Database monitoring method and device, computer equipment and storage medium

Abstract

The invention discloses a database monitoring method and device, computer equipment and a storage medium, and belongs to the technical field of big data. According to the method, the historical monitoring data flow is collected, time window segmentation processing is applied, the spatial clustering algorithm is combined to identify potential abnormal points in the data subsets, then the database abnormal state prediction model based on time sequence prediction and abnormal marking is trained, the model can receive the monitoring instruction in real time, the current database data flow is analyzed, and the database abnormal state prediction efficiency is improved. And predicting and monitoring an abnormal state of the database. The invention further relates to the technical field of block chains, and the monitoring data stream is stored on the block chain node. According to the method, the accuracy and the efficiency of database monitoring are improved, early warning of potential problems is realized, the database fault risk and the operation and maintenance cost are effectively reduced, the stability and the safety of database operation are ensured through intelligent anomaly detection and prediction, and a solid guarantee is provided for database management and application.

Description

Technical Field

[0001] The present application belongs to the field of big data technology, and specifically relates to a database monitoring method, device, computer equipment and storage medium. Background Art

[0002] Database exception monitoring is a key link in ensuring the stable operation of the database. It monitors the database operation status in real time, identifies and responds to abnormal situations such as performance bottlenecks, connection failures, SQL errors, etc., and uses alarm notifications to promptly inform administrators so that solutions can be taken quickly to ensure business continuity and data security.

[0003] At present, the implementation of database anomaly monitoring mainly relies on diversified technical means such as log analysis and performance monitoring tools. Log analysis can capture every detail of database operations through detailed log records, providing important clues for anomaly diagnosis. However, with the expansion of database scale, the amount of logs has also increased dramatically, which has brought great challenges to the efficient processing and analysis of logs, which may lead to missed detection or delayed response of key anomalies. On the other hand, performance monitoring tools can timely discover potential performance bottlenecks or abnormal behaviors by monitoring various performance indicators of the database in real time. However, the configuration of such tools is often more complicated, and due to the setting of monitoring rules, there may be omissions in reporting of certain abnormal situations. Therefore, the current database anomaly monitoring has the defect that it is difficult to meet the log processing efficiency and the comprehensiveness of monitoring rules at the same time, which may lead to omissions or delays in anomaly detection. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a database monitoring method, apparatus, computer equipment and storage medium to solve the technical problem that the current database anomaly monitoring has the problem of difficulty in simultaneously satisfying the log processing efficiency and the comprehensiveness of the monitoring rules, which may lead to omissions or delays in anomaly detection.

[0005] In order to solve the above technical problems, the present application embodiment provides a database monitoring method, which adopts the following technical solution:

[0006] A database monitoring method, comprising:

[0007] Obtaining a historical monitoring data stream of a database, wherein the historical monitoring data stream is a data set carrying time series characteristics;

[0008] Use predefined time windows to segment historical monitoring data streams to obtain several data subsets;

[0009] Use spatial clustering algorithms to perform clustering operations on several data subsets, and determine potential outliers in each data subset based on the clustering operation results;

[0010] Mark the potential outliers in each data subset to obtain data anomaly marking results;

[0011] Anomaly state prediction model based on time series prediction algorithm and data anomaly labeling result training database;

[0012] Receive database monitoring instructions, obtain real-time monitoring data streams of the database, generate abnormal state prediction results of the database based on the real-time monitoring data streams and abnormal state prediction models, and monitor the status of the database based on the abnormal state prediction results.

[0013] Furthermore, the historical monitoring data stream is a multi-dimensional indicator data stream. A spatial clustering algorithm is used to perform clustering operations on several data subsets, and potential abnormal points in each data subset are determined based on the clustering operation results, including:

[0014] Map each data subset into a multidimensional indicator space, and determine the data points corresponding to each data subset in the multidimensional indicator space;

[0015] A density-based spatial clustering algorithm is used to perform cluster analysis on data points in the multidimensional indicator space to form clusters in the multidimensional indicator space.

[0016] Calculate the nearest neighbor distance distribution between clusters, and determine the cluster radius threshold based on the nearest neighbor distance distribution;

[0017] The cluster sparse area is determined based on the cluster radius threshold, and the potential outliers in each data subset are determined through the cluster sparse area.

