Model training method and device, electronic equipment and storage medium

Abstract

The application discloses a model training method and device, electronic equipment and a storage medium. The method comprises the following steps: determining a training data set, the training data set at least containing first data of an infrastructure as a service (IaaS) layer, the first data comprising performance index data of each server in the IaaS layer within a first time range for a plurality of performance indexes; determining time sequence characteristics related to the plurality of performance indexes based on the first data, and determining at least two algorithms for performing abnormality detection on the first data and a weight coefficient corresponding to each algorithm in the at least two algorithms by at least utilizing the determined time sequence characteristics; and training a detection model by using a model fusion strategy based on a weighted voting method, the training data set, the determined at least two algorithms and the weight coefficient corresponding to each algorithm, the detection model being used for performing abnormality detection on second data of the IaaS layer, the second data comprising performance index data of each server in the IaaS layer within a current time range for the plurality of performance indexes.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a model training method, apparatus, electronic device and storage medium. Background Technology

[0002] Large-scale cloud service platforms typically deploy hundreds of thousands of servers, each with thousands of performance metrics reflecting its operational status. During the intelligent operation and maintenance of cloud service platforms, anomaly detection can be used to monitor these metrics and ensure the normal operation of business systems.

[0003] However, there is still no effective solution in terms of how to improve the accuracy of anomaly detection. Summary of the Invention

[0004] To address the related technical issues, embodiments of this application provide a model training method, apparatus, electronic device, and storage medium.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a model training method, including:

[0007] A training dataset is determined, wherein the training dataset contains at least the first data of the Infrastructure as a Service (IaaS) layer, wherein the first data includes performance indicator data of each server contained in the IaaS layer for multiple performance indicators in a first time range, and the performance indicator data characterizes the running status of the corresponding server.

[0008] Based on the first data, determine the time-series features related to the multiple performance indicators, and at least using the determined time-series features, determine at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms;

[0009] Using the training dataset, at least two determined algorithms and the weight coefficients corresponding to each algorithm, a detection model is trained using a model fusion strategy based on weighted voting. The detection model is used to detect anomalies in the second data of the IaaS layer, which includes the performance index data of each server in the IaaS layer for the current multiple performance metrics.

[0010] In the above scheme, determining the time-series characteristics related to the multiple performance indicators based on the first data includes:

[0011] For each of the plurality of performance metrics, based on the first data, at least one time-series feature corresponding to the performance metric is determined.

[0012] In the above scheme, the step of determining at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms by utilizing at least certain temporal characteristics includes:

[0013] By using the type of at least one time-series feature corresponding to each performance indicator, the plurality of performance indicators are grouped to obtain at least two performance indicator groups, and each performance indicator group contains at least one performance indicator among the plurality of performance indicators.

[0014] Based on the first data and at least two sets of performance indicators, at least two algorithms are selected from a preset candidate algorithm library, and the weight coefficients corresponding to each algorithm are determined.

[0015] In the above scheme, the step of selecting at least two algorithms from a preset candidate algorithm library based on the first data and at least two performance indicator groups, and determining the weight coefficient corresponding to each algorithm, includes:

[0016] For each of the at least two performance metric groups, based on the first data, determine the fit between the performance metric group and each algorithm contained in the candidate algorithm library;

[0017] Based on the fit between each performance metric group and each algorithm contained in the candidate algorithm library, at least two algorithms are selected from the candidate algorithm library;

[0018] The weight coefficients for each algorithm are determined based on the fit between each performance metric group and each of the at least two algorithms.

[0019] In the above scheme, the candidate algorithm library includes at least the following algorithms:

[0020] Periodic detection algorithm;

[0021] Statistical algorithms;

[0022] Unsupervised algorithms;

[0023] Deep learning algorithms based on the Transformer architecture.

[0024] In the above scheme, determining the training dataset includes:

[0025] Collect performance indicator data for each server included in the IaaS layer for the multiple performance indicators within the first time range;

[0026] The first data is obtained by filtering out noise data from the collected performance index data;

[0027] The training dataset is determined based at least on the first data.

[0028] The method in the above scheme further includes:

[0029] The second data is obtained by collecting the performance metrics data of each server included in the IaaS layer for the current multiple performance metrics.

[0030] The detection model is used to perform anomaly detection on the second data to obtain the detection results.

[0031] The method in the above scheme further includes:

[0032] If the detection result contains abnormal performance index data, the server corresponding to the abnormal performance index data is identified, and an alarm message is issued. The alarm message includes at least the abnormal performance index data and the corresponding server.

[0033] The method in the above scheme further includes:

[0034] Obtain the verification information corresponding to the alarm information, wherein the verification information indicates whether the abnormal performance indicator data is a correct detection result;

[0035] If the performance metric data indicating the anomaly is a correct detection result, the training dataset is updated using the anomaly performance metric data, and the detection model is optimized using the updated training dataset.

[0036] The method in the above scheme further includes:

[0037] Obtain the verification information corresponding to the alarm information, wherein the verification information indicates whether the abnormal performance indicator data is a correct detection result;

[0038] If the verification information indicates that the abnormal performance index data is an incorrect detection result, the weight coefficients of each of the at least two algorithms are updated using the abnormal performance index data, and the detection model is optimized using the updated weight coefficients.

[0039] The method in the above scheme further includes:

[0040] When optimizing the detection model, the abnormal performance index data is used to determine the safe range corresponding to the detection model; wherein, if the output data of the detection model belongs to the safe range, the detection result of the detection model does not contain abnormal performance index data.

[0041] This application embodiment also provides a model training apparatus, including:

[0042] The first processing unit is used to determine a training dataset, the training dataset containing at least the first data of the IaaS layer, the first data including the performance index data of each server in the IaaS layer for multiple performance indicators in a first time range, the performance index data representing the running status of the corresponding server.

[0043] The second processing unit is configured to determine the time-series features related to the plurality of performance indicators based on the first data, and at least use the determined time-series features to determine at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms.

