KPI data dimensionality reduction method based on inter-metric and time dimension selection, electronic device and storage medium

Abstract

The KPI data dimensionality reduction method, electronic device and storage medium based on inter-metric and time dimension selection belong to the field of anomaly detection processing technology. In order to improve the accuracy and efficiency in multi-dimensional KPI anomaly detection, the multi-dimensional KPI data set of the present invention is subjected to low variance filtering processing to obtain a pre-processed multi-dimensional KPI data set; inter-metric dimension selection processing is performed, including using time series coding to compress the KPI sequence, and then using mean shift clustering to retain the correlation dimension to obtain a multi-dimensional KPI data set selected by the inter-metric dimension; the pre-processed multi-dimensional KPI data set is subjected to time dimension selection processing, including using 3-sigma to mark the outliers of the KPI data of each dimension, and then using sample entropy to select the dimension where the outliers conform to the real anomaly distribution, to obtain a multi-dimensional KPI data set selected by the time dimension; the two data sets are taken as a union to obtain a KPI data dimensionality reduction data set based on the inter-metric and time dimension selection.

Description

Technical Field

[0001] The present invention belongs to the technical field of anomaly detection and processing, and particularly relates to a KPI data dimensionality reduction method, an electronic device and a storage medium based on the selection of metrics and time dimensions. Background Art

[0002] KPI (Key Performance Indicator) is essentially a series of time series generated by machines. KPI is monitored according to time series, and the measured metrics include CPU utilization rate, number of online users, number of jobs, etc. It reflects the operating status of cloud services and infrastructure. With the rapid development of cloud services, multi-dimensional KPIs are continuously generated during the service operation process. In recent years, in order to meet the needs of effective anomaly detection, multivariate KPI anomaly detection based on deep learning has become the mainstream trend. With the increase in the number of KPI dimensions, the redundant dimensions in anomaly detection are also increasing. Data with high-dimensional complexity increases the computational cost and storage requirements. This phenomenon is called the "curse of dimensionality", resulting in a decrease in the accuracy of anomaly detection and an increase in the training time. Therefore, data dimensionality reduction methods are very important in multi-dimensional KPI anomaly detection. However, although there are a large number of data dimensionality reduction methods for time series data, there is currently no dedicated research on dimensionality reduction methods for KPI data.

[0003] Taking the feature extraction method represented by PCA as an example, the feature extraction method transforms or maps the original data onto the extracted features. PCA (Principal Component Analysis) uses orthogonal transformation to transform the observed data represented by linearly correlated variables into a small number of data represented by independent independent variables. The idea of PCA is to map n-dimensional features onto k dimensions (k < n), which is a brand-new orthogonal feature. This k-dimensional feature is called the principal component, which is a reconstructed k-dimensional feature, rather than removing the remaining n - k dimensions from the n-dimensional features.

[0004] Taking feature selection methods represented by SVM-RFE, CSFS, etc. as an example, the feature selection method removes the number of features in the original data set by deleting redundant features, thus better retaining the features of the original data set. The feature selection method does not change the values of the original features, and the newly generated k features are obtained by deleting n - k dimensions from the original n-dimensional features.

[0005] However, whether it is a feature extraction or a feature selection method, it is often designed for general time series. In KPI anomaly detection, compared with time series, the model pays more attention to outliers and anomaly values. Outliers refer to those values that deviate significantly from the surrounding points. If the outliers match the true anomaly points well, the accuracy of anomaly detection will be improved. On the contrary, if there are many outliers that are not anomaly values, a large number of false positives will be generated. Summary of the invention

[0006] The problem to be solved by the present invention is to improve the accuracy and efficiency in multi-dimensional KPI anomaly detection, and propose a KPI data dimensionality reduction method, electronic device and storage medium based on inter-metric and time dimension selection.

[0007] To achieve the above object, the present invention is implemented through the following technical solutions:

[0008] A KPI data dimensionality reduction method based on inter-metric and time dimension selection includes the following steps:

[0009] S1. Collect time series data of key performance indicators to form a multidimensional KPI data set;

[0010] S2. Perform low variance filtering on the multidimensional KPI data set obtained in step S1 to obtain a preprocessed multidimensional KPI data set;

[0011] S3. Perform inter-metric dimension selection processing on the pre-processed multi-dimensional KPI data set obtained in step S2, including compressing the KPI sequence using time series encoding, and then using mean shift clustering to retain the correlation dimension, to obtain a multi-dimensional KPI data set with inter-metric dimension selection;

[0012] S4. Performing time dimension selection processing on the preprocessed multidimensional KPI data set obtained in step S2, including using 3-sigma to mark the outliers of the KPI data of each dimension, and then using sample entropy to select the dimension whose outliers conform to the real abnormal distribution, to obtain the multidimensional KPI data set selected in the time dimension;

[0013] S5. Take the union of the multidimensional KPI data set selected by the inter-metric dimension obtained in step S3 and the multidimensional KPI data set selected by the time dimension obtained in step S4 to obtain a KPI data dimensionality reduction data set based on the inter-metric and time dimension selection.

[0014] Furthermore, the multidimensional KPI data set obtained in step S1 is a time series X'=[X1, X2, ..., X i’ ,…,X M’ ], where X i’ ∈R N×1 is the i'th time series of length N.

[0015] Furthermore, step S2 converts X i’ Calculate the variance D(X) for each dimension i’ ), then remove D(X i’ )>threshold dimension, where threshold is the set threshold, and the preprocessed multidimensional KPI data set X=[X1,X2,…X i,…X M ], where M is the dimension after dimensionality reduction through low variance filtering, X i ∈R N×1 is the i-th time series of length N after dimensionality reduction through low variance filtering.

[0016] Furthermore, the threshold is set to 0 in step S2.