[0018] Furthermore, a density-based spatial clustering algorithm is used to perform cluster analysis on the data points in the multidimensional indicator space to form clusters in the multidimensional indicator space, specifically including:

[0019] In the multidimensional index space, calculate the index value of each data point in each dimension and obtain the coordinates of each data point;

[0020] Using the preset neighborhood radius parameter and the coordinates of each data point, the number of data points in the neighborhood is counted to obtain the density value of each data point;

[0021] Determine whether the density value of each data point is greater than or equal to a preset minimum data point density threshold;

[0022] If the density value of a data point is greater than or equal to the minimum data point density threshold, the data point is marked as a core point, otherwise, the data point is marked as a non-core point;

[0023] Determine whether the non-core point is within the neighborhood of the core point;

[0024] If a non-core point is within the neighborhood of a core point, the non-core point is marked as a boundary point, and the connectivity between the boundary point and the core point is recorded;

[0025] Construct clusters based on core points, boundary points and connectivity relationships.

[0026] Furthermore, the nearest neighbor distance distribution between clusters is calculated, and the cluster radius threshold is determined based on the nearest neighbor distance distribution, specifically including:

[0027] Obtain the nearest neighbor distances between each cluster, and construct a nearest neighbor distance matrix based on the nearest neighbor distances between each cluster;

[0028] Calculate the nearest neighbor distance distribution between clusters based on the nearest neighbor distance matrix;

[0029] The peak of the nearest neighbor distance distribution is determined and the peak of the nearest neighbor distance distribution is determined as the clustering radius threshold.

[0030] Furthermore, the cluster sparse area is determined based on the cluster radius threshold, and the potential outliers in each data subset are determined through the cluster sparse area, specifically including:

[0031] Calculate the density distribution of clusters in multidimensional indicator space;

[0032] Based on the density distribution of clusters, the key clusters are identified, and the area with the key cluster as the center and the cluster radius threshold as the radius is taken as the key area of ​​the cluster;

[0033] The area outside the key area of ​​the cluster in the multidimensional index space is regarded as the sparse area of ​​the cluster;

[0034] Identify data points in sparse regions of clusters and treat them as potential outliers.

[0035] Furthermore, the abnormal state prediction model of the training database based on the time series prediction algorithm and the data anomaly marking results includes:

[0036] Constructing a training data set, wherein the training data set includes a data subset carrying anomaly labels and a data subset not carrying anomaly labels;

[0037] Weights are assigned to data subsets in the training data set, and features are extracted from the training data set after weight assignment to obtain training data features;

[0038] The initial prediction model is constructed using a long short-term memory network. The dependency relationship in the training data features is learned through the initial prediction model, and the initial prediction results are output.

[0039] The initial prediction model is iterated using the back propagation algorithm or the stochastic gradient descent method combined with the initial prediction results until the model is fitted to obtain the abnormal state prediction model.

[0040] Furthermore, weights are assigned to the data subsets in the training data set, and features are extracted from the training data set after weight assignment to obtain training data features, specifically including:

[0041] The anomaly detection model is constructed using the support vector machine algorithm;

[0042] Importing the training data set into the anomaly detection model to obtain the data point anomaly detection results of each data subset, wherein the data point anomaly detection results include normal data points and abnormal data points;

[0043] Based on the data point anomaly detection result of each data subset, weights are assigned to the data subsets, wherein a first weight is assigned to normal data points, and a second weight is assigned to abnormal data points, and the second weight is greater than the first weight;

[0044] The training data set after weight allocation is vectorized to obtain a training data feature vector, and the training data features are extracted from the training data feature vector.

[0045] In order to solve the above technical problems, the embodiment of the present application also provides a database monitoring device, which adopts the following technical solution:

[0046] A database monitoring device, comprising:

[0047] A data acquisition module is used to acquire the historical monitoring data stream of the database, wherein the historical monitoring data stream is a data set carrying time series characteristics;

[0048] The data segmentation module is used to segment the historical monitoring data stream using a predefined time window to obtain several data subsets;

[0049] A clustering operation module, used to perform clustering operations on several data subsets using a spatial clustering algorithm, and determine potential outliers in each data subset based on the clustering operation results;

[0050] The anomaly marking module is used to mark potential anomalies in each data subset and obtain data anomaly marking results;

[0051] Model training module, used to train the abnormal state prediction model of the database based on the time series prediction algorithm and data anomaly marking results;

[0052] The state prediction module is used to receive database monitoring instructions, obtain the real-time monitoring data stream of the database, generate abnormal state prediction results of the database based on the real-time monitoring data stream and the abnormal state prediction model, and monitor the state of the database based on the abnormal state prediction results.

[0053] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0054] A computer device comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of any one of the above-mentioned database monitoring methods when executing the computer-readable instructions.

[0055] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0056] A computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the database monitoring method described in any one of the above are implemented.

