Monitoring method and device, equipment and storage medium

Abstract

The invention provides a monitoring method and device, equipment and a storage medium, and relates to the technical field of computers, and the method comprises the steps: determining first metadata, carrying out the differential processing of the first metadata and second metadata, obtaining a differential result, uploading the differential result to a monitoring center, enabling the monitoring center to train a teacher model based on the differential result, and obtaining a teacher model; after the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, so that monitoring of the equipment in the cluster is realized.

Description

Background Art

[0002] With the development of network technology, the number of network devices has gradually increased. More and more network devices are connected to the network to form a huge distributed system. A distributed system is usually composed of a large number of devices. How to monitor a large number of devices is an urgent problem to be solved in this field. Summary of the invention

[0003] The present disclosure provides a monitoring method, apparatus, device and storage medium, which at least to a certain extent realize the monitoring of a large number of devices in a distributed system.

[0004] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0005] According to one aspect of the present disclosure, a monitoring method is provided, which is applied to a first cluster and includes:

[0006] determining first metadata;

[0007] performing differential processing on the first metadata and the second metadata to obtain a differential result, wherein the second metadata is determined by the second cluster;

[0008] Upload the difference results to the monitoring center so that the monitoring center can train the teacher model based on the difference results. After the teacher model training is completed, distill the small model;

[0009] Receive small models;

[0010] The first cluster is monitored based on the small model.

[0011] In one embodiment of the present disclosure, determining the first metadata includes:

[0012] Obtaining status data and basic information data of network devices in the first cluster;

[0013] The first metadata is determined according to the state data and the basic information data volume semantic embedding model.

[0014] In one embodiment of the present disclosure, determining the first metadata according to the state data, the basic information data and the semantic embedding model includes:

[0015] Input the state data into the semantic embedding model to obtain semantic feature data;

[0016] The semantic feature data and the basic information data are determined as metadata.

[0017] In one embodiment of the present disclosure, performing differential processing on the first metadata and the second metadata to obtain a differential result includes:

[0018] Normalizing the first metadata and the second metadata so that the normalized first metadata and the second metadata are within the same preset range;

[0019] The first metadata and the second metadata within the same preset range are subjected to differential processing to obtain a differential result.

[0020] In one embodiment of the present disclosure, monitoring the first cluster based on the small model includes:

[0021] Input the metadata into the small model to obtain the predicted traffic data;

[0022] When the difference between the predicted traffic data and the actual traffic data in the first cluster is greater than a first preset threshold, an alarm is issued.

[0023] In one embodiment of the present disclosure, the method further includes:

[0024] Determine the first metadata and the second metadata that are different based on the difference result;

[0025] Determine the ratio of the first metadata and the second metadata that are different in the first metadata and the second metadata;

[0026] When the ratio exceeds a second preset threshold, an alarm is issued.

[0027] According to another aspect of the present disclosure, a monitoring method is provided, which is applied to a monitoring center, comprising:

[0028] receiving a differential result, where the differential result is obtained by differential processing of the first metadata and the second metadata, where the first metadata is determined by the first cluster and the second metadata is determined by the second cluster;

[0029] Train the teacher model based on the difference results;

[0030] After the teacher model is trained, the small model is distilled based on the trained teacher model;

[0031] The small model is sent to the first cluster, so that the small model monitors the first cluster.

[0032] According to another aspect of the present disclosure, a monitoring device is provided, which is applied to a first cluster and includes:

[0033] A determination module, configured to determine first metadata;

[0034] A differential module, used for performing differential processing on the first metadata and the second metadata to obtain a differential result, wherein the second metadata is determined by the second cluster;

[0035] The upload module is used to upload the differential results to the monitoring center so that the monitoring center can train the teacher model based on the differential results. After the teacher model training is completed, the small model is distilled;

[0036] A first receiving module, used for receiving a small model;

[0037] The monitoring module is used to monitor the first cluster based on the small model.

[0038] In one embodiment of the present disclosure, the determination module includes:

[0039] An acquisition unit, used to acquire status data and basic information data of network devices in the first cluster;

[0040] The determining unit is used to determine the first metadata according to the state data, the basic information data and the semantic embedding model.

[0041] In one embodiment of the present disclosure, the determining unit includes:

[0042] A first input subunit, used for inputting state data into a semantic embedding model to obtain semantic feature data;

[0043] A determination subunit is used to determine the semantic feature data and the basic information data as metadata.