[0017] Furthermore, the specific implementation method of step S3 includes the following steps:

[0018] S3.1. Use time series coding to compress the KPI sequence: Based on the segmented aggregation approximation algorithm PAA, set the segmentation window, and then perform compression operations on the segmentation window. Use the average aggregation function to compress and obtain the KPI sequence compressed by time series coding. The calculation expression of the average aggregation function is:

[0019]

[0020] Among them, q i is the time point after compression, x j is the time series corresponding to the jth timestamp, and S is the compression ratio;

[0021] Get the sequence q1,q2,...,q compressed to length w w , w = (N / S + 1);

[0022] S3.2. The KPI sequence obtained in step S3.1 after time series encoding and compression is clustered using mean shift to retain the correlation dimension. The specific implementation method of mean shift clustering includes the following steps:

[0023] S3.2.1. Select an initial window size h and initial data points X;

[0024] S3.2.2. For a data point X, calculate the density center C of the data points in the neighborhood with a window size of h and centered on X. The calculation expression is:

[0025]

[0026] Among them, K is the kernel function, usually using the Gaussian kernel function;

[0027] S3.2.3. Move the data point X to the density center C. The expression is:

[0028] X→C (3)

[0029] S3.2.4. Repeat steps S3.2.2 and S3.2.3 until the upper limit of the number of iterations is reached, or stop when the movement of the data point is less than the set threshold;

[0030] S3.2.5. Using the method of steps S3.2.1-S3.2.4, the input of mean shift clustering is the KPI sequence after time series encoding and compression, and the output is the cluster label of each dimension. After mean shift clustering, a total of k clusters are obtained. The number of dimensions contained in all clusters is expressed as [M 1 ,M 2 ,...M k ], the output shape is M1×N KPI matrix, where M1 is the total dimension of all selected classes, and the expression of the multidimensional KPI data set for inter-metric dimension selection is:

[0031]

[0032] Among them, M j The number of dimensions contained in each cluster, f(M j ) means select M j Clusters greater than 1.

[0033] Furthermore, the specific implementation method of step S4 includes the following steps:

[0034] S4.1. Perform time dimension selection processing on the preprocessed multidimensional KPI data set obtained in step S2, and use 3-sigma to mark the outliers of the KPI data in each dimension. The calculation expression of the 3-sigma threshold is:

[0035] uper=mean+3*std (6)

[0036] lower=mean-3*std (7)

[0037] Among them, upper and lower are the upper threshold and lower threshold respectively, mean is the mean value of all time points, and std is the standard deviation of all time points;

[0038] The points exceeding the threshold range in the preprocessed multidimensional KPI data set obtained in step S2 are marked as outliers, and a label matrix of shape M×N is obtained, where outliers are marked as 1 and normal points are marked as zero, and a label list is obtained;

[0039] S4.2. Use sample entropy to calculate the label list obtained in step S4.1. After calculating the sample entropy of all label lists, use the box-plot method to set the threshold, and then select the KPI sequence whose sample entropy is less than the threshold as the multidimensional KPI data set selected in the time dimension. The specific implementation method includes the following steps:

[0040] S4.2.1. For the i-th time series in the preprocessed multidimensional KPI data set obtained in step S2, define a pattern with the i-th time series length m The expression is:

[0041]

[0042] S4.2.2. For the result obtained in step S4.2.1 Calculate the distances between the pattern of the i-th time series length m and all other patterns The calculation expression is:

[0043]

[0044] Among them, Θ is the Heaviside function, ||·|| is the norm, and ρ is the distance threshold;

[0045] S4.2.3. Definitions is the average distance of a pattern of length m, and the calculation expression is:

[0046]

[0047] S4.2.4. According to the definition of sample entropy, the calculation expression of sample entropy SampleEn(m,ρ) is obtained as follows:

[0048]

[0049] S4.2.5. After calculating the sample entropy of all label lists according to step S4.2.4, select M2 dimensions whose sample entropy is lower than th to obtain a multidimensional KPI data set selected in the time dimension. The calculation expression is:

[0050]

[0051] Among them, M2 is the dimension selected to obtain the time dimension, SampleEn(X j ) is the sample entropy of the g-th dimension, f(X g ) is the dimension where the sample entropy is lower than th, and th is the threshold determined by Box-plot;

[0052] The dimension of the multidimensional KPI data set finally obtained by selecting the time dimension is M2×N.

[0053] Furthermore, step S5 takes the union of the multidimensional KPI data set selected by the inter-metric dimension obtained in step S3 and the multidimensional KPI data set selected by the time dimension obtained in step S4, and finally obtains a KPI dimension of M3×N.

[0054] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a KPI data dimensionality reduction method based on inter-metric and time dimension selection are implemented.

[0055] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements a KPI data dimensionality reduction method based on inter-metric and time dimension selection.

[0056] Beneficial effects of the present invention:

[0057] The KPI data dimensionality reduction method based on inter-metric and temporal dimension selection described in the present invention is called the inter-metric and temporal dimensionality reduction framework ITRMD (Inter-metric and Temporal dimensionality Reduction framework for MAD), which is a feature selection framework consisting of inter-metric dimension selection and temporal dimension selection. For the inter-metric dimension, a dimension with high correlation is selected to retain the inter-metric anomaly information between the dimensions. For the temporal dimension, a dimension with an outlier pattern that conforms to the real anomaly pattern is selected to reduce the occurrence of false positive results.