[0057] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0058] The present application discloses a database monitoring method, device, computer equipment and storage medium, which belongs to the field of big data technology. The present application collects historical monitoring data streams and applies time window segmentation processing, combines spatial clustering algorithms to identify potential anomalies in data subsets, and then trains a database abnormal state prediction model based on time series prediction and abnormal labeling. The model can receive monitoring instructions in real time, analyze the current database data stream, and predict and monitor the abnormal state of the database. The present application not only improves the accuracy and efficiency of database monitoring, but also realizes early warning of potential problems, effectively reduces the risk of database failure and operation and maintenance costs, and ensures the stability and security of database operation through intelligent anomaly detection and prediction, providing a solid guarantee for database management and application. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0060] Figure 1 An exemplary system architecture diagram is shown in which the present application can be applied;

[0061] Figure 2 A flowchart of an embodiment of a database monitoring method according to the present application is shown;

[0062] Figure 3 A schematic diagram showing the structure of an embodiment of a database monitoring device according to the present application is shown;

[0063] Figure 4 A schematic structural diagram of an embodiment of a computer device according to the present application is shown. DETAILED DESCRIPTION

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0065] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0066] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0067] like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0068] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0069] Terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers, desktop computers, etc.

[0070] Server 105 can be a server that provides various services, such as a background server that provides support for pages displayed on terminal devices 101, 102, and 103. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (CDNs), and big data and artificial intelligence platforms.

[0071] It should be noted that the database monitoring method provided in the embodiment of the present application is generally executed by a server, and accordingly, the database monitoring device is generally set in the server.

[0072] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0073] Continue to refer Figure 2 , shows a flow chart of an embodiment of the database monitoring method according to the present application. The embodiment of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0074] The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning. The database monitoring method includes the following steps:

[0075] S201, obtaining a historical monitoring data stream from a database, wherein the historical monitoring data stream is a data set carrying time series characteristics.

[0076] Specifically, the system collects historical monitoring data streams of the database. These data streams not only contain a comprehensive record of the database's operating status, but also contain rich time series features, such as active session data. In the context of databases and Web applications, active session data refers to the data generated by a series of ongoing interactive activities established between users and servers over a period of time. These data are usually used to track and record user authentication, activity status, preference settings, and temporary data storage. Collecting and analyzing the database's active session data to obtain its fluctuation trends, periodic change indicators, etc., these indicators are the basis for subsequent analysis and are crucial for accurately identifying database anomalies and building prediction models.

[0077] In a specific embodiment of the present application, the session data can be collected by the automatic task tool to form a historical monitoring data stream and store the data stream. The tool comes with the following scheduled tasks, which are described in detail as follows:

[0078] Scheduled task A starts to collect relevant indicators of all currently active sessions at a fixed frequency (default 1s, parameter can be changed), and stores the indicators into memory in the form of one record per session.

[0079] Scheduled task B collects the data in memory of scheduled task A at a fixed frequency (10s by default, and the parameters can be changed), persists it in the DB, and forms a historical session data stream.

[0080] Scheduled task C cleans up expired data in the DB at a fixed frequency (30 minutes by default, and the parameters can be changed) (only 3 days of data are retained by default). The longer the retention time, the larger the data space required. Users can flexibly control the number of retention days according to their needs.

[0081] Through the above efficient scheduled task system, we continuously monitor and collect active database session data, capture and store its time series characteristics in real time, and regularly clean up expired data to keep the system running efficiently. These data not only comprehensively record the database operation status, but also effectively improve the intelligence level of database monitoring and operation and maintenance.

[0082] S202, using a predefined time window to perform data segmentation processing on the historical monitoring data stream to obtain a plurality of data subsets.

[0083] Specifically, after obtaining the continuous historical monitoring data stream, it is segmented using a predefined time window. This helps to cut the continuous data stream into data subsets that are easy to process and analyze. Each subset represents the state change of the database within a specific time period. The selection of the time window needs to comprehensively consider the timeliness of the data, analysis accuracy and computing efficiency to ensure the effectiveness and accuracy of subsequent clustering operations.

[0084] S203, performing clustering operations on several data subsets using a spatial clustering algorithm, and determining potential abnormal points in each data subset based on the clustering operation results.

[0085] Specifically, the spatial clustering algorithm is applied to the processed data subset in this step. Through clustering operations, the algorithm can automatically identify data points with similar characteristics in the data set and classify the data points into the same cluster. Based on the clustering results, the characteristics of each cluster can be further analyzed, especially those clusters that are significantly different from the overall data set, which often represent potential outliers.

[0086] S204, marking potential abnormal points in each data subset to obtain data abnormality marking results.