[0044] In one embodiment of the present disclosure, the differential module includes:

[0045] A normalization unit, used for normalizing the first metadata and the second metadata so that the normalized first metadata and the second metadata are within the same preset range;

[0046] The difference unit is used to perform difference processing on the first metadata and the second metadata within the same preset range to obtain a difference result.

[0047] In one embodiment of the present disclosure, the monitoring module includes:

[0048] The second input unit is used to input the metadata into the small model to obtain the predicted traffic data;

[0049] The alarm unit is used to issue an alarm when the difference between the predicted traffic data and the actual traffic data in the first cluster is greater than a first preset threshold.

[0050] In one embodiment of the present disclosure, the device further includes:

[0051] A second determining module, configured to determine the first metadata and the second metadata that are different based on the difference result;

[0052] A third determination module is used to determine the proportion of the first metadata and the second metadata that have differences in the first metadata and the second metadata;

[0053] The second alarm module is used to generate an alarm when the ratio exceeds a second preset threshold. According to another aspect of the present disclosure, a monitoring device is provided, which is applied to a monitoring center, and includes:

[0054] A second receiving module is used to receive a differential result, where the differential result is obtained by performing differential processing on the first metadata and the second metadata, where the first metadata is determined by the first cluster and the second metadata is determined by the second cluster;

[0055] The training module is used to train the teacher model based on the differential results;

[0056] The distillation module is used to distill small models based on the trained teacher model after the teacher model training is completed;

[0057] The sending module is used to send the small model to the first cluster so that the small model monitors the first cluster.

[0058] According to another aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the above-mentioned monitoring method by executing the executable instructions.

[0059] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the above-mentioned monitoring method is implemented.

[0060] The monitoring method, apparatus, device and storage medium provided by the embodiments of the present disclosure obtain status data and basic information data of network devices in the first cluster, determine the first metadata based on the status data, basic information data and semantic embedding model, perform differential processing on the first metadata and the second metadata to obtain a differential result, and upload the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0061] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0063] Figure 1 A schematic diagram of the structure of a monitoring system in an embodiment of the present disclosure is shown;

[0064] Figure 2 A flow chart of a monitoring method in an embodiment of the present disclosure is shown;

[0065] Figure 3 Another monitoring method flow chart in an embodiment of the present disclosure is shown;

[0066] Figure 4 A flow chart of another monitoring method in an embodiment of the present disclosure is shown;

[0067] Figure 5 A flow chart of another monitoring method in an embodiment of the present disclosure is shown;

[0068] Figure 6 A flow chart of another monitoring method in an embodiment of the present disclosure is shown;

[0069] Figure 7 A schematic diagram of a monitoring device in an embodiment of the present disclosure is shown;

[0070] Figure 8 A schematic diagram of another monitoring device in an embodiment of the present disclosure is shown;

[0071] Fig. 9 A structural block diagram of an electronic device in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0072] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0073] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0074] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0075] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0076] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0077] The network monitoring of the data center usually involves regular traffic statistics of the nodes in the network topology to find out whether there is traffic congestion, traffic idleness, or even whether the device is responsive when the system provides services. Currently, most network equipment manufacturers such as switches and network cards have feedback logs or information display interfaces for the status of their own products. When monitoring and detecting, the data center only needs to access the corresponding device information to determine the status of the device. For the traffic in the network, it is necessary to further analyze the collected data and then simulate the status in the current network environment. The centralized monitoring method requires access to all devices within the jurisdiction, and the collected data is centrally processed and analyzed. This is a stable system overhead cost for the device cluster with a stable topology. As the number of devices in the system continues to grow, this overhead will continue to grow. On the other hand, as the devices managed by the data center continue to be heterogeneous, the compatibility of the centralized monitoring system will often continue to be challenged.

[0078] In order to solve the above technical problems, the present disclosure provides a monitoring method, device, equipment and storage medium. In order to explain the present disclosure in detail, the present disclosure first explains the migration method.

[0079] It should be pointed out that, in the absence of conflict, the embodiments of the present disclosure and the technical features therein may be combined with each other.

