Operation and maintenance data anomaly detection method and system based on self-supervised hybrid neural network

Abstract

The present invention discloses a method and system for detecting anomalies in operation and maintenance data based on a self-supervised hybrid neural network, including: obtaining operation and maintenance data and preprocessing it, dividing the risk level according to the historical labels of the data; extracting the data of long and short periodic sequences in the program interface operation index data; inputting the data of long and short periodic sequences in the program interface operation index data into a pre-trained time convolution network to obtain the weighted splicing of the periodic index weights for the output of the anomaly detection network; using the weighted cross entropy loss function to train the anomaly detection network, using the hypothesis testing method to capture the fluctuation of machine performance data to assist in obtaining data anomaly results, and performing operation and maintenance data anomaly detection through the trained anomaly detection network. The present invention realizes efficient screening of abnormal data from massive operation and maintenance data, and solves the problems of manual labeling, small sample abnormal data detection, and difficulty in extracting data features.

Description

Technical Field

[0001] The present invention relates to the field of intelligent operation and maintenance, and in particular to a method and system for detecting anomaly in operation and maintenance data based on a self-supervised hybrid neural network. Background Art

[0002] Intelligent operation and maintenance (AIOps) is a combination of artificial intelligence and operation and maintenance. With big data platforms and algorithm platforms as the core, it extracts data from various monitoring systems, provides services to operation and maintenance personnel, and has an automated system with decision-making intelligence. It can change the daily, large-scale repetitive work in IT operation and maintenance into automated operations, thereby improving work efficiency and reducing operational risks. Among them, the anomaly detection scenario belongs to the front-end scenario of intelligent operation and maintenance. Only by efficiently and accurately screening out anomalies in massive operation and maintenance data can we further implement fault classification, fault root cause location, and generate fault reports.

[0003] The algorithm platform in intelligent operation and maintenance is usually based on machine learning, and deep learning is also widely used in the field of intelligent operation and maintenance. However, the application of operation and maintenance data in deep learning has problems such as uneven distribution of data samples, low recognition efficiency due to large number of parameters, high cost of manual labeling, and difficulty in identifying small sample anomalies. At the same time, the current operation and maintenance data anomaly detection solution is relatively simple in the use of time series information in feature engineering, and does not fully apply the data relationship information between indicators, resulting in the inability to effectively extract data features. Summary of the invention

[0004] The purpose of the present invention is to address the deficiencies of the prior art and to propose a method and system for detecting anomalies in operation and maintenance data based on a self-supervised hybrid neural network.

[0005] The purpose of the present invention is to achieve anomaly detection of operation and maintenance data based on self-supervised hybrid neural network by the following technical scheme: an anomaly detection method and system for operation and maintenance data based on self-supervised hybrid neural network. The anomaly detection of operation and maintenance data based on self-supervised hybrid neural network includes:

[0006] S1. Obtaining program interface operation index data and machine performance index data in operation and maintenance data;

[0007] S2. Preprocess the data and classify the risk level according to the historical labels of the data;

[0008] S3. Obtain input data: extract periodic sequence data from program interface operation indicator data;

[0009] S4. Input the data in the periodic sequence of the program interface operation indicator data into the pre-trained TCN network, take the time series feature of each indicator as a neuron, and connect the maximum value of the weight values ​​of different risk levels of each neuron as the weight value of the indicator time series to obtain the periodic indicator weight;

[0010] S5. Use a weighted cross entropy loss function to train an anomaly detection network, wherein the anomaly detection network includes a CNN-TCN network and a feature splicing layer, the input is the input data in S3, and the output is a classification result obtained by weighted splicing of different period features output by the CNN-TCN network by the period indicator weight; directly classify the misclassified data in the classification result as abnormal data, then calculate the Euclidean distance between the result matrix of the correctly classified data and the true classification matrix, and classify the data whose Euclidean distance is greater than a preset threshold as abnormal data;

[0011] In the weighted cross entropy loss function, the weight of each sample is constructed by calculating the jitter data in the machine performance index data through a hypothesis testing method;

[0012] S6. Use the trained anomaly detection network to detect anomalies in operation and maintenance data, and obtain anomaly results through hypothesis testing method.