[0044] The third processing unit is used to train a detection model using the training dataset, at least two determined algorithms and the weight coefficients corresponding to each algorithm, and a model fusion strategy based on weighted voting. The detection model is used to perform anomaly detection on the second data of the IaaS layer. The second data includes the performance index data of each server included in the IaaS layer for the current multiple performance indicators.

[0045] This application also provides an electronic device, including: a processor and a memory for storing a computer program capable of running on the processor.

[0046] When the processor runs the computer program, it executes the steps of any of the above methods.

[0047] This application also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the above methods.

[0048] The model training method, apparatus, electronic device, and storage medium provided in this application embodiment determine a training dataset, which at least includes first data of the IaaS layer. The first data includes performance indicator data of each server included in the IaaS layer for multiple performance indicators within a first time range, and the performance indicator data represents the running status of the corresponding server. Based on the first data, time-series features related to the multiple performance indicators are determined, and at least two algorithms for anomaly detection of the first data and weight coefficients corresponding to each of the at least two algorithms are determined using at least the determined time-series features. Using the training dataset, the determined at least two algorithms, and the weight coefficients corresponding to each algorithm, a model fusion strategy based on weighted voting is used to train a detection model. The detection model is used to perform anomaly detection on second data of the IaaS layer, which includes performance indicator data of each server included in the IaaS layer for the multiple performance indicators at the current time. The solution provided in this application uses a detection model for anomaly detection of the current performance metric data of each server in the IaaS layer. This model is trained using a training dataset, at least two algorithms, and the weight coefficients corresponding to each algorithm, employing a model fusion strategy based on weighted voting. The at least two algorithms and the weight coefficients corresponding to each algorithm are determined using the time-series features related to performance metrics. Thus, when the detection model is subsequently used to detect anomalies in the current performance metric data of each server in the IaaS layer, the accuracy of anomaly detection can be improved. In other words, it can detect abnormal performance metric data of each server in the IaaS layer in real time and effectively, thereby ensuring the stable operation of the cloud service system. Attached Figure Description

[0049] Figure 1 This is a schematic flowchart of the model training method in an embodiment of this application;

[0050] Figure 2 A schematic diagram of the unified multi-model fusion anomaly detection algorithm framework for application examples in this application;

[0051] Figure 3 This is a schematic diagram of the model training device structure according to an embodiment of this application;

[0052] Figure 4 This is a schematic diagram of the electronic device structure according to an embodiment of this application. Detailed Implementation

[0053] The present application will now be described in further detail with reference to the accompanying drawings and embodiments.

[0054] Before describing the embodiments of this application, the following terms will be explained:

[0055] Anomaly detection, one of the most mature applications of time series data analysis, refers to the process of identifying abnormal events or behaviors from normal time series.

[0056] Temporal anomalies refer to anomalous data in time series that deviate significantly from historical observations or alter their historical distribution.

[0057] Pattern anomalies refer to a significant shift or change in the statistical characteristics of the data following an anomaly at a given point.

[0058] The IaaS layer, or infrastructure layer, typically deploys a large number of servers that can provide central processing units (CPUs), memory, storage, networking, and other basic computing resources.

[0059] In related technologies, a single type of algorithm can be used for anomaly detection. However, traditional anomaly detection algorithms (such as statistical anomaly detection algorithms) can only detect isolated vertices within a local area; prediction-based anomaly detection algorithms can determine anomalies by calculating the residual between the predicted time-series curve and the actual data, but the prediction accuracy of the model will drop rapidly as the time window increases; similarity-based anomaly detection algorithms usually only focus on single-point anomalies and may ignore other complex anomalies; and since some deep learning-based models are built on recurrent neural networks, they require a large amount of online training and computing resources, so they cannot obtain anomaly detection results in real time.

[0060] As can be seen from the above description, in related technologies, using a single type of algorithm for anomaly detection may have various problems such as low accuracy, poor real-time performance, and the ability to detect only specific types of anomalies. In other words, there is no effective solution yet for how to detect various types of anomalies while ensuring real-time performance, i.e., how to improve the accuracy of anomaly detection while ensuring real-time performance.

[0061] Based on this, in various embodiments of this application, the detection model used to detect anomalies in the current performance indicator data of each server included in the IaaS layer is trained using a model fusion strategy based on weighted voting, utilizing a training dataset, at least two algorithms, and the weight coefficients corresponding to each algorithm. The at least two algorithms and the weight coefficients corresponding to each algorithm are determined using the time-series features related to performance indicators. Thus, when the detection model is subsequently used to detect anomalies in the current performance indicator data of each server included in the IaaS layer, the accuracy of anomaly detection can be improved. That is, it can detect abnormal performance indicator data of each server in the IaaS layer in real time and effectively, thereby ensuring the stable operation of the cloud service system.

[0062] This application provides a model training method applicable to electronic devices (such as servers), such as... Figure 1 As shown, the method includes:

[0063] Step 101: Determine the training dataset, which at least contains first data of the IaaS layer. The first data includes performance index data of each server in the IaaS layer for multiple performance indicators within a first time range. The performance index data represents the running status of the corresponding server.

[0064] Step 102: Based on the first data, determine the time-series features related to the multiple performance indicators, and at least use the determined time-series features to determine at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms;

[0065] Step 103: Using the training dataset, at least two determined algorithms and the weight coefficients corresponding to each algorithm, a model fusion strategy based on weighted voting is used to train a detection model. The detection model is used to perform anomaly detection on the second data of the IaaS layer. The second data includes the performance index data of each server included in the IaaS layer for the current multiple performance indicators.

[0066] In practical applications, the IaaS layer can be deployed with a massive number of servers. The specific number of servers included in the IaaS layer can be set according to requirements (it can be understood that the specific number of servers included in the IaaS layer must be an integer greater than 1), and this embodiment of the application does not limit this. In addition, each server included in the IaaS layer can contain (or correspond to or be configured with) thousands of performance indicators (i.e., the multiple performance indicators, or at least two performance indicators), such as CPU utilization, kernel status, memory utilization, network traffic, input and output (IO) data (such as disk-related IO data), and service response rate, etc. The specific number of performance indicators included in each server can also be set according to requirements, and this embodiment of the application does not limit this.