[0080] The specific implementation method of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0081] Figure 1 A schematic diagram of the structure of a monitoring system in an embodiment of the present disclosure is shown. Figure 1 As shown, the system 10 may include: a cluster 101 and a monitoring center 102. The cluster 101 and the monitoring center 102 may be located on different devices. The cluster 101 may be a module on an electronic device with data acquisition capability. The monitoring center 102 may be a module on an electronic device with data processing capability such as a computer or a server. The cluster 101 and the monitoring center 102 may be located on the same device, such as the cluster 101 and the monitoring center 102 may be an input module and a processing module on a computer or a mobile phone.

[0082] The cluster 101 and the monitoring center 102 are connected to each other via a network, which may be a wired network or a wireless network.

[0083] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged through the network. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPsec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0084] The following describes a situation where the cluster 101 and the monitoring center 102 are located on two different devices.

[0085] The cluster 101 may be located on a terminal device, which may be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, wearable devices, augmented reality devices, virtual reality devices, etc.

[0086] Optionally, the client of the application installed in different terminal devices is the same, or the client of the same type of application based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile client, a PC client, etc.

[0087] The monitoring center 102 may be located on a server, which may be a server that provides various services, such as a background management server that provides support for devices operated by users using terminal devices. The background management server may analyze and process the received request data, and feed back the processing results to the terminal device.

[0088] Optionally, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0089] Those skilled in the art will know that Figure 1 The number of clusters 101 and monitoring centers 102 is only illustrative, and any number of clusters 101 and monitoring centers 102 may be provided according to actual needs. This is not limited in the embodiments of the present disclosure.

[0090] Figure 2 FIG. 1 shows a flow chart of a monitoring method in an embodiment of the present disclosure. It should be noted that the monitoring method of the present disclosure is applied to the first cluster. Figure 2 As shown, the method may include:

[0091] S210, determining first metadata;

[0092] In some embodiments, determining the first metadata includes:

[0093] Obtaining status data and basic information data of network devices in the first cluster;

[0094] The first metadata is determined according to the state data, the basic information data and the semantic embedding model.

[0095] In some embodiments, in some embodiments, the first cluster may be any one of a plurality of clusters connected to the monitoring center.

[0096] Exemplarily, the network device may be a network card, a switch, etc.

[0097] In some embodiments, the status data of the network device may be data generated during the operation of the network device, as well as basic parameter data of the network device.

[0098] In some embodiments, the basic information data may include relevant data of network devices in the cluster and cluster operation data.

[0099] Exemplarily, the basic information data may be the traffic data of the network card, the network traffic control algorithm, and the queue buffer data of the switch.

[0100] In some embodiments, determining the first metadata according to the state data, the basic information data, and the semantic embedding model may include:

[0101] Input the state data into the semantic embedding model to obtain semantic feature data;

[0102] The semantic feature data and the basic information data are determined as metadata.

[0103] In some embodiments, before inputting the state data into the semantic embedding model, the method may further include training the intelligent model based on the historical semantic embedding model and the historical metadata, and obtaining the semantic embedding model when the training stop condition is met.

[0104] S220, performing differential processing on the first metadata and the second metadata to obtain a differential result, where the second metadata is determined by the second cluster.

[0105] In some embodiments, the first metadata has a high degree of fit with the second metadata.

[0106] In some embodiments, the first metadata and the second metadata may be differentially processed using a sequence analysis model.

[0107] In some embodiments, performing differential processing on the first metadata and the second metadata may include merging duplicate data in the first metadata and the second metadata, and determining the merged duplicate data and difference data as a differential result.

[0108] Exemplarily, the first metadata is 1, 2, 3; the second metadata is 3, 4, 5.

[0109] The difference results can be: 1,2,3,4,5.

[0110] Exemplarily, the first metadata corresponding to the first cluster is 1a_BU and the second metadata corresponding to the second cluster is 2a_BU. The determined differential result may be Delta_a_BU_Norm.

[0111] S230, uploading the differential result to the monitoring center, so that the monitoring center trains the teacher model based on the differential result, and after the teacher model training is completed, distilling out the small model.

[0112] In some embodiments, before uploading the differential result to the monitoring center, the method may further include:

[0113] The monitoring center forms the topology information and network communication scheme of the cluster, wherein the network communication scheme includes the network connection method and communication protocol between the clusters.