[0087] Specifically, after identifying potential anomalies, they need to be clearly marked. The marking of anomalies is not only a confirmation of the clustering results, but also one of the necessary input information for building an abnormal state prediction model. By marking anomalies, the model can learn the characteristic patterns of abnormal data, so as to accurately identify similar abnormal states in subsequent predictions. The marking process needs to ensure accuracy to avoid misjudging normal data as abnormal.

[0088] S205, training an abnormal state prediction model of the database based on the time series prediction algorithm and the data anomaly marking result.

[0089] Specifically, the time series prediction algorithm and data anomaly labeling results are used to train the abnormal state prediction model of the database. Through model training, the time series prediction algorithm can learn the complex relationship between data features and time series, as well as the association between abnormal states and these features. The training process requires continuous optimization of model parameters to improve the accuracy and robustness of the prediction. The trained model can be used for subsequent real-time monitoring and anomaly prediction.

[0090] S206, receiving a database monitoring instruction, obtaining a real-time monitoring data stream of the database, generating an abnormal state prediction result of the database based on the real-time monitoring data stream and an abnormal state prediction model, and performing status monitoring on the database based on the abnormal state prediction result.

[0091] Specifically, the trained abnormal state prediction model is applied to the real-time monitoring scenario of database abnormal state. When receiving the monitoring instruction, the system will obtain the monitoring data stream of the database in real time and input it into the abnormal state prediction model. The abnormal state prediction model generates abnormal state prediction results based on real-time data, providing database administrators with timely abnormal warnings. Based on the prediction results, the database status can be monitored, potential problems can be discovered and handled in a timely manner, and the stable operation of the database can be ensured, realizing closed-loop management from data collection to abnormal prediction, and improving the intelligent level of database operation and maintenance.

[0092] In the above embodiments, the present application not only improves the accuracy and efficiency of database monitoring, but also realizes early warning of potential problems, effectively reduces the risk of database failure and operation and maintenance costs, ensures the stability and security of database operation through intelligent anomaly detection and prediction, and provides solid protection for database management and application.

[0093] Furthermore, the historical monitoring data stream is a multi-dimensional indicator data stream. A spatial clustering algorithm is used to perform clustering operations on several data subsets, and potential abnormal points in each data subset are determined based on the clustering operation results, including:

[0094] Map each data subset into a multidimensional indicator space, and determine the data points corresponding to each data subset in the multidimensional indicator space;

[0095] A density-based spatial clustering algorithm is used to perform cluster analysis on data points in the multidimensional indicator space to form clusters in the multidimensional indicator space.

[0096] Calculate the nearest neighbor distance distribution between clusters, and determine the cluster radius threshold based on the nearest neighbor distance distribution;

[0097] The cluster sparse area is determined based on the cluster radius threshold, and the potential outliers in each data subset are determined through the cluster sparse area.

[0098] In this embodiment, a spatial clustering algorithm is used to detect anomalies in the historical monitoring data of the multidimensional indicator data stream. First, each data subset is mapped to the multidimensional indicator space to form a corresponding set of data points. Subsequently, a density-based clustering algorithm is used to analyze these data points to form clusters in the multidimensional space. By calculating the nearest neighbor distance distribution between clusters, a reasonable clustering radius threshold is set to identify sparse areas in the clusters. These sparse areas are regarded as potential anomalies, thereby achieving accurate positioning of potential anomalies in each data subset.

[0099] The above steps determine the sparse areas of the cluster space through cluster analysis and nearest neighbor distance distribution, and identify the data points in the sparse areas as potential anomalies, which effectively improves the anomaly detection capability in multidimensional data monitoring and enhances the intelligent level of database management.

[0100] Furthermore, a density-based spatial clustering algorithm is used to perform cluster analysis on the data points in the multidimensional indicator space to form clusters in the multidimensional indicator space, specifically including:

[0101] In the multidimensional index space, calculate the index value of each data point in each dimension and obtain the coordinates of each data point;

[0102] Using the preset neighborhood radius parameter and the coordinates of each data point, the number of data points in the neighborhood is counted to obtain the density value of each data point;

[0103] Determine whether the density value of each data point is greater than or equal to a preset minimum data point density threshold;

[0104] If the density value of a data point is greater than or equal to the minimum data point density threshold, the data point is marked as a core point, otherwise, the data point is marked as a non-core point;

[0105] Determine whether the non-core point is within the neighborhood of the core point;

[0106] If a non-core point is within the neighborhood of a core point, the non-core point is marked as a boundary point, and the connectivity between the boundary point and the core point is recorded;

[0107] Construct clusters based on core points, boundary points and connectivity relationships.

