An anti-overfitting lightweight anomaly detection neural network model retraining method

Abstract

The application discloses a lightweight anti-overfitting neural network model retraining method, which is used for retraining a deep variational autoencoder-based anomaly detection model; when data distribution changes, the conditional distribution of the hidden state and the reconstructed data sample obtained by the encoder and the decoder of the deep variational autoencoder also changes; the application adjusts the conditional distribution of the hidden state and the reconstructed data calculated by the old model by using a mapping function, so as to adapt to the new data distribution; the mapping function has the characteristics of simplicity and convexity; under the premise of using the loss function form defined by the application, the retraining process can be ensured to have a fast convergence rate and light overhead. In addition, the application proposes a kind of ruminating module for data enhancement of new observation data, so as to solve the problem of insufficient new observation sample data in the initial stage of cloud service feature change.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing technology, specifically relating to a method for retraining a lightweight anomaly detection neural network model that is resistant to overfitting. Background Technology

[0002] In the field of cloud computing, neural network models are often used to infer anomalies based on monitoring indicators of running services in order to detect and resolve service anomalies in a timely manner. For example, OmniAnomaly, MSCRED, and DVGCRN are all deep learning methods with high recognition and good results in the current research field.

[0003] However, in many cloud service providers' business scenarios, cloud-native environments are highly dynamic, manifested in the activation of new services, the upgrading and decommissioning of older services. Neural network models trained on older data often exhibit poor accuracy in detecting anomalies in new cloud-native environments. Therefore, methods using neural network models for anomaly detection are highly time-sensitive, requiring frequent updates to the trained anomaly detection models.

[0004] Using the above methods for anomaly detection incurs significant retraining overhead when frequent model updates are required. Furthermore, when cloud service characteristics are just beginning to change, there is insufficient observational data for the new service behavior features. These neural networks are quite complex, making them prone to overfitting during training.

[0005] Based on the above observations, ProS [Atsutoshi Kumagai, Tomoharu Iwata, and Yasuhiro Fujiwara. Transfer anomaly detection by inferring latent domain representations. Advances in neural information processing systems, 32, 2019] uses transfer learning to transfer a model trained on older data to new anomaly detection scenarios. This method represents the applicable data distribution for anomaly detection as a column vector using order-independent embeddings and trains the model to use matching anomaly detection methods for different column vectors representing different data distributions. The advantage of this method is that it eliminates the need for retraining; only data from the new distribution and its representation vector are needed to use the current model for anomaly detection. However, this method exhibits significant errors when the differences between the old and new data distributions are large, and it requires collecting a sufficient amount of data from the new distribution to obtain an accurate representation vector; otherwise, it will greatly affect the model's accuracy.

[0006] Given the long waiting period required to collect sufficient new distribution data, JumpStarter [Minghua Ma and Shenglin Zhang. Jump-starting multivariate time series anomaly detection for online service systems. In Proceedings of the 2021 USENIX Annual Technical Conference, 2021] uses a signal sampling and reconstruction method to detect anomalies. This method avoids the retraining problem of neural network methods and can immediately detect whether a service anomaly has occurred without waiting for too much new distribution data; however, this method is not very real-time, and the computational and time costs of judging a single anomaly are large, which cannot meet the application scenarios of high peak traffic monitoring. Summary of the Invention

[0007] In view of the above, the present invention provides a lightweight anomaly detection neural network model retraining method that is resistant to overfitting. It adjusts the probability distribution learned by the encoder and decoder on the basis of the old model to update the anomaly detection model, so as to achieve the purpose of low overhead and resistance to overfitting.

[0008] A lightweight anomaly detection neural network model retraining method resistant to overfitting includes the following steps:

[0009] (1) In the initial stage of retraining, retain the model M trained with the old observation data samples. old ;

[0010] (2) Use the rumination module to generate shadow data that is similar to the new observation data sample;

[0011] (3) Based on the new observation data sample and its shadow data, the distribution of the new hidden state under the condition of the known new observation data sample is estimated by Bayes' formula;

[0012] (4) Use the mapping function to transform model M old The generated hidden states are mapped to new hidden states, and the model M is... old The output reconstructed sample is mapped to the new observation data sample;

[0013] (5) Fit the above mapping function in the form of a loss function.

[0014] Furthermore, the model M old This is an anomaly detection model based on deep variational autoencoders (DVAEs).

[0015] Furthermore, the specific implementation of step (2) is as follows: for any new observation data sample, input it into model M. old The encoder generates a corresponding hidden state, and then inputs this hidden state into the model M. old In the decoder, the Monte Carlo method is then used based on model M. old The decoder calculates the probability distribution and then randomly samples the reconstructed samples to generate n shadow data. i = 1, 2, ..., n, where n is a natural number greater than 1.

