Network cloud device anomaly detection method and device, electronic device and storage medium
By improving the combination of Transformer neural network and dynamic threshold, the problems of ARIMA algorithm's inability to capture nonlinear relationships and static threshold's inability to adapt in the existing technology are solved, achieving higher detection accuracy and robustness, and adapting to anomaly detection in complex scenarios.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- INSPUR TIANYUAN COMM INFORMATION SYST CO LTD
- Filing Date
- 2023-04-10
- Publication Date
- 2026-06-09
AI Technical Summary
Existing methods for detecting anomalies in network cloud devices using the ARIMA algorithm cannot effectively capture nonlinear relationships, and static thresholds cannot adapt to environmental changes, resulting in insufficient detection accuracy.
An improved Transformer neural network is adopted, replacing the original feedforward neural network with a three-layer perceptron structure, and setting the activation function to the hyperbolic tangent function. Anomaly detection is performed by combining dynamic threshold and residual, and the robustness is improved by replacing the static threshold with the dynamic threshold.
It improves the accuracy of network cloud device anomaly detection and adaptability to complex scenarios, monitors device anomalies in real time, and reduces downtime losses caused by faults.
Smart Images
Figure CN116628563B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting anomalies in network cloud devices. Background Technology
[0002] Existing methods for detecting anomalies in network cloud devices primarily rely on algorithms such as the Autoregressive Integrated Moving Average (ARIMA) model for prediction. This involves learning from historical state data of the network cloud device to predict future data trends and comparing the residual between the predicted and actual values to a pre-set static threshold. If the residual is greater than the static threshold, the device is considered to be experiencing an anomaly; otherwise, it is considered to be operating normally. However, the ARIMA algorithm requires stable time-series data and can only capture linear relationships, not nonlinear ones. Since the operational state data of network cloud devices is nonlinear, ARIMA predictions are inaccurate. Furthermore, the static threshold needs to be set in advance by business experts and cannot adapt to changes in the operating environment. Summary of the Invention
[0003] This invention provides a method, apparatus, electronic device, and storage medium for detecting anomalies in network cloud devices, aiming to improve the accuracy of anomaly detection in network cloud devices and their adaptability to complex scenarios.
[0004] In a first aspect, the present invention provides a method for detecting anomalies in network cloud devices, comprising:
[0005] The operational status data of the network cloud device to be tested is obtained; the operational status data is obtained based on the historical status data of the network cloud device to be tested.
[0006] Based on the first time series composed of the operating status of the network cloud device to be detected within a preset time period, a dynamic threshold is calculated, and the residual is calculated based on the improved Transformer neural network and the operating status data; the improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network, and improves the original feedforward neural network in the original Transformer encoder into a three-layer perceptron structure, and sets the activation function of the neurons in the perceptron to the hyperbolic tangent function;
[0007] Based on the dynamic threshold and the residual, anomalies in the network cloud device to be detected are identified.
[0008] In one embodiment, calculating the dynamic threshold based on a first time series composed of the operating states of the network cloud device under test within a preset time period includes:
[0009] The first time series is sorted in descending order of time values to obtain the second time series;
[0010] Based on the two earliest time values in the second time series, determine the maximum value of the time series, and based on the two latest time values in the second time series, determine the minimum value of the time series.
[0011] Calculate the time series mean of the second time series, and calculate the dynamic threshold based on the time series maximum value, the time series minimum value, and the time series mean.
[0012] The calculation of the dynamic threshold based on the maximum value, minimum value, and mean value of the time series includes:
[0013] The first time series difference is calculated based on the maximum value and the mean value of the time series.
[0014] The second time series difference is calculated based on the minimum value and the mean value of the time series.
[0015] The minimum value between the first time series difference and the second time series difference is determined as the dynamic threshold.
[0016] The residual is calculated based on the improved Transformer neural network and the runtime data, including:
[0017] Based on the improved Transformer neural network, the operating state data is used to predict future data to obtain predicted data;
[0018] The actual data of the operating status data is determined, and the residual is calculated based on the predicted data and the actual data.
[0019] The calculation of the residual based on the predicted data and the actual data includes:
[0020] A first operation is performed based on the predicted data and the actual data to obtain the operation result, and a second operation is performed on the operation result to obtain the residual.