[0108] In this embodiment, by using a density-based spatial clustering algorithm, an in-depth analysis is performed on the data points in the multidimensional indicator space, aiming to form a clear cluster structure. First, the precise coordinates of each data point in the multidimensional space are calculated. Then, the local density of each data point is evaluated using a preset neighborhood radius parameter, that is, the number of data points in its neighborhood is counted. By comparing the data point density with the preset minimum density threshold, the data points in the high-density area are marked as core points, and the data points in the low-density area are marked as non-core points. Further, by checking whether the non-core point is located in the neighborhood of the core point, if so, it is marked as a boundary point, and the connection path with the core point is recorded. Finally, based on the core points, boundary points and their mutual connectivity, the algorithm successfully constructs a cluster in the multidimensional space, providing strong support for data analysis and monitoring.

[0109] A multidimensional indicator space is a space composed of multiple dimensions (or indicators). In this space, each data point can be located and described by its indicator value in each dimension. The dimensions of a multidimensional indicator space can be attributes of physical space (such as length, width, height) or measurements of abstract concepts (such as time, temperature, pressure, cost, efficiency, etc.).

[0110] Density-based spatial clustering algorithms are a type of algorithm that discovers clusters through the density distribution of data points. The core idea of ​​this type of algorithm is to divide the data space into high-density areas and low-density areas, where high-density areas are considered clusters, while low-density areas may be noise or separations between different clusters, such as the DBSCAN algorithm.

[0111] In the DBSCAN algorithm, a point is called a core point if its r-neighborhood (i.e., the set of all points whose distance to the point does not exceed r) contains at least MinPts other data points. Here r is a parameter of the algorithm, indicating the radius of the neighborhood; MinPts is another parameter, indicating the minimum number of data points required in the neighborhood.

[0112] If a data point is in the r-neighborhood of a core point, but it is not a core point itself (i.e., the number of data points in its r-neighborhood is less than MinPts), then the point is called a border point. Border points are indirectly connected to other points through core points. Specifically, if a border point is in the r-neighborhood of a core point, then the point is considered to be part of the cluster to which the core point belongs. Since a cluster is composed of a core point and all its density-reachable points, a border point establishes connectivity with other points in the cluster through the core points connected to it.

[0113] The above steps use a density-based spatial clustering algorithm to accurately identify and cluster data points in a multidimensional index space, forming clusters consisting of core points, boundary points and their connectivity. This solution effectively copes with the complexity of multidimensional data, does not require a preset number of clusters, can automatically adapt to cluster structures of various shapes and densities, and can process noisy data, ensuring the accuracy and robustness of the clustering results.

[0114] Furthermore, the nearest neighbor distance distribution between clusters is calculated, and the cluster radius threshold is determined based on the nearest neighbor distance distribution, specifically including:

[0115] Obtain the nearest neighbor distances between each cluster, and construct a nearest neighbor distance matrix based on the nearest neighbor distances between each cluster;

[0116] Calculate the nearest neighbor distance distribution between clusters based on the nearest neighbor distance matrix;

[0117] The peak of the nearest neighbor distance distribution is determined and the peak of the nearest neighbor distance distribution is determined as the clustering radius threshold.

[0118] In this embodiment, a reasonable cluster radius threshold is determined by analyzing the distribution of the nearest neighbor distances between clusters. First, the minimum (i.e., nearest) distances between all clusters are calculated and collected to construct a nearest neighbor distance matrix, which fully reflects the proximity relationship between clusters. Subsequently, the distribution of the nearest neighbor distances between clusters is obtained by statistically analyzing the matrix. On this basis, the peak value of the distribution, i.e., the most frequently occurring nearest distance value, is identified and determined. Finally, this peak value is set as the cluster radius threshold to distinguish closely adjacent clusters from relatively separated clusters.

[0119] To calculate the nearest neighbor distance distribution between clusters based on the nearest neighbor distance matrix, we first need to construct a distance matrix in which the elements represent the minimum distance between clusters. Then, we count the frequency of different distance values ​​and draw a distance distribution graph. For example, if there are multiple numbers "10" in the matrix, indicating that the minimum distance between different clusters is 10, the frequency of the distance value "10" increases. By analyzing the distribution graph, we can identify which distance values ​​appear more frequently, thereby determining the closeness between clusters and the potential cluster radius threshold.

[0120] The above steps calculate the nearest neighbor distance distribution between clusters, construct a distance matrix and identify its peak, thereby determining a cluster radius threshold. This threshold can effectively distinguish between close and separated clusters, optimize the definition of cluster structure, and improve the accuracy and practicality of cluster analysis.