[0058] The KPI data dimensionality reduction method based on inter-metric and time dimension selection described in the present invention targets KPI data rather than ordinary time series. Compared with the commonly used dimensionality reduction methods for time series, it can effectively improve the accuracy of anomaly detection and greatly shorten the training time of the multi-dimensional KPI anomaly detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A flowchart of a KPI data dimensionality reduction method based on inter-metric and time dimension selection according to the present invention;

[0060] Figure 2 A schematic diagram of a framework of a KPI data dimensionality reduction method based on inter-metric and time dimension selection according to the present invention;

[0061] Figure 3 The 38-dimensional SMD data set of the present invention is low-variance filtered, and the histogram with a dimension of 0 variance is removed;

[0062] Figure 4 It is the abnormal curve between metrics in the multi-dimensional KPI of the present invention;

[0063] Figure 5 This is a sample diagram of the present invention using PAA to compress and encode a window length of 60.

[0064] Figure 6 The present invention uses the result of mean shift clustering, class1 represents the first cluster, class2 represents the second cluster, class3 represents the third cluster, and class4 represents the fourth cluster;

[0065] Figure 7 Examples of valid information and invalid information sequences defined in the present invention, where (a) is a valid information sequence and (b) is an invalid information sequence;

[0066] Figure 8 This is an example of a label matrix obtained using 3-sigma in the present invention, where (a) is the original time series and (b) is the label time series;

[0067] Fig. 9 It is a 38-dimensional sample entropy histogram from the SMD data set of the present invention;

[0068] Fig.10 A comparison chart of dimensionality reduction time of a KPI data dimensionality reduction method based on inter-metric and time dimension selection on different data sets according to the present invention;

[0069] Fig.11 This is a schematic diagram of the KPI data dimensionality reduction method after dimensionality reduction based on inter-metric and time dimension selection described in the present invention. DETAILED DESCRIPTION

[0070] In order to make the purpose, technical solution and advantages of the present invention more clear, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the specific embodiments described are only part of the embodiments of the present invention, rather than all of the specific embodiments. The components of the specific embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations, and the present invention can also have other embodiments.

[0071] Therefore, the following detailed description of the specific embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents the selected specific embodiments of the present invention. Based on the specific embodiments of the present invention, all other specific embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0072] In order to further understand the content, features and effects of the present invention, the following specific implementation methods are given as examples, and the attached Figure 1 -Attached Fig.11 The detailed instructions are as follows: Specific implementation method one:

[0074] A KPI data dimensionality reduction method based on inter-metric and time dimension selection includes the following steps:

[0075] S1. Collect time series data of key performance indicators to form a multidimensional KPI data set;

[0076] Furthermore, the multidimensional KPI data set obtained in step S1 is a time series X'=[X1, X2, ..., X i’ ,…,X M’ ], where X i’ ∈R N×1 is the i'th time series of length N;

[0077] S2. Perform low variance filtering on the multidimensional KPI data set obtained in step S1 to obtain a preprocessed multidimensional KPI data set;

[0078] In the KPI dataset, since some KPIs reflect fixed features of services and machines and will not change for a long time, they may appear as some dimensions with low variance. These dimensions contain almost no valuable information, but they greatly increase the training time. Therefore, it is necessary to remove the KPI dimensions with low variance in the preprocessing stage;

[0079] Furthermore, step S2 converts X i’ Calculate the variance D(X) for each dimension i’ ), then remove D(X i’ )>threshold dimension, where threshold is the set threshold, and the preprocessed multidimensional KPI data set X=[X1,X2,…X i ,…X M ], where M is the dimension after dimensionality reduction through low variance filtering, X i ∈R N×1 is the i-th time series of length N after dimensionality reduction through low variance filtering;

[0080] Further, in step S2, the threshold is set to 0;

[0081] Furthermore, taking the SMD dataset as an example, we calculated the variance of 38 dimensions in the SMD dataset. The results are as follows Figure 3 As shown, the dimensions with a variance of 0 are deleted, including dimensions 4, 7, 16, 17, 36, and 37. In this embodiment, ITRMD removes 6 KPI dimensions based on the variance threshold.

[0082] S3. Perform inter-metric dimension selection processing on the pre-processed multi-dimensional KPI data set obtained in step S2, including compressing the KPI sequence using time series encoding, and then using mean shift clustering to retain the correlation dimension, to obtain a multi-dimensional KPI data set with inter-metric dimension selection;

[0083] Anomalies between metrics are closely related to the correlation between dimensions. The KPIs generated by services are interrelated, resulting in linear or nonlinear correlations between the generated KPIs. If a KPI violates this correlation, it will be detected as an anomaly. Multidimensional KPI anomaly detection methods should capture the relationship between metrics and determine abnormal KPI states. Figure 4 Several KPI dimensions with high correlation are shown. All series are positively correlated, but the pattern marked by the yellow circle suddenly changes the correlation (such as positive to negative correlation) and should be marked as anomaly. Unlike many dimensionality reduction methods that treat similar features as redundant dimensions, KPI dimensions with higher correlation contain more valuable information due to the relationship between the measures. In order to measure the correlation between dimensions, many existing dimensionality reduction methods calculate the mutual information between pairs of original data dimensions, and high dimensions will lead to an increase in computational complexity. Therefore, clustering algorithms are used as an alternative to aggregate highly correlated dimensions. Among all clustering methods, Mean-Shift clustering is used because it has a lower computational complexity and does not require the number of clusters to be specified before running. Directly using clustering algorithms on long KPI sequences leads to poor clustering results and increased computational complexity, so time series encoding is used to compress the time series;

[0084] Furthermore, the specific implementation method of step S3 includes the following steps:

[0085] S3.1. Use time series coding to compress the KPI sequence: Based on the segmented aggregation approximation algorithm PAA, set the segmentation window, and then perform compression operations on the segmentation window. Use the average aggregation function to compress and obtain the KPI sequence compressed by time series coding. The calculation expression of the average aggregation function is:

[0086]

[0087] Among them, q i is the time point after compression, x j is the time series corresponding to the jth timestamp, and S is the compression ratio;

[0088] Get the sequence q1,q2,...,q compressed to length w w , w = (N / S + 1);

[0089] Furthermore, time series encoding preprocesses the data by extracting features, removing noise from the data while retaining the main features of the data. It generates a new sequence from the original sequence to represent the features of the original sequence, such as Figure 5 As shown, Figure 5The example of using PAA to compress one dimension of the SMD dataset is shown. The compression is performed in units of hours, with a window length of 60. The original time series of 28479 length is compressed to 475 length.

