0058] Z``=dropout(ReLU(WeightNorm(Dilated conv(X,k,d)))) (3)

[0059] Z```=dropout(ReLU(WeightNorm(Dilated conv(Z``,k,d)))) (4)

[0060] Z````=ReLU(Z`+Z```) (5)

[0061] padding = (k - 1) * d / 2 (6)

[0062]

[0063] In the BTVAE1 and BTVAE2 perform the phase of adversarial training, BTVAE1 is used to generate data to deceive BTVAE2, so BTVAE1 will be reconstructed X closer to normal data, and BTVAE2 is used to distinguish between input data X and BTVAE1 generated data, so BTVAE2 can be well distinguished between normal data and abnormal data, forming a kind of game between the two, which can amplify the slight abnormality, thereby improving the discriminant ability of the model for anomaly detection. The loss of the variational autoencoder network is composed of reconstruction error and KL divergence. The reconstruction error measures the difference between the decoder when generating samples and the original data, and the KL divergence measures the distance between the latent variable distribution q(z|x) generated by the encoder and the standard normal distribution p(z). The reconstruction error of the adversarial variational autoencoder loss function BTVAE is shown in the following formula (8-9), and the KL divergence is shown in the formula (10), where n is the number of iterations of training, and BTVAE(X) represents the output of X through the encoder and decoder.

[0064]

[0065]

[0066]

[0067] S4, model testing. The test data is also processed for missing values and standardized, and the trained model is used to encode and decode the data to obtain the final anomaly score, as shown in the following formula, where α and β are the coefficients of the anomaly score for measuring the proportion of adversarial training, α+β=1.

[0068] score(X) = α||X-BTVAE1(X)||2 (11) + β||X-BTVAE2(BTVAE1(X))||2

[0069] The peak-over-threshold (POT) method is used as the threshold selection method, and the POT method is the second theorem in the Extreme Value Theory (EVT). The optimal threshold λ is selected by cross-validation. The anomaly determination formula is as follows: if the anomaly score is greater than or equal to the threshold value, it is determined to be abnormal, otherwise it is normal.

[0070]

[0071] The application uses multiple interpolation methods and Z-score standardization in the data processing stage, can better process KPI data, and reduce the introduction of noise. The bidirectional time convolution network is introduced as the basic framework of the variational autoencoder, which can better capture the long-term and short-term dependence of the KPI data sequence, and improve the efficiency and accuracy of the model anomaly detection. Two variational autoencoders are used for adversarial training, which can more efficiently amplify the reconstruction error of the input containing anomalies, and finally a dynamic threshold method is used to automatically derive the optimal threshold to distinguish normal KPI data and abnormal KPI data.

[0072] Embodiment 2

[0073] The computer readable storage medium of the embodiment stores a computer program, which is executed by a processor to implement the steps of the KPI anomaly detection method of fusing Bi-TCN and adversarial VAE in embodiment 1.

[0074] The computer readable storage medium of the embodiment can be an internal storage unit of the terminal, such as a hard disk or a memory of the terminal; the computer readable storage medium of the embodiment can also be an external storage device of the terminal, such as a plug-in hard disk, a smart memory card, a secure digital card, a flash memory card, etc. equipped on the terminal; further, the computer readable storage medium can include both the internal storage unit and the external storage device of the terminal.

[0075] The computer readable storage medium of the embodiment is used to store computer programs and other programs and data required by the terminal, and the computer readable storage medium can also be used to temporarily store data that has been output or will be output.

[0076] Embodiment 3

[0077] The computer device of the embodiment includes a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor executes the program to implement the steps of the KPI anomaly detection method of fusing Bi-TCN and adversarial VAE in embodiment 1.

[0078] In the embodiment, the processor can be a central processing unit, and can also be other general-purpose processors, digital signal processors, application-specific integrated circuits, ready programmable gate arrays or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0079] Those skilled in the art will appreciate that embodiments disclosed herein can be provided as methods, systems, or computer program products. Accordingly, embodiments can be provided in the form of hardware embodiments, software embodiments, or embodiments combining software and hardware aspects. Also, embodiments can be provided in the form of computer program products embodied on one or more computer-usable storage media (including, but not limited to, disk memory and optical memory) having computer usable program code embodied thereon.