[0121] Furthermore, the cluster sparse area is determined based on the cluster radius threshold, and the potential outliers in each data subset are determined through the cluster sparse area, specifically including:

[0122] Calculate the density distribution of clusters in multidimensional indicator space;

[0123] Based on the density distribution of clusters, the key clusters are identified, and the area with the key cluster as the center and the cluster radius threshold as the radius is taken as the key area of ​​the cluster;

[0124] The area outside the key area of ​​the cluster in the multidimensional index space is regarded as the sparse area of ​​the cluster;

[0125] Identify data points in sparse regions of clusters and treat them as potential outliers.

[0126] In this embodiment, the sparse areas of clusters are identified by cluster radius thresholds, and then potential outliers are determined. First, the density distribution of clusters is calculated in the multidimensional indicator space to identify key clusters. Then, the key areas are delineated with these key clusters as the center using the previously determined cluster radius thresholds. In contrast, the space outside the key areas is defined as sparse areas, where the density of data points is low and contains abnormal or outlier data. Finally, the data points in the sparse areas are detected and marked as potential outliers.

[0127] Calculating the density distribution of clusters in a multidimensional index space usually involves counting the number of data points within each cluster in its neighborhood. Specifically, for each cluster, a suitable neighborhood radius is selected, and then the number of neighbors of each data point in the cluster within this radius is calculated to obtain the local density of the data point. By summarizing and analyzing the local density of all data points, the density distribution of the entire cluster can be obtained.

[0128] The key cluster regions refer to high-density regions around the key cluster center and bounded by the cluster radius threshold. These regions have densely clustered data points and high feature similarity, representing the core of the cluster. In contrast, the sparse cluster regions are low-density regions outside the key regions, where data points are scattered and contain points with large differences in characteristics from the main cluster, such as noise, outliers, or data points belonging to different categories. Analyzing these two types of regions helps to gain a deeper understanding of data distribution, optimize clustering effects, and identify potential abnormal patterns.

[0129] The above steps define the key and sparse areas of the cluster clusters through the cluster radius threshold, effectively identify and separate the data points in the sparse areas as potential outliers, provide precise positioning for subsequent analysis such as data cleaning and anomaly detection, and improve the accuracy and efficiency of data processing.

[0130] Furthermore, the abnormal state prediction model of the training database based on the time series prediction algorithm and the data anomaly marking results includes:

[0131] Constructing a training data set, wherein the training data set includes a data subset carrying anomaly labels and a data subset not carrying anomaly labels;

[0132] Weights are assigned to data subsets in the training data set, and features are extracted from the training data set after weight assignment to obtain training data features;

[0133] The initial prediction model is constructed using a long short-term memory network. The dependency relationship in the training data features is learned through the initial prediction model, and the initial prediction results are output.

[0134] The initial prediction model is iterated using the back propagation algorithm or the stochastic gradient descent method combined with the initial prediction results until the model is fitted to obtain the abnormal state prediction model.

[0135] In this embodiment, a model that can accurately predict the abnormal state of the database is trained through the time series prediction algorithm and the data anomaly labeling results. First, a training set containing labeled anomalies and unlabeled data is constructed, and weights are assigned to the data subsets in the training data set, and features are extracted from the training data set after the weight assignment to obtain the training data features. Subsequently, the initial prediction model is constructed using a long short-term memory network (LSTM) to capture the temporal dependencies in the data features and generate preliminary predictions. Next, the model parameters are continuously optimized using back propagation or stochastic gradient descent until the model accurately fits the training data, and finally an efficient and accurate abnormal state prediction model is obtained.

[0136] In this step, the long short-term memory network (LSTM) is carefully constructed as the core of the initial prediction model to deeply explore the complex dependencies in the training data features. LSTM effectively handles long-term dependencies and short-term fluctuations in time series data through its unique gating mechanism (forget gate, input gate, output gate). The model gradually learns and understands the interactions and evolution laws between features, such as trends, periodicity, and mutation points, and thus generates initial prediction results that include these dependencies.

[0137] The above steps build a model that can accurately predict the abnormal state of the database by integrating the time series prediction algorithm and the abnormal labeling data. By optimizing weight distribution, feature extraction and LSTM model training, the model effectively captures the complex dependencies between data features, and after multiple iterations of optimization, it reaches the best fit state, and finally obtains an efficient and accurate abnormal state prediction model.