[0090] S3.2. The KPI sequence obtained in step S3.1 after time series encoding and compression is clustered using mean shift to retain the correlation dimension. The specific implementation method of mean shift clustering includes the following steps:

[0091] S3.2.1. Select an initial window size h and initial data points X;

[0092] S3.2.2. For a data point X, calculate the density center C of the data points in the neighborhood with a window size of h and centered on X. The calculation expression is:

[0093]

[0094] Among them, K is the kernel function, usually using the Gaussian kernel function;

[0095] S3.2.3. Move the data point X to the density center C. The expression is:

[0096] X→C (3)

[0097] S3.2.4. Repeat steps S3.2.2 and S3.2.3 until the upper limit of the number of iterations is reached, or stop when the movement of the data point is less than the set threshold;

[0098] S3.2.5. Using the method of steps S3.2.1-S3.2.4, the input of mean shift clustering is the KPI sequence after time series encoding and compression, and the output is the cluster label of each dimension. After mean shift clustering, a total of k clusters are obtained. The number of dimensions contained in all clusters is expressed as [M 1 ,M 2 ,...M k ], the output shape is M1×N KPI matrix, where M1 is the total dimension of all selected classes, and the expression of the multidimensional KPI data set for inter-metric dimension selection is:

[0099]

[0100] Among them, M j The number of dimensions contained in each cluster, f(M j ) means select M j Clusters greater than 1.

[0101] Furthermore, the Mean-Shift algorithm can find the maximum density of data points to determine the cluster center. Since it is a density-based clustering method, it can handle nonlinearly distributed data and does not require the number of clusters to be specified in advance. Figure 6 An example of clustering using mean-shift is shown. Clusters with dimensions greater than 1 will be selected, and the final M1 is obtained by merging all selected clusters. Clusters 1 and 2 have more than 1 dimension and are selected.

[0102] S4. Performing time dimension selection processing on the preprocessed multidimensional KPI data set obtained in step S2, including using 3-sigma to mark the outliers of the KPI data of each dimension, and then using sample entropy to select the dimension whose outliers conform to the real abnormal distribution, to obtain the multidimensional KPI data set selected in the time dimension;

[0103] For temporal KPI anomalies, an outlier means a sudden change in the pattern after a series of normal values, usually in the form of an outlier. Anomalies are caused by a variety of reasons, such as software errors or equipment failures. The KPI data generated by actual services contains both normal values ​​and outliers, and detecting outliers is the ultimate goal. Multidimensional KPI anomaly detection algorithms rely on training sets to construct normal patterns to detect anomalies that deviate from the normal pattern in the test set. Deviations from the normal pattern are usually represented in the form of outliers. Outliers are defined as those points that deviate from the values ​​of the surrounding points, and can usually be detected using some outlier detection methods, such as 3-sigma detection. Almost all KPI anomaly detection algorithms tend to identify outliers as anomalies, while not all outliers are true anomalies. Therefore, if there are too many non-abnormal outliers in a time series dimension, a large number of false positives will be generated, affecting the detection results. In actual situations, the occurrence of KPI anomalies is a low-probability event. When an anomaly occurs, the service KPI usually manifests as a sudden pattern change after a continuous normal pattern (normal service operation), and the abnormal pattern (abnormal occurrence) returns to the normal pattern after a short duration, resulting in most anomalies being concentrated in a short period of time. Therefore, the dimension with fewer and more concentrated outliers should be selected in feature filtering because it fits the pattern of anomaly occurrence. Figure 7 Some KPI dimensions are shown. The red line is the timestamp when the real anomaly occurred. Figure 7 (b) The existence of such a dimension does not improve the accuracy of detection, but only increases the training time of the model, resulting in a large number of false positives. First, 3-sigma detection is used to select outliers from the KPI series. The number and distribution of outliers can be determined by entropy, which is usually used to measure the complexity of time series. When there are too many outliers and they are more dispersed, the complexity of the corresponding series will also increase. Here, sample entropy is used on the label list obtained from 3-sigma.

[0104] Furthermore, the specific implementation method of step S4 includes the following steps:

[0105] S4.1. Perform time dimension selection processing on the preprocessed multidimensional KPI data set obtained in step S2, and use 3-sigma to mark the outliers of the KPI data in each dimension. The calculation expression of the 3-sigma threshold is:

[0106] upper=mean+3*std (6)

[0107] lower=mean-3*std (7)

[0108] Among them, upper and lower are the upper threshold and lower threshold respectively, mean is the mean value of all time points, and std is the standard deviation of all time points;

[0109] The points exceeding the threshold range in the preprocessed multidimensional KPI data set obtained in step S2 will be marked as outliers, and a label matrix of shape M×N is obtained, in which outliers are marked as 1 and normal points are marked as zero, and a label list is obtained; Figure 8 As shown in the figure, a sample of the label matrix is ​​obtained using 3-sigma. If the KPI value exceeds the threshold, the label is set to 1, otherwise it is 0.