[0013] Furthermore, the program interface operation index data and machine performance index data are specifically:

[0014] The program operation interface indicator data includes: interface operation times, average processing time, average response time, interface operation success rate, system operation success rate, interface pause number and interface pause rate;

[0015] The machine performance indicator data includes: CPU utilization, memory usage, network bandwidth, disk IO, number of TCP connections and number of full garbage collection times.

[0016] Furthermore, the data preprocessing specifically includes: filtering, aggregating, and filling the program interface operation indicator data, and normalizing the mean of each indicator data in units of days;

[0017] The filtering is to select Q valid indicators in digital form;

[0018] The aggregation is to calculate the data average value using all the data of a single indicator in each minute, and use the average value as the indicator data of that minute;

[0019] The filling is to use the indicator data at the previous moment as the indicator data at the current moment when the indicator data at a certain moment is missing.

[0020] Furthermore, the risk level division is specifically as follows: constructing two normal distribution graphs for the interface operation success rates in the fault and warning data, respectively, setting the point with a cumulative probability of 0.8 in the warning normal distribution graph as x1, and setting the intersection point of the two normal distribution graphs as x2; dividing the data with an interface operation success rate of x1 to 100% into Class I data, dividing x2-x1 into Class II data, and dividing 0-x1 into Class III data;

[0021] The Category I data indicates that the system program runs stably and robustly, the Category II data indicates that the system program has an instability risk but runs basically stably, and the Category III data indicates that the system program runs relatively unstably and has greater security risks and crash risks.

[0022] Furthermore, the data in the periodic sequence extracted from the program interface operation index data is specifically: the program interface operation index data is decomposed at a frequency level by using wavelet transform, m main frequency components are rounded, and data is acquired with the main frequency as the sampling rate to form a time series; at the same time, the first N data at the current time point, the first N data at the current time point every day, and the first N data at the current time point every week are obtained, a total of m+3 long and short period time series, and the data volume of all time series is the same, which is N; the m+3 time series are used as the input of the neural network.

[0023] Furthermore, the anomaly detection network includes: a CNN-TCN network, a feature concatenation layer, two fully connected layers and a softmax activation function;

[0024] In the CNN-TCN network, CNN includes an index convolution layer, and TCN includes a temporal convolution layer, wherein the index convolution layer is composed of one-dimensional convolution, average pooling, Relu activation function and dropout parameter abandonment; the temporal convolution layer is composed of dilated causal convolution, normalization, Relu activation function, dropout parameter abandonment and 1X1 convolution.

[0025] Furthermore, the weighted cross entropy loss function is specifically:

[0026] Where N represents the number of samples, C represents the number of categories, represents the weight of category j, is the true label of sample i, is the predicted probability of sample i in category j, and the weight calculation is as follows.

[0027]

[0028] in represents the weight of category j in the loss function, It is the weight coefficient determined by the data jitter of the machine performance indicator. is the maximum weight value limit coefficient, and P represents the proportion of the j-th type of data in the data set.

[0029] Furthermore, the hypothesis test includes:

[0030]

[0031] Among them, X represents the sample value, U represents the population mean, SD represents the standard deviation, and n represents the sample size. When z is in the confidence interval [- , ] indicates that the data is normal, otherwise it indicates data jitter;

[0032] The proportion of statistical jitter data to the data in the window is p; the weight coefficient of the loss function The calculation formula is as follows:

[0033] .