[0138] Furthermore, weights are assigned to the data subsets in the training data set, and features are extracted from the training data set after weight assignment to obtain training data features, specifically including:

[0139] The anomaly detection model is constructed using the support vector machine algorithm;

[0140] Importing the training data set into the anomaly detection model to obtain the data point anomaly detection results of each data subset, wherein the data point anomaly detection results include normal data points and abnormal data points;

[0141] Based on the data point anomaly detection result of each data subset, weights are assigned to the data subsets, wherein a first weight is assigned to normal data points, and a second weight is assigned to abnormal data points, and the second weight is greater than the first weight;

[0142] The training data set after weight allocation is vectorized to obtain a training data feature vector, and the training data features are extracted from the training data feature vector.

[0143] In this embodiment, in the training data preprocessing stage, the support vector machine algorithm is first used to build an anomaly detection model to identify normal and abnormal data points in the training data set. Subsequently, based on the detection results, the data subsets are assigned differentiated weights, and abnormal data points are given higher weights to strengthen the model's focus on abnormal patterns. Next, the weighted training data set is vectorized and converted into a feature vector form for subsequent analysis. Finally, key training data features are extracted from these feature vectors to provide high-quality input data for the construction and training of the long short-term memory network model, thereby ensuring the accuracy and robustness of the abnormal state prediction model.

[0144] In this step, the training data set is fully imported into the constructed support vector machine anomaly detection model. The model uses the kernel function to map the input data to a high-dimensional feature space and finds an optimal hyperplane in this space to separate normal data points from abnormal data points with the maximum interval. By calculating the distance from each data point to the hyperplane, the model can determine the degree of abnormality of each data point and mark it as normal or abnormal accordingly, thereby achieving accurate anomaly detection of data points in each data subset in the training data set.

[0145] In this step, different weights are assigned to the data points in each data subset in the training dataset. Specifically, a relatively low first weight is assigned to data points that are judged to be normal, while a higher second weight is assigned to data points that are identified as abnormal to emphasize their importance in model training. For example, in a fraud detection scenario, normal transaction data may receive a weight of 0.8, while suspected fraudulent transaction data may be given a higher weight, such as 1.2, to ensure that the model can learn abnormal patterns more effectively.

[0146] The above steps strengthen the focus on abnormal patterns in the training data through support vector machine anomaly detection and differentiated weight allocation. Subsequently, the intrinsic characteristics of the weighted data set are effectively captured through vectorization processing and feature extraction, laying a solid foundation for building an efficient and accurate abnormal state prediction model, and improving the model's ability to identify and predict abnormal states of the database.

[0147] In this embodiment, the electronic device (eg, Figure 1 The server shown in the figure) can receive instructions or obtain data through a wired connection or a wireless connection. It should be noted that the above wireless connection method may include but is not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods currently known or to be developed in the future.

[0148] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned monitoring data stream, the above-mentioned monitoring data stream can also be stored in a blockchain node.

[0149] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0150] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the computer-readable instructions are executed, they can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0151] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0152] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a database monitoring device, and the device embodiment is Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0153] like Figure 3 As shown, the database monitoring device 300 described in this embodiment includes:

[0154] The data acquisition module 301 is used to acquire the historical monitoring data stream of the database, wherein the historical monitoring data stream is a data set carrying time series characteristics;

[0155] The data segmentation module 302 is used to perform data segmentation processing on the historical monitoring data stream using a predefined time window to obtain a plurality of data subsets;

[0156] A clustering operation module 303 is used to perform clustering operations on a plurality of data subsets using a spatial clustering algorithm, and determine potential abnormal points in each data subset based on the clustering operation results;

[0157] Anomaly marking module 304, used to mark potential abnormal points in each data subset to obtain data anomaly marking results;

[0158] A model training module 305 is used to train an abnormal state prediction model of a database based on a time series prediction algorithm and data abnormality marking results;

[0159] The state prediction module 306 is used to receive database monitoring instructions, obtain the real-time monitoring data stream of the database, generate abnormal state prediction results of the database based on the real-time monitoring data stream and the abnormal state prediction model, and perform state monitoring on the database based on the abnormal state prediction results.

[0160] Furthermore, the historical monitoring data stream is a multi-dimensional indicator data stream, and the clustering operation module 303 specifically includes:

[0161] A data mapping unit, used to map each data subset into a multidimensional indicator space, and determine a data point corresponding to each data subset in the multidimensional indicator space;

[0162] A cluster analysis unit, used to perform cluster analysis on data points in the multidimensional indicator space by using a density-based spatial clustering algorithm to form clusters in the multidimensional indicator space;

[0163] A clustering radius determination unit, used to calculate the nearest neighbor distance distribution between clusters, and determine the clustering radius threshold based on the nearest neighbor distance distribution;

[0164] The outlier identification unit is used to determine the cluster sparse area based on the cluster radius threshold, and determine the potential outliers in each data subset through the cluster sparse area.