[0110] S4.2. Use sample entropy to calculate the label list obtained in step S4.1. After calculating the sample entropy of all label lists, use the box-plot method to set the threshold, and then select the KPI sequence whose sample entropy is less than the threshold as the multidimensional KPI data set selected in the time dimension. The specific implementation method includes the following steps:

[0111] S4.2.1. For the i-th time series in the preprocessed multidimensional KPI data set obtained in step S2, define a pattern with the i-th time series length m The expression is:

[0112]

[0113] S4.2.2. For the result obtained in step S4.2.1 Calculate the distances between the pattern of the i-th time series length m and all other patterns The calculation expression is:

[0114]

[0115] Among them, Θ is the Heaviside function, ||·|| is the norm, and ρ is the distance threshold;

[0116] S4.2.3. Definitions is the average distance of a pattern of length m, and the calculation expression is:

[0117]

[0118] S4.2.4. According to the definition of sample entropy, the calculation expression of sample entropy SampleEn(m,ρ) is obtained as follows:

[0119]

[0120] S4.2.5. After calculating the sample entropy of all label lists according to step S4.2.4, select M2 dimensions whose sample entropy is lower than th to obtain a multidimensional KPI data set selected in the time dimension. The calculation expression is:

[0121]

[0122] Among them, M2 is the dimension selected to obtain the time dimension, SampleEn(X j ) is the sample entropy of the g-th dimension, f(X g ) is the dimension where the sample entropy is lower than th, and th is the threshold determined by Box-plot;

[0123] The dimension of the multidimensional KPI data set finally obtained by selecting the time dimension is M2×N;

[0124] Fig. 9 An example of sample entropy of a data label list from a machine in the SMD dataset is shown. As can be seen from the figure, the sample entropy of dimensions 10, 11, and 15 is higher than the threshold, so these three dimensions will be filtered out.

[0125] S5. Take the union of the multidimensional KPI data set selected from the inter-metric dimension obtained in step S3 and the multidimensional KPI data set selected from the time dimension obtained in step S4 to obtain a KPI data dimensionality reduction data set based on the inter-metric and time dimension selections;

[0126] Further, step S5 takes the union of the multidimensional KPI data set selected by the inter-metric dimension obtained in step S3 and the multidimensional KPI data set selected by the time dimension obtained in step S4, and finally obtains a KPI dimension of M3×N;

[0127] Furthermore, since the two sets may contain repeated dimensions, the final M3 is less than or equal to M1+M2.

[0128] Since the two sets may contain repeated dimensions, the final M3 is less than or equal to M1+M2.

[0129] The method of this embodiment is verified by comparing the method of this embodiment ITRMD with several other data dimensionality reduction method models on a multidimensional KPI sequence data set. The comparison method is to compare the improvement of the F1-score of the same multidimensional KPI anomaly detection model after using different dimensionality reduction methods. In addition, the difference in training time caused by using the data set after using the ITRMD dimensionality reduction method and directly using the original data set is compared.

[0130] 1. Improved accuracy of multi-dimensional KPI anomaly detection:

[0131] The improvement of anomaly detection accuracy by ITRMD is evaluated by comparing it with three time series dimensionality reduction methods and the original sequence without dimensionality reduction using the multidimensional KPI anomaly detection method. Comparative experiments are designed on five open source datasets and five multidimensional KPI anomaly detection models. The datasets include:

[0132] (1) SMD dataset: A 38-dimensional dataset generated by 28 machines with a monitoring period of 5 weeks. The training set and test set are divided into 1:1, the training set is unlabeled and the test set is labeled.

[0133] (2) SMAP and MSL datasets: SMAP and MSL represent separate datasets generated by telemetry streams from two different spacecraft. SMAP contains 25 dimensions generated by 55 entities. MSL contains 55 dimensions, monitoring 27 entities. Both SMAP and MSL are divided into training and test sets, the training set is unlabeled, and the test set is labeled.

[0134] (3) AIOPs dataset: It comes from the 2022 International AIOPs Challenge. The data is real-time data generated by different nodes every day. We selected data generated on two consecutive days, 2022-3-21 and 2022-3-22, with the former day as the training set and the latter day as the test set.

[0135] (4) SWAT dataset: It is a 51-dimensional feature generated by 51 sensors and actuators, and each timestamp is labeled as normal or abnormal.

[0136] The multi-dimensional KPI anomaly detection model includes:

[0137] (1) LSTM-NDT: This is a prediction-based model that uses LSTM to predict the values ​​of each dimension of the KPI and uses the difference between the predicted value and the true value to determine anomalies.

[0138] (2) GGIAnomaly: This is a prediction model that combines Informer, GAT, and GRU. It uses the difference between the predicted value and the true value to determine the anomaly.

[0139] (3) OmniAnomaly: This is a reconstruction-based model that reconstructs the original input through a variational autoencoder (VAE) and captures the normal model of multi-dimensional KPIs. Finally, the reconstruction probability is used to determine anomalies.

[0140] (4) MAD-GAN: It models the correlation between multi-dimensional KPIs and uses a generative adversarial network (GAN) to determine anomalies.

[0141] (5) USAD: It is an unsupervised anomaly detection method based on an adversarial training autoencoder. Its encoder-decoder structure enables it to learn how to amplify the reconstruction error of anomalous inputs.

[0142] Data dimensionality reduction methods include:

[0143] (1) PCA: PCA (Principal Component Analysis) uses orthogonal transformation to convert linearly correlated observed data into a small amount of independent data. The idea of principal component analysis is to map n-dimensional features to k dimensions (k < n), which is a new type of orthogonal feature. These k-dimensional features are called principal components.

[0144] (2) SPEC: SPEC is a spectrogram-based feature selection framework. This framework constructs a similarity matrix for the data and derives the existence of the spectrogram based on it. According to the spectrogram, the divergence between the feature vector and the original data can be calculated to select features that can better classify the original data.