[0034] On the other hand, the specification also provides an operation and maintenance data anomaly detection system based on a self-supervised hybrid neural network, the system comprising: a data preprocessing module, a periodic data extraction module, a pre-trained TCN network module, an anomaly detection network module and a training module;

[0035] The preprocessing module is used to preprocess the program interface operation indicator data in the operation and maintenance data, and divide the risk level according to the historical tags of the data;

[0036] The periodic data extraction module is used to extract the periodic sequence data in the pre-processed program interface operation index data;

[0037] The pre-trained TCN network module inputs the data of the periodic sequence, takes the time series feature of each indicator as a neuron, and connects the maximum value of the weight values ​​of different risk levels to each neuron as the weight value of the indicator time series to obtain the periodic indicator weight;

[0038] The anomaly detection network module includes a CNN-TCN network and a feature splicing layer, the input is the data of the periodic sequence, and the output is the classification result obtained by weighted splicing of different periodic features output by the CNN-TCN network by the periodic indicator weight;

[0039] The training module is used to train the anomaly detection network using a weighted cross entropy loss function. After obtaining the classification result, the data that is misclassified in the classification result is directly classified as abnormal data, and then the Euclidean distance between the result matrix of the correctly classified data and the true classification matrix is ​​calculated, and the data whose Euclidean distance is greater than a preset threshold is classified as abnormal data;

[0040] In the weighted cross entropy loss function, the weight of each sample is constructed by calculating the jitter data in the machine performance indicator data through a hypothesis testing method.

[0041] On the other hand, the specification also provides an operation and maintenance data anomaly detection device based on a self-supervised hybrid neural network, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it implements the operation and maintenance data anomaly detection method based on a self-supervised hybrid neural network.

[0042] Beneficial effects of the invention: The invention discloses a method and system for detecting anomalies in operation and maintenance data based on a self-supervised hybrid neural network, which performs data preprocessing according to the characteristics of operation and maintenance data, performs automatic labeling based on the data's own attributes, uses a convolutional neural network (CNN) to fit the functional relationship between indicators of application operation data, uses a temporal convolutional network (TCN) to extract time features of long and short cycles, and captures fluctuations in machine performance data through a hypothesis testing method, thereby realizing the function of efficiently screening abnormal data from massive operation and maintenance data, and promoting the solution of the problems of low detection efficiency, the need for manual data labeling, difficulty in detecting small sample abnormal data, and difficulty in effectively extracting data features in current anomaly detection schemes. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A schematic diagram of an operation and maintenance data anomaly detection method based on a self-supervised hybrid neural network provided in an embodiment of the present invention;

[0044] Figure 2 A schematic diagram of risk level classification of program interface operation indicator data provided by an embodiment of the present invention;

[0045] Figure 3 A schematic diagram of an indicator convolution layer provided in an embodiment of the present invention;

[0046] Figure 4 A schematic diagram of a temporal convolutional layer provided in an embodiment of the present invention;

[0047] Figure 5 A schematic diagram of an operation and maintenance data anomaly detection device based on a self-supervised hybrid neural network provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0049] like Figure 1 As shown, the present invention provides a method for detecting anomalies in operation and maintenance data based on a self-supervised hybrid neural network.

[0050] S1. Obtaining program interface operation index data and machine performance index data in operation and maintenance data;

[0051] When operating and maintaining system programs running on servers, operation and maintenance data such as program interface operation index data and machine performance index data are usually generated. This solution uses program interface operation data as the input of the neural network and machine performance index data as auxiliary supporting data.

[0052] Among them, the program interface operation index data usually includes indicators such as the number of interface operations, average processing time, average response time, and interface operation success rate, and the machine performance index data usually includes indicators such as CPU utilization, memory usage, network bandwidth, and disk IO. This scheme uses the program interface operation data as the input of the neural network, and the machine performance index data as auxiliary supporting data. The indicators included in the program interface operation index data and the machine performance index data in this embodiment are as follows: the program operation interface index data include: the number of interface operations, average processing time, average response time, interface operation success rate, system operation success rate, interface pause number, and interface pause rate; the machine performance index data include: CPU utilization, memory usage, network bandwidth, disk IO, number of TCP connections, and number of full garbage collection times.