[0114] After the monitoring center determines the network communication solution, the determined network communication solution may be sent to each cluster.

[0115] In some embodiments, after the monitoring center collects the differential results, it first trains the teacher model. This teacher model is a high-performance, high-precision model that is obtained by centralized training using a large amount of data collected by the monitoring center. This teacher model is able to learn complex patterns and rules in metadata very well.

[0116] After the teacher model is trained, the monitoring center will also conduct adaptive distillation training on the small model. Adaptive distillation refers to the selective distillation of the knowledge of the teacher model into the small model of each cluster in combination with the template of a specific autonomous cluster, so that the small model can fully inherit the capabilities of the teacher model while adapting to the characteristics and needs of its own cluster. This adaptive distillation training can greatly improve the performance of the small model and make it closer to the needs of the autonomous cluster.

[0117] In some embodiments, the specific implementation process of adaptive distillation training is as follows: First, prepare specific cluster data, and the monitoring center will collect and organize specific data for each cluster. These data include historical monitoring data of the cluster, current operating status data, and relevant information in a specific environment. These data will serve as the basic data set for training the small model. Then, based on the data characteristics of each cluster, an adaptive template is generated. This template contains the unique characteristics and requirements of the cluster, so that the distillation process can adjust the distillation strategy in a targeted manner to ensure that the small model can adapt to the cluster environment to the greatest extent. During the distillation process, the teacher model transfers its knowledge to the small model. Specifically, the teacher model generates corresponding soft labels and feature representations by predicting and analyzing the data of a specific cluster. Then, this information will be used to guide the training of the small model, so that it can not only learn the knowledge of the teacher model, but also perform well on the data of a specific cluster. At the same time, during the distillation process, the distillation strategy is dynamically adjusted according to the feedback and performance of the cluster. For example, the training of the small model can be made more accurate and efficient by optimizing the loss function, adjusting the distillation temperature, or changing the learning rate. After the training of the small model is completed, the monitoring center will conduct rigorous verification and evaluation of each small model. By testing on cluster-specific data, we ensure that the performance and adaptability of the small model meet the expected requirements. Finally, the monitoring center distributes these trained autonomous cluster adaptive models to each cluster. After deployment, the small model will monitor and analyze cluster data in real time to provide accurate services. At the same time, the monitoring center will regularly collect feedback and new data, and continuously update and optimize the model to ensure that the model always maintains the best performance.

[0118] S240, receiving small model.

[0119] S250: Monitor the first cluster based on the small model.

[0120] The monitoring method provided by the embodiments of the present disclosure obtains status data and basic information data of network devices in the first cluster, determines the first metadata based on the status data, basic information data and semantic embedding model, performs differential processing on the first metadata and the second metadata to obtain a differential result, and uploads the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0121] Figure 3 FIG. 2 shows another flow chart of a monitoring method according to an embodiment of the present disclosure. Figure 3 As shown, the method may include:

[0122] S310, obtaining status data and basic information data of network devices in the first cluster;

[0123] S320, determining first metadata according to the state data, the basic information data, and the semantic embedding model;

[0124] S330: normalize the first metadata and the second metadata so that the normalized first metadata and the second metadata are located in the same preset range.

[0125] In some embodiments, the preset range may be a range of the same type or a range within the same data range.

[0126] Exemplarily, the first metadata corresponding to the first cluster is 1a_BU and the second metadata corresponding to the second cluster is 2a_BU. First, 1a_BU and 2a_BU are normalized and scaled to a standard range such as [0, 1] or [-1, 1]. At this time, the normalized first metadata is 1a_BU_Norm and the normalized second metadata is 2a_BU_Norm.

[0127] S340: Perform differential processing on the first metadata and the second metadata within the same preset range to obtain a differential result.

[0128] Exemplarily, at this time, the normalized first metadata is 1a_BU_Norm, the normalized second metadata is 2a_BU_Norm, and a difference result obtained by difference may be Delta_a_BU_Norm.

[0129] S350, uploading the differential result to the monitoring center, so that the monitoring center trains the teacher model based on the differential result, and after the teacher model training is completed, distilling the small model;

[0130] S360, receiving small model;

[0131] S370: Monitor the first cluster based on the small model.