[0145] (3) SVD-Entropy: SVD-Entropy measures the entropy of the original data matrix through singular values, evaluates the contribution of each feature to the entropy, and sorts the features according to their respective entropy values.

[0146] The F1-score (F1) is used to judge the accuracy of anomaly detection. Let the true label at time t be l t , and the predicted label be l t and (such as [0, 1, 0...]) both contain 0 and 1 (1 indicates an anomaly point). The calculation formulas for P, R, and F1 are shown in Equations 14, 15, and 16:

[0147]

[0148] Among them, TP is the correctly detected anomaly (the predicted label is 1 and the true label lt is 1), FP is the falsely detected anomaly (the predicted label is 1 and the true label lt is 0), TN is the correctly assigned normal (the predicted label is 0 and the true label lt is 0), and FN is the falsely assigned normal (the predicted label is 0, and the true label lt is 1).

[0149] Table 1 shows the detection results of the original dataset and the dataset after dimensionality reduction using the ITRMD, PCA, SPEC and SVD-Entropy methods under different models and datasets. The F1-score is used for measurement. The values ​​in brackets represent the percentage increase in the F1-score, and those marked in red represent a decrease. The values ​​in brackets in the first column represent the total improvement in the F1-score after using the dimensionality reduction method compared to the original dataset.

[0150] Table 1 Comparison of dimensionality reduction methods for improving the accuracy of multi-dimensional KPI anomaly detection

[0151]

[0152]

[0153] 2. Improved training efficiency of multi-dimensional KPI anomaly detection

[0154] Since KPI anomaly detection emphasizes real-time detection, the efficiency of detection is crucial when dealing with a large number of complex KPIs. In order to verify the superiority of ITRMD in detection efficiency, the training time of ITRMD was compared with the original KPI dataset without dimensionality reduction. The time is expressed as the sum of dimensionality reduction time and training time. Taking OmniAnomaly as an example, the time spent on training 10 epochs on five datasets was calculated. Both methods were trained using NVIDIA GeForce RTX 2060. The results are shown in Table 2, which is a comparison table of the improvement of training efficiency of multi-dimensional KPI anomaly detection by dimensionality reduction methods. It can be seen from Table 2 that ITRMD outperforms the original dataset and all other dimensionality reduction methods in multi-dimensional KPI anomaly detection, and the F1-score increased by 4.534. There are two percentage decreases in ITRMD, which shows that ITRMD is robust to different datasets and models. As can be seen from the last column of the table, the ITRMD method has the greatest improvement in the detection performance of the AIOPS dataset, with the F1-Score exceeding the original data by up to 366%. It can be seen from the table that the ITRMD method did not significantly improve the detection results on the SMAP and MSL datasets (the F1-score of the SMAP dataset decreased slightly when OmniAnomaly and LSTM-NDT were used). PCA failed to improve the detection performance in most cases. On the SMAP dataset, the use of PCA resulted in significantly lower detection performance than the original sequence (F1-score decreased by up to 25%). Using SPEC on MSL and SMAP can improve the detection performance, while SPEC has little improvement on the other three datasets. The SVD-Entropy method performed poorly on most datasets (F1-score decreased by 37% compared to the original data), while the detection performance on the AIOPS dataset was significantly improved (F1-score increased by 497% compared to the original data). The numbers before and after the arrows in brackets represent the original dimension and the dimension after dimensionality reduction, respectively. It can be seen from the table that training with the ITRMD reduced dimensionality dataset can significantly shorten the training time, especially for high-dimensional datasets. For the AIOPS and MSL datasets, ITRMD removes more than three-quarters of the redundant dimensions from the datasets (from 55 to 12 for MSL and from 330 to 60 for AIOPS), which greatly improves the detection efficiency.

[0155] Table 2 Comparison of dimensionality reduction methods on the improvement of multi-dimensional KPI anomaly detection training efficiency

[0156]

[0157]

[0158] Fig.10The time taken by the dimensionality reduction framework ITRMD is shown. The two components that constitute the largest time cost in ITRMD are mean shift and sample entropy, neither of which exceeds the order of 100 seconds. Using ITRMD on the SMD dataset, the total time of the four components is 102.86 seconds, which takes the most time. It can be seen that the time spent by the dimensionality reduction method is negligible compared to the detection model using complex neural networks. Therefore, it is very effective to use the ITRMD framework to speed up the training time.

[0159] 3. Results Analysis

[0160] Principal component analysis (PCA) is a commonly used dimensionality reduction method in data analysis. It projects high-dimensional data into a low-dimensional space. As can be seen from Table 2-1, PCA is not very effective in improving the accuracy of anomaly detection. PCA does not delete dimensions in the original sequence, but regenerates the specified K new dimensions from the original sequence. The newly generated dimensions are linear combinations of the original dimensions. Although the newly generated dimensions try to retain the information of the original dimensions as much as possible, it still loses some of the characteristics of the original dimensions. In addition, PCA reduces the correlation between dimensions while reducing the dimensions, resulting in the loss of information between metrics.

[0161] The idea of ​​SPEC is to select the most useful features for sample classification. From the experiments, we can see that SPEC is not ideal for most datasets. This is due to the imbalance between normal and abnormal samples in KPI anomaly detection, where the number of normal data is much larger than the number of abnormal data. This unbalanced sample greatly increases the randomness and uncertainty of SPEC selection. In MSL and SMAP, SPEC achieved better results due to the large number of outliers.

[0162] SVD-Entropy measures the entropy of the original matrix through singular value decomposition and evaluates the contribution of each feature to the entropy. In this process, KPI series with less information content and close to white noise will be excluded. As can be seen from the table, directly using SVD-Entropy to measure the amount of information in the original time series does not achieve good results. The calculation of information entropy is very sensitive and will be affected by a large number of small fluctuations in the time series. SVD-Entropy performs better on the AIOPs dataset because the AIOPs dataset is a large 330-dimensional dataset with a large amount of noise and redundant dimensions that can be removed.