[0053] S2. Preprocess the data and classify the risk level according to the historical labels of the data;

[0054] When preprocessing data, this solution filters, aggregates, and fills the program interface operation indicator data, and normalizes the mean of each indicator data by day. Filtering refers to screening out Q valid indicators in digital form, and there are 7 valid indicators in this embodiment; aggregation refers to calculating the data average using all data of a single indicator within each minute, and using the average as the indicator data of that minute; filling refers to using the indicator data of the previous moment as the indicator data of the current moment when the indicator data of a certain moment is missing.

[0055] This solution defines common operation and maintenance data as typical fault-free data and typical fault data, where typical fault data refers to data that conforms to the majority distribution in fault data and is easier to detect in actual operation and maintenance scenarios. At the same time, abnormal data refers to data that can indicate problems in the operation and maintenance status in the remaining data other than common operation and maintenance data. The characteristics of data anomalies summarized in this solution are that the data relationship between each indicator in the program interface operation indicator data is abnormal and the indicator data does not conform to the time series law of the past history. Abnormal data is a small sample data in the operation and maintenance data, which contains high-level operation and maintenance information and can be used to indicate potential deep risks in the operation of the program system. For example, 90% of the operation and maintenance data belongs to common operation and maintenance data, that is, typical fault-free data and typical fault data account for 90% in total, and the remaining 10% belongs to uncommon operation and maintenance data. Of this 10% of data, about 5% can indicate that the operation and maintenance status is abnormal (the meaning of abnormality is: there is an abnormality in the program running on the server, which may or may not be manifested in the form of a fault), and the other 5% is noise data such as burrs and jitters.

[0056] Program interface operation index data is a time series data containing multiple indicators, among which the interface operation success rate indicator has the highest correlation with the system program operation status and is the most informative. Figure 2 As shown in the figure, according to the fault and warning labels given by the operation and maintenance personnel to the historical program interface operation index data, two normal distribution graphs are constructed for the interface operation success rate in the fault and warning data, and the point with a cumulative probability of 0.8 in the warning normal distribution graph is set as x1, and the intersection point of the two normal distribution graphs is set as x2. The data with an interface operation success rate of x1 to 100% is divided into Class I data, x2-x1 is divided into Class II data, and 0-x1 is divided into Class III data. Among them, Class I data indicates that the system program runs stably and robustly, Class II data indicates that the system program has an unstable risk but runs basically stable, and Class III data indicates that the system program runs relatively unstable and has a greater safety hazard and crash risk. As shown in the figure, the yellow histogram shows the probability distribution of the interface operation success rate of the warning data, the blue curve is the normal distribution curve fitted by the interface operation success rate of the warning data, the red histogram shows the probability distribution of the interface operation success rate of the fault data, and the black curve is the normal distribution curve fitted by the interface operation success rate of the fault data.

[0057] S3. Obtain input data: extract periodic sequence data from program interface operation indicator data;

[0058] The program interface operation index data is decomposed into frequency levels by wavelet transform, and the m main frequency components are rounded, and the data is obtained at the main frequency as the sampling rate to form a time series. At the same time, the first N data at the current time point, the first N data at the current time point every day, and the first N data at the current time point every week are obtained, a total of m+3 long and short cycle time series, and the data volume of all time series is the same, which is N. Among them, the first N data at the current time point every day can be understood as obtaining data at a sampling rate of days to form a time series. For example, the current time is 12:00, and the time series consists of the data corresponding to the 12:00 time point every day of the previous N days. The m+3 time series are used as the input of the neural network. The program interface operation index data usually has a strong periodicity, which may be caused by the periodicity of business demand, data processing periodicity, or user behavior periodicity, such as the surge in orders on e-commerce websites during holidays or specific promotional activities, and the generation, processing and analysis of sensor data, log data, etc. at fixed time intervals. Periodic sampling helps to highlight the periodic characteristics of the data, making it easier for the neural network to learn the periodic laws of the data, thereby improving the generalization ability of the model and reducing the risk of overfitting. It also enhances the interpretability of time series data, making it easier for professional operation and maintenance personnel to understand and interpret the prediction results of the model.