[0132] The monitoring method provided by the embodiments of the present disclosure obtains status data and basic information data of network devices in the first cluster, determines the first metadata based on the status data, basic information data and semantic embedding model, performs differential processing on the first metadata and the second metadata to obtain a differential result, and uploads the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0133] Figure 4 A schematic diagram of another monitoring method flow in an embodiment of the present disclosure is shown. Figure 4 As shown, the method may include:

[0134] S410, obtaining status data and basic information data of network devices in the first cluster;

[0135] S420, determining first metadata according to the state data, the basic information data, and the semantic embedding model;

[0136] S430, performing differential processing on the first metadata and the second metadata to obtain a differential result, where the second metadata is determined by the second cluster;

[0137] S440, uploading the differential result to the monitoring center, so that the monitoring center trains the teacher model based on the differential result, and after the teacher model training is completed, distilling the small model;

[0138] S450, receiving small model;

[0139] S460, inputting the metadata into the small model to obtain predicted traffic data;

[0140] S470: When the difference between the predicted traffic data and the actual traffic data in the first cluster is greater than a first preset threshold, an alarm is issued.

[0141] In some embodiments, the first cluster may collect actual traffic data within the first cluster, and then determine a difference between the actual traffic data and the predicted traffic data in the first cluster.

[0142] In some embodiments, the preset threshold may be determined by a user, which will not be described in detail here.

[0143] In some embodiments, alerting may include alerting a monitoring center.

[0144] The monitoring method provided by the embodiments of the present disclosure obtains status data and basic information data of network devices in the first cluster, determines the first metadata based on the status data, basic information data and semantic embedding model, performs differential processing on the first metadata and the second metadata to obtain a differential result, and uploads the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0145] Figure 5 A schematic diagram of another monitoring method flow in an embodiment of the present disclosure is shown. Figure 5 As shown, the method may include:

[0146] S510, obtaining status data and basic information data of network devices in the first cluster;

[0147] S520, determining first metadata according to the state data, the basic information data, and the semantic embedding model;

[0148] S530, performing differential processing on the first metadata and the second metadata to obtain a differential result, where the second metadata is determined by the second cluster;

[0149] S540, determining the first metadata and the second metadata that are different based on the difference result;

[0150] S550, determining the proportion of the first metadata and the second metadata that have differences in the first metadata and the second metadata;

[0151] S560: When the ratio exceeds a second preset threshold, an alarm is issued.

[0152] In some embodiments, the second preset threshold may include a threshold determined independently by the user, which is not specifically limited in the present disclosure.

[0153] The monitoring method provided by the embodiments of the present disclosure obtains status data and basic information data of network devices in the first cluster, determines the first metadata based on the status data, basic information data and semantic embedding model, performs differential processing on the first metadata and the second metadata to obtain a differential result, and uploads the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0154] Based on the same inventive concept, the present disclosure also provides a monitoring method, such as the following embodiment. Since the principle of solving the problem in the method embodiment is similar to that in the above method embodiment, the implementation of the method embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0155] Figure 6 A flow chart of another monitoring method in an embodiment of the present disclosure is shown. It should be noted that the monitoring method in the present disclosure is applied to a monitoring center.

[0156] like Figure 6 As shown, the method may include:

[0157] S610, receiving a differential result, where the differential result is obtained by performing differential processing on first metadata and second metadata, where the first metadata is determined by a first cluster, and the second metadata is determined by a second cluster;

[0158] S620, training the teacher model based on the differential result;

[0159] S630, after the teacher model training is completed, distilling the small model based on the trained teacher model;

[0160] S640: Send the small model to the first cluster, so that the small model monitors the first cluster.

[0161] The monitoring method provided by the embodiments of the present disclosure obtains status data and basic information data of network devices in the first cluster, determines the first metadata based on the status data, basic information data and semantic embedding model, performs differential processing on the first metadata and the second metadata to obtain a differential result, and uploads the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0162] Based on the same inventive concept, the present disclosure also provides a monitoring device, such as the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0163] Figure 7 A schematic diagram of the structure of a monitoring device in an embodiment of the present disclosure is shown. It should be noted that the device is applied to the first cluster. The device 700 includes:

[0164] A determination module 701, configured to determine first metadata;

[0165] A differential module 702 is used to perform differential processing on the first metadata and the second metadata to obtain a differential result, where the second metadata is determined by the second cluster;

[0166] The uploading module 703 is used to upload the differential result to the monitoring center so that the monitoring center can train the teacher model based on the differential result, and distill the small model after the teacher model training is completed;

[0167] A first receiving module 704, used to receive a small model;

[0168] The monitoring module 705 is used to monitor the first cluster based on the small model.