[0016] Furthermore, the expression for Bayes' formula in step (3) is as follows:

[0017]

[0018]

[0019]

[0020] Where: x represents the observed data sample, z represents the hidden state, and p1(z|x) represents the distribution of z given x. This indicates that under the given z condition The distribution, This represents a new sample of observational data. This represents the expectation of z given that z follows the distribution p1(z|x). This indicates that z follows the distribution p1(z|x). T z's expectation T Indicates transpose. E represents the variance of z given that z follows the distribution p1(z|x). z～P(z) [] represents the expectation function given that z follows P(z), where P(z) is a standard normal distribution. This indicates that under the given z condition The distribution, express The i-th shadow data.

[0021] Furthermore, let Indicates known New hidden state under the condition, new hidden state The distribution is due to and composition.

[0022] Furthermore, in step (4), two trainable mapping functions M are used. z and M x Mapping function M z Used to convert model Mold The generated hidden state Mapped to the new hidden state estimated in step (3) The expectation, mapping function M x Used to convert model M old Output reconstructed samples Mapped to new observation data samples Immediately Fitting make Fitting

[0023] Furthermore, the mapping function and The expression is as follows:

[0024]

[0025]

[0026] in: and They are respectively and Expectations and They are respectively and Expectations, Σ 12 for and The correlation matrix, Σ 11 for The autocorrelation matrix, This is a sample of old observation data. for and The correlation matrix, for The autocorrelation matrix, for The corresponding reconstructed samples, for The corresponding reconstructed sample.

[0027] Furthermore, the specific implementation of step (5) is as follows: using gradient descent to make and Error and and The error is minimized, and the total loss function is expressed as follows:

[0028]

[0029] in: For the total loss function, They represent the mapping function M respectively. x and M z Trainable parameters, Indicates the use of measurement and The loss function for the magnitude of the error. Indicates the use of measurement and The loss function for the magnitude of the error.

[0030] The method proposed in this invention is based on deep variational autoencoders and their variants. The main principle of a deep variational autoencoder is that the encoder learns a probability distribution of the hidden states given known data samples, and the decoder learns a probability distribution of reconstructing the data samples given the probabilities of the hidden states. The probability of reconstructing the samples is calculated by multiplying the two probabilities together. Since normal samples are used for training, the model learns the encoding and reconstruction rules for normal samples. When abnormal samples appear, the reconstruction probability calculated by the model will be lower. When the data distribution changes, the data distribution learned by both the encoder and decoder of the deep variational autoencoder changes.

[0031] Therefore, this invention proposes a retraining method for an anomaly detection model based on Deep Variational Autoencoders (DVAEs). When the data distribution changes, the conditional distributions of the hidden states and reconstructed data samples obtained by the encoder and decoder of the DVAE also change. This invention uses a mapping function to adjust the conditional distributions of the hidden states and reconstructed data calculated by the old model to adapt to the new data distribution. This mapping function has simple and convex characteristics, and under the premise of using the loss function form defined in this invention, it can ensure a fast convergence rate and lightweight overhead in the retraining process. In addition, this invention proposes a rumination module to perform data augmentation on new observation data, solving the problem of insufficient new observation sample data in the early stage when cloud service features change. Attached Figure Description

[0032] Figure 1 This is a schematic diagram of the neural network model and its retraining process of the present invention. The gray box represents the training part of the old model using old data, the white box represents the retraining part, the black arrow represents the process of training the old model, and the gray arrow represents the retraining process. Detailed Implementation

[0033] To describe the present invention in more detail, the technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0034] In a service cluster, service-related data is monitored and collected in real time. When a significant decrease in the accuracy of the current anomaly detection model is detected, specifically a significant drop in the F1 score, the following operations are performed using the current model:

[0035] Using the data with significantly decreased F1 scores as observation samples of the new distribution, the encoder of the old model is used to encode each observation sample of the new distribution, obtaining the hidden state for each observation sample of the new distribution. For each obtained hidden state, the decoder of the old model is used to decode and sample to generate three to five shadow data points. Using the generated shadow data and the observation samples of the new distribution, the distribution of the hidden state in the new data distribution under the known data sample conditions is estimated according to Bayes' theorem. Gradient descent is used to adjust the mapping function to map the distribution of the hidden state and the reconstructed data calculated by the model to the estimated distribution of the new hidden state and the new reconstructed data, such as... Figure 1 As shown.

[0036] Let the observation data of the old distribution be... The observation data for the new distribution are The old distribution's observation data was reconstructed into samples. The newly distributed observation data reconstructed the sample as follows The hidden state that follows the old distribution is denoted as . The hidden state that follows the new distribution is denoted as . For observed data of the old distribution, the distribution of the hidden state is denoted as p0(z|x) given the known data samples; and the data distribution is denoted as p0(x|z) given the known hidden state. For observed data of the new distribution, the distribution of the hidden state is denoted as p1(z|x) given the known samples; and the data distribution is denoted as p1(x|z) given the known hidden state.

[0037] First, for each newly observed data sample, it is input into the encoder of the old model to generate a hidden state. The hidden state is input into the decoder of the old model. Using the Monte Carlo method, based on the probability distribution calculated by the encoder of the old model, n reconstructed data points are randomly sampled and generated.