[0067] In practical applications, the specific size of the first time range can be set according to requirements, such as 24 hours.

[0068] In practical applications, in order to improve the training effect of the detection model, i.e. improve the accuracy of anomaly detection, the electronic device can filter out noise data in the collected performance index data after collecting performance index data of each server included in the IaaS layer for the multiple performance indicators within the first time range.

[0069] Based on this, in one embodiment, determining the training dataset may include:

[0070] Collect performance indicator data for each server included in the IaaS layer for the multiple performance indicators within the first time range;

[0071] The first data is obtained by filtering out noise data from the collected performance index data;

[0072] The training dataset is determined based at least on the first data.

[0073] In practical applications, the noise data can also be understood as dirty data. The specific type of noise data can be set according to requirements, such as acquisition error, type error, or null value.

[0074] In practical applications, in addition to the first data, the training dataset may also contain other data, such as historical anomaly data, i.e., performance indicator data of anomalies detected by the detection model; or indicator registration information, i.e., related information of the multiple performance indicators, such as the type of performance indicator and whether it is a critical performance indicator. Among them, critical performance indicators refer to performance indicators that are directly related to the business and will affect the quality of service (QoS), such as service response rate; critical performance indicators can be pre-set according to requirements, i.e., which performance indicators are critical performance indicators can be pre-defined.

[0075] In practical applications, the time-series features related to the multiple performance indicators may include at least one time-series feature corresponding to each of the multiple performance indicators.

[0076] Based on this, in one embodiment, determining the time-series characteristics related to the plurality of performance indicators based on the first data may include:

[0077] For each of the plurality of performance metrics, based on the first data, at least one time-series feature corresponding to the performance metric is determined.

[0078] In practical applications, different feature extraction methods can be used for different types of time-series features. For example, Table 1 shows the classification of time-series features and the feature extraction methods that can be used for each type of time-series feature.

[0079]

[0080]

[0081] Table 1

[0082] In practical applications, after determining the time-series features related to the multiple performance indicators, the multiple performance indicators can be classified (or grouped) according to the type of time-series features. Then, based on the classification results (i.e. grouping results), the weight coefficients of the at least two algorithms and each of the at least two algorithms can be determined.

[0083] Based on this, in one embodiment, determining at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms, using at least determined temporal characteristics, may include:

[0084] By using the type of at least one time-series feature corresponding to each performance indicator, the plurality of performance indicators are grouped to obtain at least two performance indicator groups, and each performance indicator group contains at least one performance indicator among the plurality of performance indicators.

[0085] Based on the first data and at least two sets of performance indicators, at least two algorithms are selected from a preset candidate algorithm library, and the weight coefficients corresponding to each algorithm are determined.

[0086] In practical applications, the types and number of algorithms included in the candidate algorithm library can be set according to requirements. For example, the candidate algorithm library may include at least the following algorithms:

[0087] Periodic detection algorithm;

[0088] Statistical algorithms;

[0089] Unsupervised algorithms;

[0090] Deep learning algorithms based on the Transformer architecture.

[0091] The periodicity detection algorithm can also be understood as a periodicity detection model, which can be implemented based on an automated periodicity detection algorithm and pre-set the detection period (e.g., a detection period in days). During the estimation process (i.e., using the periodicity detection algorithm for anomaly detection), considering the potential fluctuations and monotonically increasing / decreasing characteristics of the data, a Loess-based seasonal trend decomposition procedure (STL) can be used for time-series decomposition. This process breaks down and calculates factors such as the periodicity, trend, and residual fluctuations of historical data, and combines these with algorithms such as exponential or sliding window weighted averages to generate reasonable predictions for the data in the new time period.

[0092] The statistical algorithm can also be understood as a statistical model. This model can perform analysis of variance, year-on-year and month-on-month comparison, mean analysis, or dispersion analysis on the data within a specified window to determine whether outliers appear in the time series data.

[0093] The unsupervised algorithm can also be understood as an unsupervised model. This unsupervised algorithm can include the One-Class Support Vector Machine (One-Class SVM) algorithm, a singularity detection algorithm that finds a hyperplane to segment the samples, identifying points outside the hyperplane as outliers. For datasets with complex distributions within normal classes, the One-Class SVM model may be ineffective. The unsupervised algorithm can also include the Isolation Forest (IForest) algorithm, which randomly selects a feature and then randomly chooses a split plane from the maximum and minimum values ​​of the selected feature. In other words, the entire training dataset can be recursively divided like a tree, with the number of divisions equal to the path distance from the root node to the leaf node. By finding the leaf node with the shortest path, outliers can be found, i.e., anomalies can be detected.

[0094] The deep learning algorithm based on the Transformer architecture can also be understood as a Transformer-type deep learning model. Because it replaces the recurrent neural network structure in most temporal deep learning algorithms with the Transformer architecture, it can solve the problem of data incompatibility, thus significantly improving inference speed and anomaly detection efficiency. This model can learn potential temporal correlations from multi-layered deep features and can also employ a minimax strategy to further increase the difference in correlation between anomalies and normal points. By combining the standardized correlation difference with the reconstruction error, a new anomaly detection criterion can be defined.

[0095] In practical applications, at least two algorithms can be selected from the candidate algorithm library based on the fit between each performance index group and each algorithm contained in the candidate algorithm library, and the weight coefficient corresponding to each algorithm can be determined.

[0096] Based on this, in one embodiment, the step of selecting at least two algorithms from a preset candidate algorithm library based on the first data and at least two performance indicator groups, and determining the weight coefficient corresponding to each algorithm, may include:

[0097] For each of the at least two performance metric groups, based on the first data, determine the fit between the performance metric group and each algorithm contained in the candidate algorithm library;

[0098] Based on the fit between each performance metric group and each algorithm contained in the candidate algorithm library, at least two algorithms are selected from the candidate algorithm library;

[0099] The weight coefficients for each algorithm are determined based on the fit between each performance metric group and each of the at least two algorithms.