[0059] S4. Input the time series of m+3 periods into the TCN pre-trained network respectively, perform global average pooling on each indicator time series of each period as time series features, and use the time series features of each indicator as a neuron through a fully connected layer and a softmax output matrix of 1x3. Set the maximum value of the three weight values ​​of each neuron connecting the three categories as the weight value of the indicator time series, and finally obtain the period indicator weight.

[0060] S5. Use a weighted cross entropy loss function to train an anomaly detection network, wherein the anomaly detection network includes a CNN-TCN network and a feature concatenation layer, wherein the input is the input data in S3, and the output is a classification result obtained by weighted concatenation of different period features output by the CNN-TCN network by the period indicator weight;

[0061] Specifically, the time series of m+3 periods is used as the input of the CNN-TCN network. First, the convolutional neural network is used to perform one-dimensional convolution on the indicator dimension, establish the data relationship between indicators, and extract the indicator dimension features. Secondly, the TCN network is used to fit the historical laws of the data in the time dimension. Then, the features of different periods are weighted and spliced ​​using the periodic indicator weights obtained by pre-training. Finally, after two layers of fully connected layers and softmax activation function, the output is obtained to obtain a 1x3 result matrix and classification results. The overall network framework is shown below.

[0062] like Figure 3and Figure 4 As shown in the figure, the specific structures of the index convolution layer and the temporal convolution layer are as follows: the index convolution layer consists of one-dimensional convolution, average pooling, Relu activation function and dropout parameter abandonment. The temporal convolution layer consists of dilated causal convolution, normalization, Relu activation function, dropout parameter abandonment and 1X1 convolution.

[0063] Normally, the system program is in stable operation, so the number of samples of Class II and Class III data is small. The weighted cross entropy loss function is set to increase the classification weight of Class II and Class III data for training, so that the network can fully learn the sample distribution of common fault data in operation and maintenance data [90%]. When the network's recognition accuracy is higher than 95%, it indicates that the network's feature extraction ability is credible, and the network can well learn the distribution characteristics of common operation and maintenance data. The weighted cross entropy loss function is shown below.

[0064]

[0065] Where N represents the number of samples, C represents the number of categories, represents the weight of category j, is the true label of sample i, is the predicted probability of sample i in category j. The weight calculation is as follows.

[0066]

[0067] in represents the weight of category j in the loss function, It is the weight coefficient determined by the data jitter of the machine performance indicator. Used to limit the highest weight value (for example, when When is 0.1, the highest category weight is 10), P represents the proportion of the j-th category data in the data set (for example, the third category data accounts for 10% of all data, then P is 10%).

[0068] The incorrectly classified data in the classification results are directly classified as abnormal data, and then the Euclidean distance between the result matrix of the correctly classified data and the true classification matrix is ​​calculated, and the data with a Euclidean distance greater than d is classified as abnormal data.

[0069] The value range of Euclidean distance d is [0.25, 0.4], and the value of d is calibrated using the recall rate of abnormal data.

[0070] This solution uses the CNN+TCN network as a fitting function and uses the information of the program interface operation indicator data in the time and indicator dimensions to derive the classification results of the current interface operation success rate. Abnormal data has errors in the data derivation relationship in the indicator dimension or abnormal jitter characteristics in each time period, which makes the network misclassify or the difference between the derivation result and the actual result is greater than d.

[0071] Select the machine index data of the system program that has not crashed or frequently failed in the past three weeks, use this data to establish a machine performance index database, calculate the overall mean U and standard deviation SD of the database, and statistically calculate the proportion of jitter data in the database to all data as the α value. The cumulative probability density of the normal distribution with mean U and standard deviation SD is calculated as The z value is given as − , the confidence interval is [- , ].