[0169] The monitoring device provided by the embodiments of the present disclosure obtains status data and basic information data of network devices in the first cluster, determines the first metadata according to the status data, the basic information data and the semantic embedding model, performs differential processing on the first metadata and the second metadata to obtain a differential result, and uploads the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0170] In one embodiment of the present disclosure, the determination module includes:

[0171] An acquisition unit, used to acquire status data and basic information data of network devices in the first cluster;

[0172] The determining unit is used to determine the first metadata according to the state data, the basic information data and the semantic embedding model.

[0173] In one embodiment of the present disclosure, the determination module includes:

[0174] A first input subunit, used for inputting state data into a semantic embedding model to obtain semantic feature data;

[0175] A determination subunit is used to determine the semantic feature data and the basic information data as metadata.

[0176] In one embodiment of the present disclosure, the differential module includes:

[0177] A normalization unit, used for normalizing the first metadata and the second metadata so that the normalized first metadata and the second metadata are within the same preset range;

[0178] The difference unit is used to perform difference processing on the first metadata and the second metadata within the same preset range to obtain a difference result.

[0179] In one embodiment of the present disclosure, the monitoring module includes:

[0180] The second input unit is used to input the metadata into the small model to obtain the predicted traffic data;

[0181] The alarm unit is used to issue an alarm when the difference between the predicted traffic data and the actual traffic data in the first cluster is greater than a first preset threshold.

[0182] In one embodiment of the present disclosure, the device further includes:

[0183] A second determining module, configured to determine the first metadata and the second metadata that are different based on the difference result;

[0184] A third determination module is used to determine the proportion of the first metadata and the second metadata that have differences in the first metadata and the second metadata;

[0185] The second alarm module is used to issue an alarm when the ratio exceeds a second preset threshold.

[0186] The monitoring device provided by the embodiments of the present disclosure obtains status data and basic information data of network devices in the first cluster, determines the first metadata according to the status data, the basic information data and the semantic embedding model, performs differential processing on the first metadata and the second metadata to obtain a differential result, and uploads the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0187] Based on the same inventive concept, the present disclosure also provides a monitoring device, such as the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0188] Figure 8 A schematic diagram of the structure of a monitoring device in an embodiment of the present disclosure is shown. It should be noted that the device is applied to a monitoring center. The device 800 includes:

[0189] The second receiving module 801 is used to receive a differential result, where the differential result is obtained by performing differential processing on the first metadata and the second metadata, where the first metadata is determined by the first cluster and the second metadata is determined by the second cluster;

[0190] A training module 802, for training a teacher model based on the differential results;

[0191] A distillation module 803 is used to distill a small model based on the trained teacher model after the teacher model training is completed;

[0192] The sending module 804 is used to send the small model to the first cluster so that the small model monitors the first cluster.

[0193] The monitoring device provided by the embodiments of the present disclosure obtains status data and basic information data of network devices in the first cluster, determines the first metadata according to the status data, the basic information data and the semantic embedding model, performs differential processing on the first metadata and the second metadata to obtain a differential result, and uploads the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result. After the teacher model training is completed, the small model is distilled out, and the first cluster is monitored based on the small model, thereby realizing the monitoring of the devices in the cluster.

[0194] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0195] Refer to the following Fig. 9 The electronic device 900 according to this embodiment of the present disclosure is described. Fig. 9 The electronic device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0196] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0197] The storage unit stores program codes, which can be executed by the processing unit 910, so that the processing unit 910 performs the steps of various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 910 can perform the following steps of the above method embodiment:

[0198] Obtaining status data and basic information data of network devices in the first cluster;

[0199] Determine first metadata according to the state data, the basic information data, and the semantic embedding model;

[0200] performing differential processing on the first metadata and the second metadata to obtain a differential result, wherein the second metadata is determined by the second cluster;

[0201] Upload the difference results to the monitoring center so that the monitoring center can train the teacher model based on the difference results. After the teacher model training is completed, distill the small model;

[0202] Receive small models;

[0203] The first cluster is monitored based on the small model.