[0100] In practical applications, the specific method for determining the fit between a performance metric group and an algorithm can be set according to requirements. For example, the association between the data type (or type of performance metric) corresponding to the performance metric group and the algorithm can be pre-defined, and then the fit between a performance metric group and an algorithm can be determined based on this association. In other words, the corresponding algorithm can be selected from the candidate algorithm library based on this association. For example, for periodic data, a periodic detection algorithm and / or a statistical algorithm can be selected; for non-periodic data, a statistical algorithm and / or at least two unsupervised algorithms can be selected; for key performance indicator data, deep learning algorithms can be added (or superimposed or further selected) to perform multiple anomaly detection based on at least one of the periodic detection algorithm, statistical algorithm, and unsupervised algorithm.

[0101] In practical applications, the detection model can be understood as a fusion model or an integrated model. This model can vote on the anomaly detection results of at least two sub-models (i.e., the sub-models corresponding to each of the at least two algorithms) based on the weight coefficients corresponding to each of the at least two algorithms, and calculate the final fusion result, which is the final anomaly detection result. For example, assuming that four algorithms, i.e. four sub-models, are determined in step 102, and the weight coefficient corresponding to each sub-model is 0.25, then when the detection model determines whether a performance indicator data is abnormal, it needs to determine whether the sum of the products of the output results of the four sub-models and the weight coefficients (i.e., the output result of sub-model 1 * 0.25 + the output result of sub-model 2 * 0.25 + the output result of sub-model 3 * 0.25 + the output result of sub-model 4 * 0.25) is greater than 0.5. If the sum of the products of the output results of the four sub-models and the weight coefficients is greater than 0.5, the performance indicator data is abnormal; if the sum of the products of the output results of the four sub-models and the weight coefficients is less than or equal to 0.5, the performance indicator data is normal.

[0102] In practical applications, after the detection model has been initially trained, it can be used to detect anomalies in the current performance metrics data of each server included in the IaaS layer in real time.

[0103] Based on this, in one embodiment, the method may further include:

[0104] The second data is obtained by collecting the performance metrics data of each server included in the IaaS layer for the current multiple performance metrics.

[0105] The detection model is used to perform anomaly detection on the second data to obtain the detection results.

[0106] In practical applications, when the detection results contain abnormal performance index data, the electronic device can issue alarm information based on the type of abnormality (such as outlier anomalies, contextual anomalies, or periodic anomalies), thereby ensuring the stable operation of the cloud service system. This provides more feature inputs (such as the alarm information) for root cause localization of faults in intelligent operation and maintenance, thereby greatly reducing the risks of service downtime and business interruption, and shortening the mean time to repair faults.

[0107] Based on this, in one embodiment, the method may further include:

[0108] If the detection result contains abnormal performance index data, the server corresponding to the abnormal performance index data is identified, and an alarm message is issued. The alarm message includes at least the abnormal performance index data and the corresponding server.

[0109] In practical applications, the alarm information may also include the type of the anomaly, such as outlier anomaly, context anomaly, or periodic anomaly.

[0110] In practical applications, after the electronic device issues an alarm message, experts can verify the abnormal performance indicator data based on the alarm message, that is, determine whether the abnormal performance indicator data is a correct detection result, and then input the obtained verification result (i.e. verification information) into the electronic device so that the electronic device can perform corresponding operations based on the verification information, such as optimizing the detection model.

[0111] Based on this, in one embodiment, the method may further include:

[0112] Obtain the verification information corresponding to the alarm information, wherein the verification information indicates whether the abnormal performance indicator data is a correct detection result;

[0113] If the performance metric data indicating the anomaly is a correct detection result, the training dataset is updated using the anomaly performance metric data, and the detection model is optimized using the updated training dataset.

[0114] In practical applications, updating the training dataset using the abnormal performance metric data can be understood as storing the abnormal performance metric data in a database used to store the training dataset.

[0115] In practical applications, in response to erroneous detection results, the electronic device can use the abnormal performance index data to update the weight coefficients corresponding to each of the at least two algorithms, and then use the updated weight coefficients to optimize the detection model.

[0116] Based on this, in one embodiment, the method may further include:

[0117] If the verification information indicates that the abnormal performance index data is an incorrect detection result, the weight coefficients of each of the at least two algorithms are updated using the abnormal performance index data, and the detection model is optimized using the updated weight coefficients.

[0118] Specifically, in practical applications, the electronic device can utilize the abnormal performance indicator data to increase or decrease the weight coefficients corresponding to each of the at least two algorithms. For example, assuming four algorithms (four sub-models) are determined in step 102, and each sub-model has a weight coefficient of 0.25, for an abnormal performance indicator data point that is incorrectly detected by the detection model, the detection results of each sub-model for that performance indicator data can be confirmed. Assuming that sub-models 1 and 3 show no abnormality for that performance indicator data, while sub-models 2 and 4 show an abnormality, the electronic device can increase the weight coefficients corresponding to sub-models 1 and 3, and decrease the weight coefficients corresponding to sub-models 2 and 4. The specific formula for increasing / decreasing the weight coefficients can be set according to requirements; for example, the updated weight coefficients of sub-models 1 and 3 can be 0.35, and the updated weight coefficients of sub-models 2 and 4 can be 0.15.

[0119] In practical applications, when the electronic device optimizes the detection model to address erroneous detection results, it can also determine the safe range corresponding to the detection model, thereby further improving the accuracy of anomaly detection.

[0120] Based on this, in one embodiment, the method may further include:

[0121] When the verification information indicates that the abnormal performance index data is an erroneous detection result, when optimizing the detection model, the abnormal performance index data is used to determine the safe range corresponding to the detection model; wherein, when the output data of the detection model belongs to the safe range, the detection result of the detection model does not contain abnormal performance index data.