[0021] The step of detecting anomalies in the network cloud device under test based on the dynamic threshold and the residual includes:
[0022] The dynamic threshold and the residual are compared to obtain the comparison result;
[0023] If the comparison result is that the residual is greater than the dynamic threshold, then the network cloud device to be detected is determined to be abnormal.
[0024] If the comparison result is that the residual is less than or equal to the dynamic threshold, then it is determined that the network cloud device to be detected is not abnormal.
[0025] The specific steps for obtaining the operational status data based on the historical data of the network cloud device to be detected include:
[0026] The missing data in the historical data is filled by mean interpolation, and the abnormal data in the historical data is re-interpolated by multiple interpolation to obtain the running status data.
[0027] Secondly, the present invention provides a network cloud device anomaly detection device, comprising:
[0028] The acquisition module is used to acquire the operating status data of the network cloud device to be tested; the operating status data is obtained based on the historical status data of the network cloud device to be tested.
[0029] The calculation module is used to calculate a dynamic threshold based on a first time series composed of the operating states of the network cloud device under test within a preset time period, and to calculate the residual based on the improved Transformer neural network and the operating state data; the improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network, and improves the original feedforward neural network in the original Transformer encoder into a three-layer perceptron structure, and sets the activation function of the neurons in the perceptron to the hyperbolic tangent function;
[0030] An anomaly detection module is used to detect anomalies in the network cloud device under test based on the dynamic threshold and the residual.
[0031] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network cloud device anomaly detection method described in the first aspect.
[0032] Fourthly, the present invention also provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium comprising a computer program, which, when executed by the processor, implements the network cloud device anomaly detection method described in the first aspect.
[0033] Fifthly, the present invention also provides a computer program product, the computer program product comprising a computer program, which, when executed by the processor, implements the network cloud device anomaly detection method described in the first aspect.
[0034] The present invention provides a method, apparatus, electronic device, and storage medium for detecting anomalies in network cloud devices. The method acquires operational status data of the network cloud device under test. This operational status data is obtained based on historical status data of the network cloud device. A dynamic threshold is calculated based on a first time series composed of the operational status of the network cloud device within a preset time period. A residual is calculated based on an improved Transformer neural network and the operational status data. Based on the dynamic threshold and the residual, anomalies in the network cloud device under test are detected. In the process of detecting network cloud device anomalies, the improved Transformer neural network calculates the residual within the normal range of the operational status data. Combined with the dynamic threshold obtained from historical data, this effectively detects anomalies that may occur during the operation of the network cloud device, improving the accuracy of anomaly detection. Furthermore, replacing the static threshold with a dynamic threshold improves robustness and enhances adaptability to complex scenarios. Attached Figure Description
[0035] To more clearly illustrate the technical solutions of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0036] Figure 1 This is a flowchart illustrating the network cloud device anomaly detection method provided by the present invention;
[0037] Figure 2 This is a schematic diagram of the original Transformer neural network provided by the present invention;
[0038] Figure 3 This is a schematic diagram of the improved Transformer neural network provided by the present invention;
[0039] Figure 4 This is a prediction principle diagram provided by the present invention;
[0040] Figure 5 This is a schematic diagram of the network cloud device anomaly detection device provided by the present invention;
[0041] Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation
[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0043] This invention provides an embodiment of a method for detecting anomalies in network cloud devices. It should be noted that although the logical order is shown in the flowchart, under certain data conditions, the steps shown or described may be performed in a different order than that shown here.
[0044] Reference Figure 1 , Figure 1 This is a flowchart illustrating the network cloud device anomaly detection method provided by the present invention. The network cloud device anomaly detection method provided in this embodiment of the invention includes:
[0045] Step 101: Obtain the operating status data of the network cloud device to be tested; the operating status data is obtained based on the historical status data of the network cloud device to be tested.
[0046] Step 102: Calculate the dynamic threshold based on the first time series composed of the operating status of the network cloud device to be detected within a preset time period, and calculate the residual based on the improved Transformer neural network and the operating status data.
[0047] Step 103: Based on the dynamic threshold and the residual, detect the abnormal situation of the network cloud device to be detected.
[0048] This embodiment of the invention uses a network cloud device anomaly detection system as the execution subject as an example.
[0049] When detecting anomalies in a network cloud device, the network cloud device anomaly detection system first needs to obtain the operating status data of the network cloud device under test.