[0204] Alternatively, receiving a differential result, where the differential result is obtained by performing differential processing on the first metadata and the second metadata, where the first metadata is determined by the first cluster and the second metadata is determined by the second cluster;

[0205] Train the teacher model based on the difference results;

[0206] After the teacher model is trained, the small model is distilled based on the trained teacher model;

[0207] The small model is sent to the first cluster, so that the small model monitors the first cluster.

[0208] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0209] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0210] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0211] The electronic device 900 may also process images with one or more external devices 940 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also process images with one or more devices that enable users to interact with the electronic device 900, and / or may process images with any device that enables the electronic device 900 to process images with one or more other computing devices (e.g., routers, modems, etc.). Such image processing may be performed through an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also process images with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 960. As shown, the network adapter 960 processes images with other modules of the electronic device 900 through a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0212] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0213] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0214] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0215] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0216] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0217] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0218] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0219] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0220] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0221] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A monitoring method, It is characterized in that Applied to the first cluster, including: determining first metadata; performing differential processing on the first metadata and the second metadata to obtain a differential result, wherein the second metadata is determined by the second cluster; Uploading the differential result to the monitoring center so that the monitoring center trains the teacher model based on the differential result, and after the teacher model training is completed, distilling out the small model; receiving the small model; The first cluster is monitored based on the small model.

2. The monitoring method according to claim 1, It is characterized in that The determining the first metadata comprises: Acquire status data and basic information data of network devices in the first cluster; The first metadata is determined according to the state data, the basic information data and the semantic embedding model.

3. The monitoring method according to claim 2, It is characterized in that The determining the first metadata according to the state data, the basic information data and the semantic embedding model includes: Inputting the state data into a semantic embedding model to obtain semantic feature data; The semantic feature data and the basic information data are determined as metadata.

4. The monitoring method according to claim 1, It is characterized in that The step of performing differential processing on the first metadata and the second metadata to obtain a differential result includes: Normalizing the first metadata and the second metadata so that the normalized first metadata and the second metadata are within the same preset range; The first metadata and the second metadata within the same preset range are subjected to differential processing to obtain a differential result.

5. The monitoring method according to claim 1, It is characterized in that The monitoring of the first cluster based on the small model includes: Inputting the metadata into the small model to obtain predicted traffic data; When the difference between the predicted traffic data and the actual traffic data in the first cluster is greater than a first preset threshold, an alarm is issued.

6. The monitoring method according to claim 1, It is characterized in that The method further comprises: Determine the first metadata and the second metadata that are different based on the difference result; Determine the proportion of the first metadata and the second metadata that have differences in the first metadata and the second metadata; When the ratio exceeds a second preset threshold, an alarm is issued.

7. A monitoring method, It is characterized in that Applied to monitoring centers, including: receiving a differential result, where the differential result is obtained by performing differential processing on the first metadata and the second metadata, where the first metadata is determined by the first cluster and the second metadata is determined by the second cluster; Training the teacher model based on the differential result; After the teacher model is trained, the small model is distilled based on the trained teacher model; The small model is sent to the first cluster, so that the small model monitors the first cluster.

8. A monitoring device, It is characterized in that Applied to the first cluster, including: A determination module, configured to determine first metadata; a differential module, configured to perform differential processing on the first metadata and the second metadata to obtain a differential result, wherein the second metadata is determined by the second cluster; An uploading module, used for uploading the differential result to a monitoring center, so that the monitoring center trains the teacher model based on the differential result, and distills out a small model after the teacher model training is completed; A first receiving module, used for receiving the small model; A monitoring module is used to monitor the first cluster based on the small model.

9. A monitoring device, It is characterized in that Applied to monitoring centers, including: A second receiving module is used to receive a differential result, where the differential result is obtained by performing differential processing on the first metadata and the second metadata, where the first metadata is determined by the first cluster and the second metadata is determined by the second cluster; A training module, used for training the teacher model based on the differential result; The distillation module is used to distill small models based on the trained teacher model after the teacher model training is completed; A sending module is used to send the small model to the first cluster, so that the small model monitors the first cluster.

10. An electronic device, It is characterized in that include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the monitoring method according to any one of claims 1 to 7 by executing the executable instructions.

11. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, the monitoring method according to any one of claims 1 to 7 is implemented.

Images