[0122] In practical applications, the safe interval can also be called a safe boundary, safe range, safe coefficient, or safe threshold, etc. In this application embodiment, the name of the safe interval is not limited, as long as its function is achieved (that is, when the output data of the detection model belongs to the safe interval, the detection result of the detection model does not contain abnormal performance index data).

[0123] The model training method provided in this application includes: determining a training dataset, wherein the training dataset contains at least first data of the IaaS layer, the first data including performance index data of each server included in the IaaS layer for multiple performance indicators within a first time range, the performance index data representing the running status of the corresponding server; based on the first data, determining time-series features related to the multiple performance indicators, and using at least the determined time-series features, determining at least two algorithms for anomaly detection of the first data and weight coefficients corresponding to each of the at least two algorithms; using the training dataset, the determined at least two algorithms and the weight coefficients corresponding to each algorithm, training a detection model using a model fusion strategy based on weighted voting, the detection model being used to perform anomaly detection of second data of the IaaS layer, the second data including performance index data of each server included in the IaaS layer for the multiple performance indicators at the current time. The solution provided in this application uses a detection model for anomaly detection of the current performance metric data of each server in the IaaS layer. This model is trained using a training dataset, at least two algorithms, and the weight coefficients corresponding to each algorithm, employing a model fusion strategy based on weighted voting. The at least two algorithms and the weight coefficients corresponding to each algorithm are determined using the time-series features related to performance metrics. Thus, when the detection model is subsequently used to detect anomalies in the current performance metric data of each server in the IaaS layer, the accuracy of anomaly detection can be improved. In other words, it can detect abnormal performance metric data of each server in the IaaS layer in real time and effectively, thereby ensuring the stable operation of the cloud service system.

[0124] The following section provides a more detailed description of this application with reference to application examples.

[0125] In this application example, such as Figure 2As shown, a unified, cloud-based, multi-model fusion, and real-time time-series anomaly detection algorithm framework for massive performance metrics at the IaaS layer is proposed. This framework can accurately detect and locate faulty servers for various types of anomalies in time-series performance data, thus efficiently detecting server performance anomalies to ensure the stable operation of overall maintenance services. Furthermore, based on anomaly feedback results, combined with expert experience and historical data annotation, the framework can automatically learn and optimize the algorithm's effectiveness online, thereby optimizing the detection model.

[0126] In this application example, such as Figure 2 As shown, the aforementioned anomaly detection framework can include three layers from top to bottom: a data layer, a training layer, and a detection layer. Additionally, the anomaly detection framework can include a time-series data acquisition module. Each server in the IaaS layer can have an agent program installed. The time-series data acquisition module can collect relevant performance metrics data (such as CPU utilization, kernel status, memory utilization, network traffic, I / O data (e.g., disk-related I / O data), and service response rate) from the agent program running within each server, providing data input to the data layer and the detection layer.

[0127] The data layer is used for data storage, such as storing historical performance index data (i.e., the first data mentioned above), historical anomaly data detected by the detection model, and index registration information, etc. The registration of the index can be understood as saving, storing, or marking as valid, that is, selecting and marking as valid performance indicators that need to be detected from a large number of performance indicators for storage.

[0128] The training layer is used to extract relevant time-series features based on historical data (such as historical performance index data, or historical performance index data and historical anomaly data) to train the detection model online. That is, a multi-model fusion strategy is adopted to generate an integrated model (i.e. the detection model mentioned above).

[0129] The detection layer receives real-time performance metrics data from the time-series data acquisition module. This real-time performance metrics data characterizes the current operating status of the massive number of servers. It detects abnormal performance metrics data from the real-time data, locates the abnormal servers, and provides feedback (i.e., alarms). Operations experts can make judgments based on the alarms. If the judgment is correct, the abnormal performance metrics data can be labeled (e.g., annotated anomaly type), and the labeled abnormal performance metrics data can be stored in the historical anomaly database. If the judgment is incorrect, the detected erroneous (i.e., abnormal) performance metrics data can be input into the training layer for automatic optimization of the detection model, and the relevant algorithm configuration parameters (i.e., the weight coefficients corresponding to each of the at least two algorithms mentioned above) can be updated.

[0130] In this application example, the training layer is the core of the anomaly detection framework, and the training layer specifically includes the following modules:

[0131] (1) Data Engineering Module: In response to the large amount of noise data (i.e., noisy data) that may exist in the historical performance index data, the data engineering module can remove dirty data (i.e., noisy data) such as collection errors, type errors, or null values, so as to avoid the impact of dirty data in historical data on the training effect of online models.

[0132] (2) The pre-processing algorithm module can detect the distribution, stability, and periodicity of the data, extract relevant time-series features of historical data (such as historical performance index data, or historical performance index data and historical abnormal data), select several models (i.e., models corresponding to at least two of the periodic algorithm, statistical algorithm, unsupervised algorithm, and deep learning algorithm) based on the extracted time-series features, and determine the pre-set weights of each model based on the extracted time-series features for the voting integration of the detection models in the later model integration module. Among them, for periodic data, periodic algorithms and statistical algorithms can be selected; for non-periodic data, statistical algorithms and multiple unsupervised algorithms can be selected; for key business indicators (i.e., the aforementioned key performance indicators, which performance indicators can be pre-set as key business indicators) data, deep learning algorithms can be added to perform multiple anomaly detection.

[0133] (3) The periodic algorithm module, which can also be understood as a periodic detection model, can be implemented based on an automated periodic detection algorithm and the detection period can be preset (e.g., a detection period in days). In the process of generating estimates (i.e., using periodic detection algorithms to detect anomalies), considering that the data may have fluctuations and monotonically increasing or decreasing characteristics, STL can be used for time series decomposition to break down and calculate the periodicity, trend, and residual fluctuation of historical data, and combine it with algorithms such as exponential or sliding window weighted average to generate reasonable prediction values ​​for the data in the new time period.

[0134] (4) The statistical algorithm module, which can also be understood as a statistical model, can perform variance analysis, year-on-year and month-on-month analysis, mean analysis, or dispersion analysis on the data within a specified window to determine whether there are outliers in the time series data.