[0080] Embodiments are described herein with reference to flowchart illustrations and / or block diagrams of methods, and computer program products according to embodiments of the present application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0081] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0082] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in the flowchart illustrations and / or block diagrams.

[0083] Those skilled in the art will appreciate that implementing all or part of the methods described above in the embodiments can be accomplished by way of computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams.

[0084] The above merely describes the preferred embodiments of the present application, and the protection scope of the present application is not limited to the above-mentioned embodiments. Any technical scheme falling within the concept of the present application shall fall within the protection scope of the present application. It should be noted that, for ordinary skilled persons in the art, some improvements and refinements without departing from the principles of the present application shall be deemed to fall within the protection scope of the present application.

[0085] The above-mentioned embodiments only express one implementation of the present application, and the description is more specific and detailed, but it should not be understood as limiting the scope of the patent. It should be noted that, for ordinary skilled persons in the art, some modifications and improvements without departing from the concept of the present application shall be deemed to fall within the protection scope of the present application. Therefore, the protection scope of the present application patent shall be subject to the appended claims.

Claims

1. A KPI anomaly detection method of fusing Bi-TCN and counter VAE, characterized in that, Comprise the following steps: S1, data preprocessing; S2, model initialization, randomly initialize the model parameters, set the parameters; S3, model training, input the processed data into the training module to learn the normal mode of the sequence, the encoder part of the variational autoencoder uses a bidirectional time convolutional network to capture KPI sequence information, and the two decoders are used to reconstruct the compressed data, and an adversarial training is formed between the two variational encoders to amplify the reconstruction error of the input containing the anomaly; S4, model testing, the same data processing is performed on the test, the trained model is input to obtain the reconstruction error, and the threshold value generated by the automatic threshold method is used to determine whether it is abnormal; The KPI data is page access, server CPU utilization, router memory usage and switch throughput data obtained from APM monitoring tools or log analysis; In S3, taking input X as an example, the Bi-TCN residual block is calculated according to formula (2-5), and the dilated convolution calculation formula is shown in formula (6-7), wherein d represents the dilated rate, which increases exponentially by 2 (d=1, 2, 4...), and k represents the size of the convolution kernel: Z`=Conv1(X) (2) Z``=dropout(ReLU(WeightNorm(Dilatedconv(X,k,d)))) (3) Z```=dropout(ReLU(WeightNorm(Dilatedconv(Z``,k,d)))) (4) Z````=ReLU(Z`+Z```) (5) padding=(k-1)*d / 2 (6) In S3, the reconstruction error of the adversarial variational autoencoder loss function BTVAE is shown in the following formula (8-9), and the KL divergence is shown in formula (10), wherein n is the number of iterations of training, and BTVAE(X) represents the output of X after passing through the encoder and the decoder; 2. The method of claim 1, wherein, The specific steps of S1 are as follows: S11, missing value processing, KPI data generally has missing data at a certain moment, and multiple imputation method is used for missing value processing in the preprocessing stage; S12, data standardization, KPI data is standardized using Z-score; S13, use a sliding window with a size of W to process KPI data to obtain KPI sequence for learning KPI normal mode and anomaly detection.

3. The method of claim 2, wherein, In S12, the following formula is used: Wherein, x is the original data, μ is the average value of the original data, and σ is the standard deviation of the original data.

4. The method of claim 1, wherein, In S4, the test data is also processed for missing values and standardized, and the trained model is used to encode and decode the data to obtain the final anomaly score, as shown in the following formula, wherein α and β are the coefficients of the anomaly score for measuring the proportion of the adversarial training, α+β=1, score(X)=α||X-BTVAE1(X)||2+β||X-BTVAE2(BTVAE1(X))||2 (11); The peak-over-threshold method is used as a threshold selection method, and the optimal threshold λ is selected through cross-validation; the abnormality determination formula is as follows: if the abnormality score is greater than or equal to the threshold, it is determined to be abnormal, otherwise it is normal.

5. A computer readable storage medium having stored thereon a computer program, characterized in that: The processor implements the steps in the KPI anomaly detection method of fusing Bi-TCN and adversarial VAE according to any one of claims 1-4 when executing the program.

6. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps in the KPI anomaly detection method of fusing Bi-TCN and adversarial VAE according to any one of claims 1-4 when executing the program.

Images