[0050] It should be noted that the operational status data of the network cloud device under test is obtained based on its historical status data over a preset period, typically the past year. This historical status data includes at least CPU (Central Processing Unit) utilization, memory usage, device operating temperature, device power consumption, firewall throughput, number of newly established firewall connections, and number of concurrent firewall connections. The time granularity of the historical status data is in 15-minute increments. Therefore, it can be understood that when the network cloud device anomaly detection system detects anomalies in the network cloud device under test, it collects and organizes the CPU utilization, memory usage, device operating temperature, device power consumption, firewall throughput, number of newly established firewall connections, and number of concurrent firewall connections for the device over the past year. Furthermore, the network cloud device anomaly detection system performs data preprocessing on the collected historical status data to obtain the operational status data of the network cloud device under test.
[0051] Furthermore, the network cloud device anomaly detection system calculates a dynamic threshold based on a first time series composed of the operating states of the network cloud device under test within a preset time period. This preset time period is typically the past week. Therefore, it can be understood that the network cloud device anomaly detection system calculates the dynamic threshold based on a first time series composed of the operating states of the network cloud device under test within the past week. Further, the network cloud device anomaly detection system calculates residuals by combining the improved Transformer neural network with the operating state data.
[0052] It should be noted that the embodiments of the present invention predict the runtime state of network cloud devices through an improved Transformer neural network. The improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network and no longer uses the Transformer decoder in the original Transformer neural network. At the same time, the original feedforward neural network in the original Transformer encoder is improved into a three-layer perceptron structure, and the activation function of the neurons in the three-layer perceptron is set to the hyperbolic tangent function.
[0053] For the original Transformer neural network, please refer to [link / reference]. Figure 2 , Figure 2 This is a schematic diagram of the original Transformer neural network provided by the present invention.
[0054] The original Transformer neural network, also known as the classic Transformer neural network used for prediction, mainly consists of two parts: an encoder and a decoder.
[0055] Furthermore, for the improved Transformer neural network reference Figure 3 , Figure 3 This is a schematic diagram of the improved Transformer neural network provided by the present invention.
[0056] The prediction model in this embodiment of the invention is based on a Transformer neural network. To improve prediction accuracy, the model structure has been improved, specifically to address the overfitting problem that occurs in time series prediction using Transformer neural networks. Therefore, this embodiment of the invention improves the classic Transformer neural network by using only the original Transformer encoder, eliminating the Transformer decoder. Furthermore, the original feedforward neural network in the original Transformer encoder is modified into a three-layer perceptron structure, and the activation functions of the neurons in all three perceptron layers are set to the hyperbolic tangent function, effectively preventing overfitting. The fully connected layers use a standard multilayer perceptron structure. The number of layers and the number of neurons in each layer are designed according to the scale of historical data, and the hyperbolic tangent function is used as the activation function. Additionally, the input is masked to avoid introducing future information. Therefore, the encoder part of the model takes historical time series data as input, and the decoder performs autoregression to output the predicted value.
[0057] The loss function of the improved Transformer neural network model is designed as the mean squared error function:
[0058]
[0059] The model is trained on the training dataset using the RMSprop training algorithm.
[0060] Furthermore, the network cloud device anomaly detection system compares the dynamic threshold and the residual to obtain a comparison result. Based on this comparison result, the system determines whether the network cloud device under test has experienced an anomaly, i.e., it detects anomalies in the network cloud device under test.
[0061] The network cloud device anomaly detection method provided in this embodiment of the invention obtains the operating status data of the network cloud device to be detected; the operating status data is obtained based on the historical status data of the network cloud device to be detected; a dynamic threshold is calculated based on a first time series composed of the operating status of the network cloud device to be detected within a preset time period, and a residual is calculated based on the improved Transformer neural network and the operating status data; based on the dynamic threshold and the residual, anomalies of the network cloud device to be detected are detected.
[0062] In the process of network cloud device anomaly detection, the residual of the normal range of operating status data is calculated by an improved Transformer neural network. Combined with a dynamic threshold obtained from historical data, this effectively detects anomalies that may occur during the operation of network cloud devices, improving the accuracy of anomaly detection. Furthermore, replacing static thresholds with dynamic thresholds enhances robustness and improves adaptability to complex scenarios. In addition, the network cloud device anomaly detection method provided by this invention can monitor the status of network cloud devices and detect anomalies in real time, effectively avoiding losses caused by device downtime due to malfunctions.