[0135] (5) Unsupervised algorithm module, which can also be understood as unsupervised model. This model can be implemented by One-Class SVM algorithm. One-Class SVM is a singularity detection algorithm. It can find a hyperplane to divide the samples and identify points outside the plane as outliers. For datasets with complex distribution within normal classes, One-Class SVM model may be ineffective. Alternatively, this model can also be implemented by IFOreest algorithm. IFOreest algorithm can randomly select a feature and then randomly select a split plane between the maximum and minimum values ​​of the selected feature. In other words, the training of the entire training dataset can be recursively divided like a tree. The number of divisions is equal to the path distance from the root node to the leaf node. By finding the leaf node with the shortest path, outliers can be found, that is, anomalies are detected.

[0136] (6) The deep learning module, which can also be understood as a Transformer-type deep learning model, replaces the recurrent neural network structure in most temporal deep learning algorithms with the Transformer architecture. This solves the problem of data not being parallelizable, thereby significantly improving the inference speed and thus increasing the efficiency of anomaly detection. This model can learn potential temporal correlations from multi-level deep features and can also use the minimax strategy to further increase the difference in correlation between anomalies and normal points. By combining the standardized correlation difference with the reconstruction error, a new anomaly detection criterion can be defined.

[0137] (7) Model integration module, which is used to vote on the detection results of multiple models (i.e., at least two models among periodic detection models, statistical models, unsupervised models, and deep learning models) according to their corresponding weight coefficients, and calculate the final fusion result to obtain the integrated detection model.

[0138] The solution provided in this application example has the following advantages:

[0139] 1) Taking into full account the periodicity and other characteristics of performance data, the detection model is trained using a multi-model fusion learning strategy. This enables the detection model to detect abnormal fluctuations in server performance indicators in real time and effectively. In other words, it can detect various types of time-series anomalies and generate corresponding alarms based on the type of anomaly. This ensures the stable operation of the cloud service system. In other words, it provides more feature inputs (such as alarms) for root cause localization of faults in intelligent operation and maintenance, thereby greatly reducing the risk of service downtime and business interruption and shortening the average fault repair time.

[0140] 2) The detection model does not rely on prior knowledge and annotations of the data during the initial run (i.e., during the first model training), thereby improving the model training efficiency;

[0141] 3) It can realize online training and optimization of detection models, that is, it can adjust the corresponding model strategies (such as the weight coefficients of the model and / or the safe range of the model) based on the feedback detection results (i.e. alarms) and expert experience, thereby effectively avoiding false alarms of abnormal indicators caused by normal business peaks and further improving the anomaly detection accuracy of time series data.

[0142] To implement the method of the embodiments of this application, the embodiments of this application also provide a model training device, which is set on an electronic device (such as a server), such as... Figure 3 As shown, the device includes:

[0143] The first processing unit 301 is used to determine a training dataset, the training dataset containing at least the first data of the IaaS layer, the first data including the performance index data of each server in the IaaS layer for multiple performance indicators in a first time range, the performance index data representing the running status of the corresponding server.

[0144] The second processing unit 302 is configured to determine the time-series features related to the plurality of performance indicators based on the first data, and at least use the determined time-series features to determine at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms.

[0145] The third processing unit 303 is used to train a detection model using the training dataset, at least two determined algorithms and the weight coefficients corresponding to each algorithm, and a model fusion strategy based on weighted voting. The detection model is used to perform anomaly detection on the second data of the IaaS layer. The second data includes the performance index data of each server included in the IaaS layer for the current multiple performance indicators.

[0146] In one embodiment, the second processing unit 302 is further configured to determine at least one time-series feature corresponding to each of the plurality of performance indicators based on the first data.

[0147] In one embodiment, the second processing unit 302 is further configured to:

[0148] By using the type of at least one time-series feature corresponding to each performance indicator, the plurality of performance indicators are grouped to obtain at least two performance indicator groups, and each performance indicator group contains at least one performance indicator among the plurality of performance indicators.

[0149] Based on the first data and at least two sets of performance indicators, at least two algorithms are selected from a preset candidate algorithm library, and the weight coefficients corresponding to each algorithm are determined.

[0150] In one embodiment, the second processing unit 302 is further configured to:

[0151] For each of the at least two performance metric groups, based on the first data, determine the fit between the performance metric group and each algorithm contained in the candidate algorithm library;

[0152] Based on the fit between each performance metric group and each algorithm contained in the candidate algorithm library, at least two algorithms are selected from the candidate algorithm library;

[0153] The weight coefficients for each algorithm are determined based on the fit between each performance metric group and each of the at least two algorithms.

[0154] In one embodiment, such as Figure 3 As shown, the device may further include a data acquisition unit 304, which is used to acquire performance index data of each server included in the IaaS layer for the multiple performance indicators within the first time range.

[0155] Accordingly, the first processing unit 301 is further configured to:

[0156] The first data is obtained by filtering out noise data from the collected performance index data;

[0157] The training dataset is determined based at least on the first data.

[0158] In one embodiment, such as Figure 3 As shown, the device may also include a detection unit 305;

[0159] The acquisition unit 304 is also used to acquire the performance index data of each server included in the IaaS layer for the current multiple performance indicators, and obtain the second data;

[0160] The detection unit 305 is used to perform anomaly detection on the second data using the detection model to obtain a detection result.

[0161] In one embodiment, the detection unit 305 is further configured to, when the detection result contains abnormal performance index data, determine the server corresponding to the abnormal performance index data and issue an alarm message, wherein the alarm message at least includes the abnormal performance index data and the corresponding server.

[0162] In one embodiment, such as Figure 3 As shown, the device may further include:

[0163] The acquisition unit 306 is used to acquire the verification information corresponding to the alarm information, wherein the verification information indicates whether the abnormal performance index data is a correct detection result.

[0164] The fourth processing unit 307 is used to update the training dataset using the abnormal performance index data when the verification information indicates that the abnormal performance index data is a correct detection result, and to optimize the detection model using the updated training dataset.