[0072] Get the timestamp of the abnormal data, define a time window in the five minutes before and three minutes after the timestamp, extract the machine performance index data in the time window, and use the hypothesis testing method in statistics to detect fluctuating machine indicators. Summarize the program interface operation index data and the machine performance index data into abnormal results, which serve as an important basis for operation and maintenance personnel to further diagnose abnormalities. Among them, the abnormal results include abnormal time points and indicator timing curves. The indicator timing curve is divided into two parts. One is a curve composed of the timing data of each indicator of the machine performance index data and marks the data jitter points. The second is a curve composed of N data of each indicator of the m+3 long and short cycles of the program interface operation index data and marks the abnormal points. The formula of the hypothesis testing method is shown below.

[0073]

[0074] Where X represents the sample value, U represents the population mean, SD represents the standard deviation, and n represents the sample size. , ] indicates that the data is normal, otherwise it indicates data jitter.

[0075] The proportion of statistical jitter data to the data in the window is p. The weight coefficient of the loss function The calculation formula is as follows.

[0076]

[0077] The more jitter data there are, the more anomalies need to be detected, and the neural network should not miss possible anomalies. Therefore, the larger the p is, the more jitter data there is. The lower the learning weight of the data of type II and III, the lower the risk of misclassifying abnormal data as typical fault data. This coefficient does not explicitly increase the anomaly detection rate, but it can make anomaly detection more stable and reduce the risk of misclassifying abnormal data as common data.

[0078] S6. Use the trained anomaly detection network to perform anomaly detection on operation and maintenance data, and obtain the anomaly results through the above hypothesis testing method.

[0079] Corresponding to the aforementioned embodiment of an operation and maintenance data anomaly detection method based on a self-supervised hybrid neural network, the present invention also provides an embodiment of an operation and maintenance data anomaly detection system based on a self-supervised hybrid neural network. The system includes: a data preprocessing module, a periodic data extraction module, a pre-trained TCN network module, an anomaly detection network module and a training module;

[0080] The preprocessing module is used to preprocess the program interface operation indicator data in the operation and maintenance data, and divide the risk level according to the historical tags of the data;

[0081] The periodic data extraction module is used to extract the data of long and short periodic sequences in the pre-processed program interface operation index data;

[0082] The pre-trained TCN network module inputs the data of long and short periodic sequences, takes the time series characteristics of each indicator as a neuron, and connects the maximum value of the weight values ​​of different risk levels to each neuron as the weight value of the indicator time series to obtain the periodic indicator weight;

[0083] The anomaly detection network module includes a CNN-TCN network and a feature splicing layer, the input is the data of long and short periodic sequences, and the output is the classification result obtained by weighted splicing of different periodic features output by the CNN-TCN network using periodic indicator weights;

[0084] The training module is used to train the anomaly detection network using a weighted cross entropy loss function. After obtaining the classification result, the data that is misclassified in the classification result is directly classified as abnormal data, and then the Euclidean distance between the result matrix of the correctly classified data and the true classification matrix is ​​calculated, and the data whose Euclidean distance is greater than a preset threshold is classified as abnormal data;

[0085] In the weighted cross entropy loss function, the weight of each sample is constructed by calculating the jitter data in the machine performance indicator data through a hypothesis testing method.

[0086] Corresponding to the aforementioned embodiment of an operation and maintenance data anomaly detection method based on a self-supervised hybrid neural network, the present invention also provides an embodiment of an operation and maintenance data anomaly detection device based on a self-supervised hybrid neural network.

[0087] See also Figure 5 An operation and maintenance data anomaly detection device based on a self-supervised hybrid neural network provided in an embodiment of the present invention includes a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement an operation and maintenance data anomaly detection method based on a self-supervised hybrid neural network in the above embodiment.