[0063] Furthermore, the specific steps for obtaining the operational status data from the historical data of the network cloud device to be tested, as recorded in step 101, include:
[0064] The missing data in the historical data is filled by mean interpolation, and the abnormal data in the historical data is re-interpolated by multiple interpolation to obtain the running status data.
[0065] It should be noted that due to errors in data collection by staff or software system malfunctions leading to abnormal data collection, the network cloud device anomaly detection system needs to perform data preprocessing on the historical data collected from the network cloud devices to be tested. This preprocessing yields the operational status data of the network cloud devices under test. The data preprocessing primarily involves handling missing and abnormal data, specifically:
[0066] For missing data: The network cloud device anomaly detection system fills in the missing parts of historical data using the mean interpolation method.
[0067] For the abnormal data portion: an abnormal data portion is when the data value is outside the defined range. Therefore, the network cloud device anomaly detection system deletes the value and re-interpolates the abnormal data portion using a multiple interpolation method, that is, re-interpolates the deleted value using a multiple interpolation method.
[0068] The embodiments of the present invention perform data preprocessing operations on historical data through mean interpolation and multiple interpolation, providing accurate operational status data for network cloud device anomaly detection.
[0069] Further, step 102 describes calculating a dynamic threshold based on a first time series composed of the operating states of the network cloud device under test within a preset time period, including:
[0070] The first time series is sorted in descending order of time values to obtain the second time series;
[0071] Based on the two earliest time values in the second time series, determine the maximum value of the time series, and based on the two latest time values in the second time series, determine the minimum value of the time series.
[0072] Calculate the time series mean of the second time series, and calculate the dynamic threshold based on the time series maximum value, the time series minimum value, and the time series mean.
[0073] It should be noted that the method for setting dynamic thresholds involves using the time series mean, maximum, and minimum values of a time series composed of the operating status of network cloud devices over the past week. Therefore, it is necessary to calculate the time series mean, maximum, and minimum values, as follows:
[0074] The network cloud device anomaly detection system sorts the first time series in descending order of time values to obtain the second time series. It should be noted that, in this embodiment of the invention, the first time series can also be sorted in ascending order of time values.
[0075] Furthermore, the network cloud device anomaly detection system identifies the two earliest time values in the second time series, i.e., it identifies the maximum value in the second time series. and the second largest value and the maximum value Replace the value with The maximum value of the second time series is obtained. Furthermore, the last two time values in the second time series of the network cloud device anomaly detection system are used to determine the minimum value in the second time series. and the second smallest value and the minimum value Replace the value with This yields the minimum value of the second time series.
[0076] Furthermore, the network cloud device anomaly detection system calculates the time series mean of the second time series. Time series mean The calculation formula is as follows:
[0077]
[0078] Where n is the number of time values in the second time series. This refers to the time values in the second time series.
[0079] Furthermore, the network cloud device anomaly detection system calculates the dynamic threshold by analyzing the maximum, minimum, and mean values of the time series.
[0080] The embodiments of the present invention calculate a dynamic threshold, thereby replacing the static threshold with a dynamic threshold, which improves robustness and enhances the adaptability to complex scenarios.
[0081] Further, the dynamic threshold is calculated based on the maximum value, the minimum value, and the mean value of the time series, including:
[0082] The first time series difference is calculated based on the maximum value and the mean value of the time series.
[0083] The second time series difference is calculated based on the minimum value and the mean value of the time series.
[0084] The minimum value between the first time series difference and the second time series difference is determined as the dynamic threshold.
[0085] Specifically, the network cloud device anomaly detection system will use the maximum value of the time series. With time series mean The difference is calculated to obtain the first time series difference, which is: Furthermore, the network cloud device anomaly detection system will use the time series average. With the minimum value of the time series The difference is calculated to obtain the second time series difference, which is: .
[0086] Furthermore, the network cloud device anomaly detection system will use the first time series difference as... The difference between the second time series and the second time series is Perform numerical comparisons and set the difference between the first time series as... The difference in the second time series is The value with the smallest median is determined as the dynamic threshold. Therefore, the formula for calculating the dynamic threshold can be expressed as:
[0087] .