[0038] Then, based on the online Bayesian formula, estimation is performed using shadow data and new observation data. The value of is shown in the following formula:

[0039]

[0040]

[0041]

[0042] Where: P(z) is the standard normal distribution. The i-th shadow data is generated for the current new observation data. Since the model applicable to this invention is a deep variational autoencoder, its hidden state distribution under known observation data conditions is a normal distribution. According to the above formula, the expectation and variance of this distribution can be used to obtain the accurate probability density function of the posterior distribution of the hidden state for the current new observation sample.

[0043] Then, two trainable mapping functions M are used. z M x Map the hidden states generated by the old model to the new hidden states estimated in the previous step. The expectation is to map the data samples reconstructed from the old model to the newly observed samples, that is, to let Fitting make Fitting These trainable mapping functions are in the form of the following equation:

[0044]

[0045]

[0046] in: They are respectively and Expectations; Σ 12 Σ 11 They are respectively and The correlation matrix, and The correlation matrix; They are respectively and The correlation matrix, and The correlation matrix, and these parameters are all trainable parameters of the mapping function.

[0047] Finally, gradient descent is used to make... and and The error is minimized; the loss function for this training process is defined as follows:

[0048]

[0049] In principle, the mapping function proposed in this invention can be replaced by any convex and Lipzig-continuous function. and And achieve The convergence rate. Based on Occam's razor principle, a simple loss function that satisfies the conditions can be used, such as the MSE loss function.

[0050] The above description of the embodiments is provided to enable those skilled in the art to understand and apply the present invention. Those skilled in the art can readily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without creative effort. Therefore, the present invention is not limited to the above embodiments, and any improvements and modifications made to the present invention by those skilled in the art based on the disclosure thereof should be within the scope of protection of the present invention.

Claims

1. A lightweight anomaly detection neural network model retraining method resistant to overfitting, wherein in a service cluster, service-related data is monitored and collected in real time, and when a significant decrease in the accuracy of the current anomaly detection model is detected, the following operations are performed using the current model: (1) In the initial stage of retraining, retain the model M trained with the old observation data samples. old ; (2) Use the rumination module to generate shadow data that is similar to the new observation data sample. The specific implementation method is as follows: For any new observation data sample, input it into model M. old The encoder generates a corresponding hidden state, and then inputs this hidden state into the model M. old In the decoder, the Monte Carlo method is then used based on model M. old The decoder calculates the probability distribution and then randomly samples the reconstructed samples to generate n shadow data. i = 1, 2, ..., n, where n is a natural number greater than 1; (3) Based on the new observation data sample and its shadow data, the distribution of the new hidden state under the condition of the known new observation data sample is estimated by Bayes' formula; (4) Use the mapping function to transform model M old The generated hidden states are mapped to new hidden states, and the model M is... old The output reconstructed sample is mapped to the new observation data sample; (5) Fit the above mapping function in the form of a loss function.

2. The lightweight anomaly detection neural network model retraining method according to claim 1, characterized in that: The model M old This is an anomaly detection model based on a deep variational autoencoder.

3. The lightweight anomaly detection neural network model retraining method according to claim 1, characterized in that: The expression for Bayes' formula in step (3) is as follows: Where: x represents the observed data sample, z represents the hidden state, and p1(z|x) represents the distribution of z given x. This indicates that under the given z condition The distribution, This represents a new sample of observational data. This represents the expectation of z given that z follows the distribution p1(z|x). This indicates that z follows the distribution p1(z|x). T z's expectation T Indicates transpose. E represents the variance of z given that z follows the distribution p1(z|x). z～P(z) [] represents the expectation function given that z follows P(z), where P(z) is a standard normal distribution. This indicates that under the given z condition The distribution, express The i-th shadow data.

4. The lightweight anomaly detection neural network model retraining method according to claim 3, characterized in that: make Indicates known New hidden state under the condition, new hidden state The distribution is due to and composition.

5. The lightweight anomaly detection neural network model retraining method according to claim 4, characterized in that: In step (4), two trainable mapping functions M are used. z and M x Mapping function M z Used to convert model M old The generated hidden state Mapped to the new hidden state estimated in step (3) The expectation, mapping function M x Used to convert model M old Output reconstructed samples Mapped to new observation data samples Immediately Fitting make Fitting 6. The lightweight anomaly detection neural network model retraining method according to claim 5, characterized in that: The mapping function and The expression is as follows: in: and They are respectively and Expectations and They are respectively and Expectations, Σ 12 for and The correlation matrix, Σ 11 for The autocorrelation matrix, This is a sample of old observation data. for and The correlation matrix, for The autocorrelation matrix, for The corresponding reconstructed samples, for The corresponding reconstructed sample.

7. The lightweight anomaly detection neural network model retraining method according to claim 6, characterized in that: The specific implementation of step (5) is as follows: using gradient descent to make and Error and and The error is minimized, and the total loss function is expressed as follows: in: For the total loss function, They represent the mapping function M respectively. x and M z Trainable parameters, Indicates the use of measurement and The loss function for the magnitude of the error. Indicates the use of measurement and The loss function for the magnitude of the error.

Images