[0165] In one embodiment, the fourth processing unit 307 is further configured to, when the verification information indicates that the abnormal performance index data is an erroneous detection result, update the weight coefficients corresponding to each of the at least two algorithms using the abnormal performance index data, and optimize the detection model using the updated weight coefficients.

[0166] In one embodiment, the fourth processing unit 307 is further configured to determine the safe range corresponding to the detection model by using the abnormal performance index data when optimizing the detection model; wherein, when the output data of the detection model belongs to the safe range, the detection result of the detection model does not contain abnormal performance index data.

[0167] The functions of the first processing unit 301, the second processing unit 302, the third processing unit 303, the acquisition unit 306, and the fourth processing unit 307 are equivalent to the functions of the training layer in the anomaly detection framework of the above application example; the function of the acquisition unit 304 is equivalent to the function of the time-series data acquisition module in the anomaly detection framework of the above application example; and the function of the detection unit 305 is equivalent to the function of the detection layer in the anomaly detection framework of the above application example.

[0168] In practical applications, the first processing unit 301, the second processing unit 302, the third processing unit 303, the detection unit 305, and the fourth processing unit 307 can be implemented by the processor in the model training device; the acquisition unit 304 and the acquisition unit 306 can be implemented by the processor in the model training device in conjunction with the communication interface.

[0169] It should be noted that the model training device provided in the above embodiments is only illustrated by the division of the above program modules when training the model. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the model training device and the model training method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0170] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide an electronic device, such as... Figure 4 As shown, the electronic device 400 includes:

[0171] The communication interface 401 enables information exchange with other electronic devices;

[0172] The processor 402 is connected to the communication interface 401 to enable information interaction with other electronic devices and to execute the methods provided by one or more of the above technical solutions when running computer programs.

[0173] The memory 403 stores computer programs that can run on the processor 402.

[0174] Specifically, the processor 402 is used for:

[0175] A training dataset is determined, wherein the training dataset contains at least the first data of the IaaS layer, the first data including the performance index data of each server included in the IaaS layer for multiple performance indicators in a first time range, the performance index data representing the running status of the corresponding server.

[0176] Based on the first data, determine the time-series features related to the multiple performance indicators, and at least using the determined time-series features, determine at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms;

[0177] Using the training dataset, at least two determined algorithms and the weight coefficients corresponding to each algorithm, a detection model is trained using a model fusion strategy based on weighted voting. The detection model is used to detect anomalies in the second data of the IaaS layer, which includes the performance index data of each server in the IaaS layer for the current multiple performance metrics.

[0178] In one embodiment, the processor 402 is further configured to determine at least one timing feature corresponding to each of the plurality of performance metrics based on the first data.

[0179] In one embodiment, the processor 402 is further configured to:

[0180] By using the type of at least one time-series feature corresponding to each performance indicator, the plurality of performance indicators are grouped to obtain at least two performance indicator groups, and each performance indicator group contains at least one performance indicator among the plurality of performance indicators.

[0181] Based on the first data and at least two sets of performance indicators, at least two algorithms are selected from a preset candidate algorithm library, and the weight coefficients corresponding to each algorithm are determined.

[0182] In one embodiment, the processor 402 is further configured to:

[0183] For each of the at least two performance metric groups, based on the first data, determine the fit between the performance metric group and each algorithm contained in the candidate algorithm library;

[0184] Based on the fit between each performance metric group and each algorithm contained in the candidate algorithm library, at least two algorithms are selected from the candidate algorithm library;

[0185] The weight coefficients for each algorithm are determined based on the fit between each performance metric group and each of the at least two algorithms.

[0186] In one embodiment, the processor 402 is further configured to:

[0187] The communication interface 401 is used to collect performance index data for the multiple performance indicators of each server included in the IaaS layer within the first time range.

[0188] The first data is obtained by filtering out noise data from the collected performance index data;

[0189] The training dataset is determined based at least on the first data.

[0190] In one embodiment, the processor 402 is further configured to:

[0191] The second data is obtained by collecting performance index data of each server in the IaaS layer for the current multiple performance indicators through the communication interface 401.

[0192] The detection model is used to perform anomaly detection on the second data to obtain the detection results.

[0193] In one embodiment, the processor 402 is further configured to, when the detection result contains abnormal performance indicator data, determine the server corresponding to the abnormal performance indicator data and issue an alarm message, wherein the alarm message at least includes the abnormal performance indicator data and the corresponding server.

[0194] In one embodiment, the processor 402 is further configured to:

[0195] The verification information corresponding to the alarm information is obtained through the communication interface 401. The verification information indicates whether the abnormal performance index data is a correct detection result.

[0196] If the performance metric data indicating the anomaly is a correct detection result, the training dataset is updated using the anomaly performance metric data, and the detection model is optimized using the updated training dataset.

[0197] In one embodiment, the processor 402 is further configured to, when the verification information indicates that the abnormal performance index data is an erroneous detection result, update the weight coefficients corresponding to each of the at least two algorithms using the abnormal performance index data, and optimize the detection model using the updated weight coefficients.

[0198] In one embodiment, the processor 402 is further configured to, when optimizing the detection model, use the abnormal performance index data to determine the safe range corresponding to the detection model; wherein, when the output data of the detection model belongs to the safe range, the detection result of the detection model does not contain abnormal performance index data.

[0199] It should be noted that the specific processing procedure of the processor 402 can be understood by referring to the above method, and will not be repeated here.

[0200] Of course, in practical applications, the various components in electronic device 400 are coupled together through bus system 404. It can be understood that bus system 404 is used to realize the connection and communication between these components. In addition to a data bus, bus system 404 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, in... Figure 4The general designated all buses as Bus System 404.

[0201] The memory 403 in this embodiment is used to store various types of data to support the operation of the electronic device 400. Examples of such data include any computer program used to operate on the electronic device 400.

[0202] The methods disclosed in the embodiments of this application can be applied to processor 402, or implemented by processor 402. Processor 402 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 402 or by instructions in the form of software. The processor 402 may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 402 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 403. Processor 402 reads the information in memory 403 and combines its hardware to complete the steps of the aforementioned method.