[0088] An embodiment of an operation and maintenance data anomaly detection device based on a self-supervised hybrid neural network provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From a hardware perspective, if Figure 5 As shown, it is a hardware structure diagram of any device with data processing capability where the operation and maintenance data anomaly detection device based on self-supervised hybrid neural network provided by the present invention is located, except Figure 5 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0089] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0090] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0091] An embodiment of the present invention also provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, a method for detecting anomalies in operation and maintenance data based on a self-supervised hybrid neural network in the above embodiment is implemented.

[0092] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0093] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the operation and maintenance data anomaly detection method based on a self-supervised hybrid neural network.

[0094] Those skilled in the art will readily appreciate other embodiments of the present application after considering the description and practicing the contents disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The description and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the claims.

[0095] It should be understood that the above general description and the detailed description below are only exemplary and explanatory and cannot limit the present application. The present application is not limited to the precise structure described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present application is limited only by the attached claims.

Claims

1. A method for detecting anomalies in operation and maintenance data based on a self-supervised hybrid neural network, characterized in that: The method includes: S1. Obtaining program interface operation index data and machine performance index data in operation and maintenance data; S2. Preprocess the data and divide the risk level according to the historical label of the data; the risk level division is specifically as follows: construct two normal distribution graphs for the interface operation success rate in the fault and warning data, respectively, set the point with a cumulative probability of 0.8 in the warning normal distribution graph as x1, and set the intersection point of the two normal distribution graphs as x2; divide the data with an interface operation success rate of x1 to 100% into Class I data, x2-x1 into Class II data, and 0-x1 into Class III data; The data of category I indicates that the system program runs stably and robustly, the data of category II indicates that the system program has the risk of instability but runs basically stably, and the data of category III indicates that the system program runs relatively unstable and has great security risks and crash risks; S3. Obtain input data: extract the data of long and short periodic sequences from the program interface operation indicator data; S4. Input the data of long and short periodic sequences in the program interface operation indicator data into the pre-trained TCN network, perform global average pooling on each indicator time series of each cycle as time series features, and use the time series features of each indicator as a neuron through a fully connected layer and a softmax output matrix of 1x3; set the maximum value of the three weight values ​​of each neuron connecting the three categories as the weight value of the indicator time series, and finally obtain the periodic indicator weight; S5. Use a weighted cross entropy loss function to train an anomaly detection network, wherein the anomaly detection network includes a CNN-TCN network and a feature splicing layer, the input is the input data in S3, and the output is a classification result obtained by weighted splicing of different period features output by the CNN-TCN network by the period indicator weight; directly classify the misclassified data in the classification result as abnormal data, then calculate the Euclidean distance between the result matrix of the correctly classified data and the true classification matrix, and classify the data whose Euclidean distance is greater than a preset threshold as abnormal data; In the weighted cross entropy loss function, the weight of each sample is constructed by calculating the jitter data in the machine performance index data using a hypothesis testing method; the weighted cross entropy loss function is specifically: Among them, N represents the number of samples, C represents the number of categories, ω j represents the weight of category j, y ij is the true label of sample i, p ij is the predicted probability of sample i in category j, and the weight calculation is as follows: where ω j represents the weight of category j in the loss function, ρ is the weight coefficient determined by the data jitter of the machine performance indicator, ε is the maximum weight value limit coefficient, and P represents the proportion of the j-th category data in the data set; The hypothesis testing includes: Among them, X represents the sample value, U represents the population mean, SD represents the standard deviation, and n represents the sample size. When z is in the confidence interval [-Z score ,Z score ] indicates that the data is normal, otherwise it indicates data jitter; The proportion of statistical jitter data to the data in the window is p; the calculation formula of the loss function weight coefficient ρ is as follows: S6. Use the trained anomaly detection network to detect anomalies in operation and maintenance data, and obtain anomaly results through hypothesis testing method.