[0163] ITRMD is a dimensionality reduction method that considers both inter-metric and temporal features. Compared with feature extraction methods for dimensionality reduction such as PCA, ITRMD selects highly correlated features through clustering, thereby retaining information between metrics. The idea of ​​SPEC is to select the most useful features for sample classification. Due to the imbalance between positive and negative samples in KPI anomaly detection, ITRMD is more applicable to most data sets than SPEC. Compared with SVD-Entropy, ITRMD uses the information entropy of outliers instead of the information entropy of the original sequence to avoid interference from small fluctuations.

[0164] As can be seen from Table 1, ITRMD significantly improves the detection accuracy on the AIOPs dataset. The AIOPs dataset contains a large number of dimensions. Most of these dimensions should be considered redundant dimensions and may lead to false positives. ITRMD uses temporal dimension selection to remove these dimensions. ITRMD performs better than any other dimensionality reduction method on the SMD and SWAT datasets. This is because, in both datasets, many dimensions are closely related and highly correlated. ITRMD can well preserve these features through inter-metric dimensionality selection.

[0165] ITRMD does not significantly improve the detection performance of the MSL and SMAP datasets. Some dimensions in these two datasets have the following characteristics: KPIs exhibit periodic signals, and the values ​​of each period deviate significantly from the surrounding values, making them easily identified as outliers, so these dimensions are removed by ITRMD. The real anomalies occur during the period when the periodic pattern changes. Using the ITRMD dimensionality reduction method will lose this information. Fig.11 Shown is a dimension reduced by ITRMD in MSL. This is a sequence with periodic zero and one signal transitions, where the region marked with a red circle should be considered an anomaly due to a sudden increase in signal density. Specific implementation method 2:

[0167] An electronic device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of a KPI data dimensionality reduction method based on inter-metric and time dimension selection described in a specific implementation method 1 are implemented.

[0168] The computer device of the present invention may be a device including a processor and a memory, such as a single chip microcomputer including a central processing unit, etc. Moreover, the processor is used to implement the steps of the above-mentioned KPI data dimensionality reduction method based on inter-metric and time dimension selection when executing the computer program stored in the memory.

[0169] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), off-the-shelf programmable gate arrays (FPGAs), or a processor.

[0170] Field-Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0171] The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Specific implementation method three:

[0173] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, a KPI data dimensionality reduction method based on inter-metric and time dimension selection as described in a specific implementation mode 1 is implemented.

[0174] The computer-readable storage medium of the present invention can be any form of storage medium that can be read by a processor of a computer device, including but not limited to non-volatile memory, volatile memory, ferroelectric memory, etc. The computer-readable storage medium stores a computer program. When the processor of the computer device reads and executes the computer program stored in the memory, the steps of the above-mentioned KPI data dimensionality reduction method based on inter-metric and time dimension selection can be implemented.

[0175] The computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form, etc. The computer readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer readable media do not include electric carrier signals and telecommunication signals.

[0176] The key technical points and the points to be protected of the present invention are:

[0177] In the present invention, we propose a new dimensionality reduction method ITRMD for multi-dimensional KPI data, which mainly starts from two aspects: inter-metric dimension selection and time dimension selection. The inter-metric dimension selection includes time series encoding and Mean-shift clustering. The accelerated clustering method is used to select dimensions with high correlation, which reflects the close connection between different KPIs generated in actual services. The time dimension selection includes 3-sigma detection and sample entropy judgment. Outliers are detected by 3-sigma and sample entropy is used to determine whether the outliers conform to a relatively small and relatively concentrated distribution pattern, so as to retain the dimensions whose outlier distribution conforms to the real abnormal distribution to the maximum extent and reduce the occurrence of false positives.

[0178] Experiments on different datasets and anomaly detection models show that ITRMD, as a dimensionality reduction method for KPI data, achieves better results than other general time series dimensionality reduction methods in improving the accuracy of multi-dimensional KPI anomaly detection. Through ablation experiments on inter-metric dimension selection and time dimension selection, we verify the impact of each component of ITRMD on KPI anomaly detection. In addition, the comparison of training time on different datasets shows that ITRMD can significantly improve the training efficiency of anomaly detection deep learning models.

[0179] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0180] Although the present application has been described above with reference to specific embodiments, various modifications may be made thereto and parts thereof may be replaced with equivalents without departing from the scope of the present application. In particular, as long as there is no structural conflict, the various features in the specific embodiments disclosed in the present application may be used in combination with each other in any manner, and the fact that these combinations are not exhaustively described in this specification is only for the sake of omitting space and saving resources. Therefore, the present application is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A KPI data dimensionality reduction method based on inter-metric and time dimension selection, characterized in that: The steps include: S1. Collect time series data of key performance indicators to form a multidimensional KPI data set; S2. Perform low variance filtering on the multidimensional KPI data set obtained in step S1 to obtain a preprocessed multidimensional KPI data set; S3. Perform inter-metric dimension selection processing on the pre-processed multi-dimensional KPI data set obtained in step S2, including compressing the KPI sequence using time series encoding, and then using mean shift clustering to retain the correlation dimension, to obtain a multi-dimensional KPI data set with inter-metric dimension selection; The specific implementation method of step S3 includes the following steps: S3.

1. Use time series coding to compress the KPI sequence: Based on the segmented aggregation approximation algorithm PAA, set the segmentation window, and then perform compression operations on the segmentation window. Use the average aggregation function to compress and obtain the KPI sequence compressed by time series coding. The calculation expression of the average aggregation function is: Among them, q i is the time point after compression, x j is the time series corresponding to the jth timestamp, and S is the compression ratio; Get the sequence q1,q2,...,q compressed to length w w , w = (N / S + 1); S3.