[0088] The embodiments of the present invention calculate a dynamic threshold, thereby replacing the static threshold with a dynamic threshold, which improves robustness and enhances the adaptability to complex scenarios.
[0089] Further, step 102, which describes calculating the residual based on the improved Transformer neural network and the operating state data, includes:
[0090] Based on the improved Transformer neural network, the operating state data is used to predict future data to obtain predicted data;
[0091] The actual data of the operating status data is determined, and the residual is calculated based on the predicted data and the actual data.
[0092] It should be noted that historical data is generally used to predict data trends. Therefore, the network cloud device anomaly detection system uses an improved Transformer neural network to predict future data based on operational status data, obtaining predicted data, which is then referenced. Figure 4 , Figure 4 This is the prediction principle diagram provided by the present invention, with input time series T1 to T... n-1 Predicting time series T n .
[0093] Furthermore, residual calculation involves finding the residual between the predicted and actual values. Therefore, the network cloud device anomaly detection system also needs to calculate the actual operational status data. The system then performs calculations on the predicted and actual data to determine the residual.
[0094] The embodiments of the present invention calculate residuals to perform anomaly detection using residuals and dynamic thresholds. This effectively detects anomalies that may occur during the operation of network cloud devices, improving the accuracy of anomaly detection. At the same time, by replacing static thresholds with dynamic thresholds, robustness is improved, thus enhancing the adaptability to complex scenarios.
[0095] Further, based on the predicted data and the actual data, the residual is calculated, including:
[0096] A first operation is performed based on the predicted data and the actual data to obtain the operation result, and a second operation is performed on the operation result to obtain the residual.
[0097] Specifically, the network cloud device anomaly detection system calculates the difference between the predicted data and the actual data, and then squares this difference to obtain the squared value. Further, the system takes the square root of the squared value to obtain the residual. Therefore, the formula for calculating the residual can be expressed as:
[0098]
[0099] In the formula, For residuals, It is forecast data. These are actual data.
[0100] The embodiments of the present invention calculate residuals to perform anomaly detection using residuals and dynamic thresholds. This effectively detects anomalies that may occur during the operation of network cloud devices, improving the accuracy of anomaly detection. At the same time, by replacing static thresholds with dynamic thresholds, robustness is improved, thus enhancing the adaptability to complex scenarios.
[0101] Further, step 103, which describes detecting anomalies in the network cloud device under test based on the dynamic threshold and the residual, includes:
[0102] The dynamic threshold and the residual are compared to obtain the comparison result;
[0103] If the comparison result is that the residual is greater than the dynamic threshold, then the network cloud device to be detected is determined to be abnormal.
[0104] If the comparison result is that the residual is less than or equal to the dynamic threshold, then it is determined that the network cloud device to be detected is not abnormal.
[0105] Specifically, the network cloud device anomaly detection system compares the dynamic threshold and the residual to obtain a comparison result. The comparison result can be that the residual is greater than the dynamic threshold, or that the residual is less than or equal to the dynamic threshold.
[0106] If the comparison result shows that the residual is greater than the dynamic threshold, the network cloud device anomaly detection system determines that the network cloud device under test is abnormal. If the comparison result shows that the residual is less than or equal to the dynamic threshold, the network cloud device anomaly detection system determines that the network cloud device under test is not abnormal.
[0107] This invention utilizes residuals and dynamic thresholds for anomaly detection, effectively detecting anomalies that may occur during the operation of network cloud devices, thus improving the accuracy of anomaly detection. Furthermore, by replacing static thresholds with dynamic thresholds, robustness is enhanced, thereby improving the adaptability to complex scenarios.
[0108] Furthermore, the network cloud device anomaly detection device provided by the present invention and the network cloud device anomaly detection method provided by the present invention correspond to each other.
[0109] Figure 5 As shown, Figure 5 This is a schematic diagram of the network cloud device anomaly detection device provided by the present invention. The network cloud device anomaly detection device includes:
[0110] The acquisition module 501 is used to acquire the operating status data of the network cloud device to be tested; the operating status data is obtained based on the historical status data of the network cloud device to be tested.
[0111] The calculation module 502 is used to calculate a dynamic threshold based on a first time series composed of the operating states of the network cloud device to be detected within a preset time period, and to calculate the residual based on the improved Transformer neural network and the operating state data; the improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network, and improves the original feedforward neural network in the original Transformer encoder into a three-layer perceptron structure, and sets the activation function of the neurons in the perceptron to the hyperbolic tangent function;
[0112] Anomaly detection module 503 is used to detect anomalies in the network cloud device to be detected based on the dynamic threshold and the residual.