2. According to claim 1, a method for detecting anomalies in operation and maintenance data based on a self-supervised hybrid neural network is characterized in that: The program interface operation index data and machine performance index data are specifically: The program operation interface indicator data includes: interface operation times, average processing time, average response time, interface operation success rate, system operation success rate, interface pause number and interface pause rate; The machine performance indicator data includes: CPU utilization, memory usage, network bandwidth, disk IO, number of TCP connections and number of full garbage collection times.

3. The method for detecting anomaly in operation and maintenance data based on a self-supervised hybrid neural network according to claim 1, characterized in that: The data preprocessing specifically includes: filtering, aggregating, and filling the program interface operation indicator data, and normalizing the mean of each indicator data in units of days; The filtering is to select Q valid indicators in digital form; The aggregation is to calculate the data average value using all the data of a single indicator in each minute, and use the average value as the indicator data of that minute; The filling is to use the indicator data at the previous moment as the indicator data at the current moment when the indicator data at a certain moment is missing.

4. The method for detecting anomaly in operation and maintenance data based on a self-supervised hybrid neural network according to claim 1, characterized in that: The method of extracting the data of the long and short periodic series in the program interface operation index data is specifically as follows: using wavelet transform to perform frequency hierarchical decomposition on the program interface operation index data, rounding the m main frequency components therein, and acquiring data with the main frequency as the sampling rate to form a time series; at the same time, obtaining the first N data at the current time point, the first N data at the current time point every day, and the first N data at the current time point every week, a total of m+3 long and short periodic time series, the data volume of all time series is the same, which is N; the m+3 time series are used as the input of the neural network.

5. The method for detecting anomaly in operation and maintenance data based on a self-supervised hybrid neural network according to claim 1, characterized in that: The anomaly detection network includes: a CNN-TCN network, a feature concatenation layer, two fully connected layers and a softmax activation function; In the CNN-TCN network, CNN includes an index convolution layer, and TCN includes a temporal convolution layer, wherein the index convolution layer is composed of one-dimensional convolution, average pooling, Relu activation function and dropout parameter abandonment; the temporal convolution layer is composed of dilated causal convolution, normalization, Relu activation function, dropout parameter abandonment and 1X1 convolution.

6. A system for implementing the method according to any one of claims 1 to 5, characterized in that: The system includes: a data preprocessing module, a periodic data extraction module, a pre-trained TCN network module, an anomaly detection network module and a training module; The preprocessing module is used to preprocess the program interface operation indicator data in the operation and maintenance data, and divide the risk level according to the historical tags of the data; The periodic data extraction module is used to extract the data of long and short periodic sequences in the pre-processed program interface operation index data; The pre-trained TCN network module inputs the data of long and short periodic sequences, performs global average pooling on each indicator time series of each period as the time series feature, takes the time series feature of each indicator as a neuron, and connects the maximum value of the weight values ​​of different risk levels to each neuron as the weight value of the indicator time series to obtain the periodic indicator weight; The anomaly detection network module includes a CNN-TCN network and a feature splicing layer, the input is the data of long and short periodic sequences, and the output is the classification result obtained by weighted splicing of different periodic features output by the CNN-TCN network using periodic indicator weights; The training module is used to train the anomaly detection network using a weighted cross entropy loss function. After obtaining the classification result, the data that is misclassified in the classification result is directly classified as abnormal data, and then the Euclidean distance between the result matrix of the correctly classified data and the true classification matrix is ​​calculated, and the data whose Euclidean distance is greater than a preset threshold is classified as abnormal data; In the weighted cross entropy loss function, the weight of each sample is constructed by calculating the jitter data in the machine performance indicator data through a hypothesis testing method.

7. A maintenance data anomaly detection device based on a self-supervised hybrid neural network, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, an operation and maintenance data anomaly detection method based on a self-supervised hybrid neural network as described in any one of claims 1 to 5 is implemented.

Images