[0203] In an exemplary embodiment, the electronic device 400 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the aforementioned method.

[0204] It is understood that the memory 403 in this embodiment can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memories described in the embodiments of this application are intended to include, but are not limited to, these and any other suitable types of memories.

[0205] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 403 storing a computer program, which can be executed by the processor 402 of the electronic device 400 to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0206] It should be noted that terms such as "first" and "second" are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0207] Furthermore, the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict.

[0208] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

Claims

1. A model training method, characterized in that, include: A training dataset is determined, wherein the training dataset contains at least the first data of the Infrastructure as a Service (IaaS) layer, the first data including performance index data of each server included in the IaaS layer for multiple performance indicators within a first time range, the performance index data representing the running status of the corresponding server. Based on the first data, determine the time-series features related to the multiple performance indicators, and at least using the determined time-series features, determine at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms; Using the training dataset, at least two determined algorithms and the weight coefficients corresponding to each algorithm, a model fusion strategy based on weighted voting is used to train a detection model. The detection model is used to detect anomalies in the second data of the IaaS layer. The second data includes the performance index data of each server included in the IaaS layer for the current multiple performance indicators. The method further includes: The detection model is used to perform anomaly detection on the second data to obtain the detection results; If the detection results contain abnormal performance index data, an alarm message will be issued; Obtain the verification information corresponding to the alarm information, and optimize the detection model based on the verification information; wherein, when optimizing the detection model, use the abnormal performance index data in the alarm information to determine the safe range corresponding to the detection model; wherein, when the output data of the detection model belongs to the safe range, the detection result of the detection model does not contain abnormal performance index data.

2. The method according to claim 1, characterized in that, The step of determining the time-series characteristics related to the multiple performance indicators based on the first data includes: For each of the plurality of performance metrics, based on the first data, at least one time-series feature corresponding to the performance metric is determined.

3. The method according to claim 2, characterized in that, The step of determining at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms, using at least certain temporal characteristics, includes: By using the type of at least one time-series feature corresponding to each performance indicator, the plurality of performance indicators are grouped to obtain at least two performance indicator groups, and each performance indicator group contains at least one performance indicator among the plurality of performance indicators. Based on the first data and at least two sets of performance indicators, at least two algorithms are selected from a preset candidate algorithm library, and the weight coefficients corresponding to each algorithm are determined.

4. The method according to claim 3, characterized in that, The step of selecting at least two algorithms from a preset candidate algorithm library based on the first data and at least two performance indicator groups, and determining the weight coefficient corresponding to each algorithm, includes: For each of the at least two performance metric groups, based on the first data, determine the fit between the performance metric group and each algorithm contained in the candidate algorithm library; Based on the fit between each performance metric group and each algorithm contained in the candidate algorithm library, at least two algorithms are selected from the candidate algorithm library; The weight coefficients for each algorithm are determined based on the fit between each performance metric group and each of the at least two algorithms.

5. The method according to claim 3, characterized in that, The candidate algorithm library contains at least the following algorithms: Periodic detection algorithm; Statistical algorithms; Unsupervised algorithms; Deep learning algorithms based on the Transformer architecture.

6. The method according to claim 1, characterized in that, The determination of the training dataset includes: Collect performance indicator data for each server included in the IaaS layer for the multiple performance indicators within the first time range; The first data is obtained by filtering out noise data from the collected performance index data; The training dataset is determined based at least on the first data.

7. The method according to claim 1, characterized in that, The method further includes: The second data is obtained by collecting the performance metrics data of each server included in the IaaS layer for the current multiple performance metrics.

8. The method according to claim 7, characterized in that, The method further includes: If the detection result contains abnormal performance index data, the server corresponding to the abnormal performance index data is identified, and an alarm message is issued. The alarm message includes at least the abnormal performance index data and the corresponding server.

9. The method according to claim 8, characterized in that, The method further includes: Obtain the verification information corresponding to the alarm information, wherein the verification information indicates whether the abnormal performance indicator data is a correct detection result; If the performance metric data indicating the anomaly is a correct detection result, the training dataset is updated using the anomaly performance metric data, and the detection model is optimized using the updated training dataset.

10. The method according to claim 8, characterized in that, The method further includes: Obtain the verification information corresponding to the alarm information, wherein the verification information indicates whether the abnormal performance indicator data is a correct detection result; If the verification information indicates that the abnormal performance index data is an incorrect detection result, the weight coefficients of each of the at least two algorithms are updated using the abnormal performance index data, and the detection model is optimized using the updated weight coefficients.

11. A model training device, characterized in that, include: The first processing unit is used to determine a training dataset, the training dataset containing at least the first data of the IaaS layer, the first data including the performance index data of each server in the IaaS layer for multiple performance indicators in a first time range, the performance index data representing the running status of the corresponding server. The second processing unit is configured to determine the time-series features related to the plurality of performance indicators based on the first data, and at least use the determined time-series features to determine at least two algorithms for anomaly detection of the first data and the weight coefficients corresponding to each of the at least two algorithms. The third processing unit is used to train a detection model using the training dataset, at least two determined algorithms and the weight coefficients corresponding to each algorithm, and a model fusion strategy based on weighted voting. The detection model is used to perform anomaly detection on the second data of the IaaS layer. The second data includes the performance index data of each server included in the IaaS layer for the current multiple performance indicators. The model training device further includes: The detection unit is used to perform anomaly detection on the second data using the detection model to obtain a detection result; and to issue an alarm message if the detection result contains abnormal performance index data. The acquisition unit is used to acquire the verification information corresponding to the alarm information; The fourth processing unit is used to optimize the detection model based on the verification information; wherein, when optimizing the detection model, the abnormal performance index data is used to determine the safe range corresponding to the detection model; wherein, when the output data of the detection model belongs to the safe range, the detection result of the detection model does not contain abnormal performance index data.

12. An electronic device, characterized in that, include: The processor and the memory used to store computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 10.

13. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 10.

Images