[0113] Furthermore, the acquisition module 501 is also used for:
[0114] The missing data in the historical data is filled by mean interpolation, and the abnormal data in the historical data is re-interpolated by multiple interpolation to obtain the running status data.
[0115] Furthermore, the computing module 502 is also used for:
[0116] The first time series is sorted in descending order of time values to obtain the second time series;
[0117] Based on the two earliest time values in the second time series, determine the maximum value of the time series, and based on the two latest time values in the second time series, determine the minimum value of the time series.
[0118] Calculate the time series mean of the second time series, and calculate the dynamic threshold based on the time series maximum value, the time series minimum value, and the time series mean.
[0119] Furthermore, the computing module 502 is also used for:
[0120] The first time series difference is calculated based on the maximum value and the mean value of the time series.
[0121] The second time series difference is calculated based on the minimum value and the mean value of the time series.
[0122] The minimum value between the first time series difference and the second time series difference is determined as the dynamic threshold.
[0123] Furthermore, the computing module 502 is also used for:
[0124] Based on the improved Transformer neural network, the operating state data is used to predict future data to obtain predicted data;
[0125] The actual data of the operating status data is determined, and the residual is calculated based on the predicted data and the actual data.
[0126] Furthermore, the computing module 502 is also used for:
[0127] A first operation is performed based on the predicted data and the actual data to obtain the operation result, and a second operation is performed on the operation result to obtain the residual.
[0128] Furthermore, the anomaly detection module 503 is also used for:
[0129] The dynamic threshold and the residual are compared to obtain the comparison result;
[0130] If the comparison result is that the residual is greater than the dynamic threshold, then the network cloud device to be detected is determined to be abnormal.
[0131] If the comparison result is that the residual is less than or equal to the dynamic threshold, then it is determined that the network cloud device to be detected is not abnormal.
[0132] The specific embodiments of the network cloud device anomaly detection device provided by the present invention are basically the same as the embodiments of the network cloud device anomaly detection method described above, and will not be repeated here.
[0133] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute a network cloud device anomaly detection method, which includes:
[0134] The operational status data of the network cloud device to be tested is obtained; the operational status data is obtained based on the historical status data of the network cloud device to be tested.
[0135] Based on the first time series composed of the operating status of the network cloud device to be detected within a preset time period, a dynamic threshold is calculated, and the residual is calculated based on the improved Transformer neural network and the operating status data; the improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network, and improves the original feedforward neural network in the original Transformer encoder into a three-layer perceptron structure, and sets the activation function of the neurons in the perceptron to the hyperbolic tangent function;
[0136] Based on the dynamic threshold and the residual, anomalies in the network cloud device to be detected are identified.
[0137] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0138] On the other hand, the present invention also provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, which, when executed by a computer, enable the computer to execute the network cloud device anomaly detection method provided by the above methods, the method comprising:
[0139] The operational status data of the network cloud device to be tested is obtained; the operational status data is obtained based on the historical status data of the network cloud device to be tested.
[0140] Based on the first time series composed of the operating status of the network cloud device to be detected within a preset time period, a dynamic threshold is calculated, and the residual is calculated based on the improved Transformer neural network and the operating status data; the improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network, and improves the original feedforward neural network in the original Transformer encoder into a three-layer perceptron structure, and sets the activation function of the neurons in the perceptron to the hyperbolic tangent function;
[0141] Based on the dynamic threshold and the residual, anomalies in the network cloud device to be detected are identified.
[0142] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the aforementioned network cloud device anomaly detection methods, the method comprising:
[0143] The operational status data of the network cloud device to be tested is obtained; the operational status data is obtained based on the historical status data of the network cloud device to be tested.
[0144] Based on the first time series composed of the operating status of the network cloud device to be detected within a preset time period, a dynamic threshold is calculated, and the residual is calculated based on the improved Transformer neural network and the operating status data; the improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network, and improves the original feedforward neural network in the original Transformer encoder into a three-layer perceptron structure, and sets the activation function of the neurons in the perceptron to the hyperbolic tangent function;
[0145] Based on the dynamic threshold and the residual, anomalies in the network cloud device to be detected are identified.