2. The KPI sequence obtained in step S3.1 after time series encoding and compression is clustered using mean shift to retain the correlation dimension. The specific implementation method of mean shift clustering includes the following steps: S3.2.

1. Select an initial window size h and initial data points X; S3.2.

2. For a data point X, calculate the density center C of the data points in the neighborhood with a window size of h and centered on X. The calculation expression is: Among them, K is the kernel function, usually using the Gaussian kernel function; S3.2.

3. Move the data point X to the density center C. The expression is: X→C (3) S3.2.

4. Repeat steps S3.2.2 and S3.2.3 until the upper limit of the number of iterations is reached, or stop when the movement of the data point is less than the set threshold; S3.2.

5. Using the method of steps S3.2.1-S3.2.4, the input of mean shift clustering is the KPI sequence after time series encoding and compression, and the output is the cluster label of each dimension. After mean shift clustering, a total of k clusters are obtained. The number of dimensions contained in all clusters is expressed as [M 1 ,M 2 ,...M k ], the output shape is M1×N KPI matrix, where M1 is the total dimension of all selected classes, and the expression of the multidimensional KPI data set for inter-metric dimension selection is: Among them, M j The number of dimensions contained in each cluster, f(M j ) means select M j Clusters greater than 1; S4. Performing time dimension selection processing on the preprocessed multidimensional KPI data set obtained in step S2, including using 3-sigma to mark the outliers of the KPI data of each dimension, and then using sample entropy to select the dimension whose outliers conform to the real abnormal distribution, to obtain the multidimensional KPI data set selected in the time dimension; S5. Take the union of the multidimensional KPI data set selected by the inter-metric dimension obtained in step S3 and the multidimensional KPI data set selected by the time dimension obtained in step S4 to obtain a KPI data dimensionality reduction data set based on the inter-metric and time dimension selection.

2. A KPI data dimensionality reduction method based on inter-metric and time dimension selection according to claim 1, characterized in that: The multidimensional KPI data set obtained in step S1 is the time series of the key performance indicators of the M' dimension X' = [X1, X2, ..., X i’ ,…,X M’ ], where X i’ ∈R N×1 is the i'th time series of length N.

3. A KPI data dimensionality reduction method based on inter-metric and time dimension selection according to claim 2, characterized in that: Step S2: X i’ Calculate the variance D(X) for each dimension i’ ), then remove D(X i’ )>threshold dimension, where threshold is the set threshold, and the preprocessed multidimensional KPI data set X=[X1,X2,…X i ,…X M ], where M is the dimension after dimensionality reduction through low variance filtering, X i ∈R N×1 is the i-th time series of length N after dimensionality reduction through low variance filtering.

4. A KPI data dimensionality reduction method based on inter-metric and time dimension selection according to claim 3, characterized in that: In step S2, the threshold is set to 0.

5. A KPI data dimensionality reduction method based on inter-metric and time dimension selection according to claim 4, characterized in that: The specific implementation method of step S4 includes the following steps: S4.

1. Perform time dimension selection processing on the preprocessed multidimensional KPI data set obtained in step S2, and use 3-sigma to mark the outliers of the KPI data in each dimension. The calculation expression of the 3-sigma threshold is: upper=mean+3*std (6) lower=mean-3*std (7) Among them, upper and lower are the upper threshold and lower threshold respectively, mean is the mean value of all time points, and std is the standard deviation of all time points; The points exceeding the threshold range in the preprocessed multidimensional KPI data set obtained in step S2 are marked as outliers, and a label matrix of shape M×N is obtained, where outliers are marked as 1 and normal points are marked as zero, and a label list is obtained; S4.

2. Use sample entropy to calculate the label list obtained in step S4.

1. After calculating the sample entropy of all label lists, use the box-plot method to set the threshold, and then select the KPI sequence whose sample entropy is less than the threshold as the multidimensional KPI data set selected in the time dimension. The specific implementation method includes the following steps: S4.2.

1. For the i-th time series in the preprocessed multidimensional KPI data set obtained in step S2, define a pattern with the i-th time series length m The expression is: S4.2.

2. For the result obtained in step S4.2.1 Calculate the distances between the pattern of the i-th time series length m and all other patterns The calculation expression is: Among them, Θ is the Heaviside function, ||·|| is the norm, and ρ is the distance threshold; S4.2.

3. Definitions is the average distance of a pattern of length m, and the calculation expression is: S4.2.

4. According to the definition of sample entropy, the calculation expression of sample entropy SampleEn(m,ρ) is obtained as follows: S4.2.

5. After calculating the sample entropy of all label lists according to step S4.2.4, select M2 dimensions whose sample entropy is lower than th to obtain a multidimensional KPI data set selected in the time dimension. The calculation expression is: Among them, M2 is the dimension selected to obtain the time dimension, SampleEn(X j ) is the sample entropy of the g-th dimension, f(X g ) is the dimension where the sample entropy is lower than th, and th is the threshold determined by Box-plot; The dimension of the multidimensional KPI data set finally obtained by selecting the time dimension is M2×N.

6. A KPI data dimensionality reduction method based on inter-metric and time dimension selection according to claim 5, characterized in that: Step S5 takes the union of the multidimensional KPI data set selected by the inter-metric dimension obtained in step S3 and the multidimensional KPI data set selected by the time dimension obtained in step S4, and finally obtains a KPI dimension of M3×N.

7. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method implements the steps of a KPI data dimensionality reduction method based on inter-metric and time dimension selection as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the KPI data dimensionality reduction method based on inter-metric and time dimension selection as described in any one of claims 1 to 6 is implemented.

Images