[0146] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0147] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0148] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for detecting anomalies in network cloud devices, characterized in that, include: Obtain operational status data of the network cloud device to be tested; The operational status data is obtained based on the historical status data of the network cloud device under test. Based on the first time series composed of the operating status of the network cloud device to be detected within a preset time period, a dynamic threshold is calculated, and the residual is calculated based on the improved Transformer neural network and the operating status data; the improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network, and improves the original feedforward neural network in the original Transformer encoder into a three-layer perceptron structure, and sets the activation function of the neurons in the perceptron to the hyperbolic tangent function; Based on the dynamic threshold and the residual, detect abnormal situations of the network cloud device to be detected; The calculation of the dynamic threshold based on the first time series composed of the operating states of the network cloud device under test within a preset time period includes: The first time series is sorted in descending order of time values to obtain the second time series; Based on the two earliest time values in the second time series, determine the maximum value of the time series, and based on the two latest time values in the second time series, determine the minimum value of the time series. Calculate the time series mean of the second time series, and calculate the dynamic threshold based on the time series maximum value, the time series minimum value, and the time series mean; The step of calculating the dynamic threshold based on the maximum value, minimum value, and mean value of the time series includes: The first time series difference is calculated based on the maximum value and the mean value of the time series. The second time series difference is calculated based on the minimum value and the mean value of the time series. The minimum value between the first time series difference and the second time series difference is determined as the dynamic threshold.
2. The network cloud device anomaly detection method according to claim 1, characterized in that, The residual is calculated based on the improved Transformer neural network and the runtime data, including: Based on the improved Transformer neural network, the operating state data is used to predict future data to obtain predicted data; The actual data of the operating status data is determined, and the residual is calculated based on the predicted data and the actual data.
3. The network cloud device anomaly detection method according to claim 2, characterized in that, The calculation of the residual based on the predicted data and the actual data includes: A first operation is performed based on the predicted data and the actual data to obtain the operation result, and a second operation is performed on the operation result to obtain the residual.
4. The network cloud device anomaly detection method according to claim 1, characterized in that, The step of detecting anomalies in the network cloud device under test based on the dynamic threshold and the residual includes: The dynamic threshold and the residual are compared to obtain the comparison result; If the comparison result is that the residual is greater than the dynamic threshold, then the network cloud device to be detected is determined to be abnormal. If the comparison result is that the residual is less than or equal to the dynamic threshold, then it is determined that the network cloud device to be detected is not abnormal.
5. The network cloud device anomaly detection method according to any one of claims 1 to 4, characterized in that, The specific steps for obtaining the operational status data based on the historical data of the network cloud device to be detected include: The missing data in the historical data is filled by mean interpolation, and the abnormal data in the historical data is re-interpolated by multiple interpolation to obtain the running status data.
6. A network cloud device anomaly detection device, characterized in that, include: The acquisition module is used to acquire the operating status data of the network cloud device to be tested; The operational status data is obtained based on the historical status data of the network cloud device under test. The calculation module is used to calculate a dynamic threshold based on a first time series composed of the operating states of the network cloud device under test within a preset time period, and to calculate the residual based on the improved Transformer neural network and the operating state data; the improved Transformer neural network only uses the original Transformer encoder in the original Transformer neural network, and improves the original feedforward neural network in the original Transformer encoder into a three-layer perceptron structure, and sets the activation function of the neurons in the perceptron to the hyperbolic tangent function; An anomaly detection module is used to detect anomalies in the network cloud device under test based on the dynamic threshold and the residual. The computing module is also used for: The first time series is sorted in descending order of time values to obtain the second time series; Based on the two earliest time values in the second time series, determine the maximum value of the time series, and based on the two latest time values in the second time series, determine the minimum value of the time series. Calculate the time series mean of the second time series, and calculate the dynamic threshold based on the time series maximum value, the time series minimum value, and the time series mean; The computing module is also used for: The first time series difference is calculated based on the maximum value and the mean value of the time series. The second time series difference is calculated based on the minimum value and the mean value of the time series. The minimum value between the first time series difference and the second time series difference is determined as the dynamic threshold.
7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the network cloud device anomaly detection method according to any one of claims 1 to 5.
8. A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the network cloud device anomaly detection method according to any one of claims 1 to 5.