[0165] Furthermore, the cluster analysis unit specifically includes:

[0166] The coordinate acquisition subunit is used to calculate the index value of each data point in each dimension in the multi-dimensional index space to obtain the coordinates of each data point;

[0167] The density value calculation subunit is used to use a preset neighborhood radius parameter and the coordinates of each data point to count the number of data points in the neighborhood and obtain the density value of each data point;

[0168] The density comparison subunit is used to determine whether the density value of each data point is greater than or equal to a preset minimum data point density threshold;

[0169] A core point marking subunit is used to mark a data point as a core point when the density value of the data point is greater than or equal to the minimum data point density threshold, otherwise, mark the data point as a non-core point;

[0170] A neighborhood judgment subunit is used to judge whether a non-core point is within the neighborhood of a core point;

[0171] A boundary point marking subunit is used to mark a non-core point as a boundary point when the non-core point is in the neighborhood of the core point, and record the connectivity relationship between the boundary point and the core point;

[0172] The cluster building subunit is used to build clusters according to core points, boundary points and connectivity relationships.

[0173] Furthermore, the cluster radius determination unit specifically includes:

[0174] A distance matrix construction subunit is used to obtain the nearest neighbor distances between each clustering cluster, and to construct a nearest neighbor distance matrix based on the nearest neighbor distances between each clustering cluster;

[0175] A distance distribution construction subunit is used to calculate the nearest neighbor distance distribution between cluster clusters based on the nearest neighbor distance matrix;

[0176] The clustering radius determination subunit is used to determine the peak value of the nearest neighbor distance distribution, and determine the peak value of the nearest neighbor distance distribution as the clustering radius threshold.

[0177] Furthermore, the outlier identification unit specifically includes:

[0178] The density distribution subunit is used to calculate the density distribution of clusters in the multidimensional indicator space;

[0179] The key area identification subunit is used to identify the key clusters based on the density distribution of the clusters, and take the key cluster as the center and the area with the cluster radius threshold as the radius as the key area of ​​the cluster;

[0180] A sparse region identification subunit is used to identify the region outside the cluster key region in the multidimensional index space as the cluster sparse region;

[0181] The outlier identification subunit is used to identify data points in the sparse area of ​​the clusters and regard the data points in the sparse area of ​​the clusters as potential outliers.

[0182] Furthermore, the model training module 305 specifically includes:

[0183] A data set construction unit, used to construct a training data set, wherein the training data set includes a data subset carrying anomaly labels and a data subset not carrying anomaly labels;

[0184] A weight allocation unit is used to allocate weights to data subsets in the training data set, and to extract features from the training data set after the weight allocation is completed to obtain training data features;

[0185] A feature learning unit is used to construct an initial prediction model using a long short-term memory network, learn the dependencies in the training data features through the initial prediction model, and output the initial prediction results;

[0186] The model iteration unit is used to iterate the initial prediction model by using the back propagation algorithm or the stochastic gradient descent method in combination with the initial prediction results until the model is fitted to obtain the abnormal state prediction model.

[0187] Furthermore, the weight allocation unit specifically includes:

[0188] A detection model building subunit, used to build an anomaly detection model using a support vector machine algorithm;

[0189] An anomaly detection subunit is used to import the training data set into the anomaly detection model to obtain the data point anomaly detection results of each data subset, wherein the data point anomaly detection results include normal data points and abnormal data points;

[0190] A weight allocation subunit, configured to allocate weights to the data subsets based on the data point anomaly detection result of each data subset, wherein a first weight is allocated to normal data points and a second weight is allocated to abnormal data points, and the second weight is greater than the first weight;

[0191] The feature extraction subunit is used to vectorize the training data set after the weight allocation is completed, obtain the training data feature vector, and extract the training data features from the training data feature vector.

[0192] In the above embodiment, the present application discloses a database monitoring device, which belongs to the field of big data technology. The present application collects historical monitoring data streams and applies time window segmentation processing, combines spatial clustering algorithms to identify potential anomalies in data subsets, and then trains a database abnormal state prediction model based on time series prediction and abnormal labeling. The model can receive monitoring instructions in real time, analyze the current database data stream, and predict and monitor the abnormal state of the database. The present application not only improves the accuracy and efficiency of database monitoring, but also realizes early warning of potential problems, effectively reduces the risk of database failures and operation and maintenance costs, and ensures the stability and security of database operation through intelligent anomaly detection and prediction, providing solid protection for database management and application.

[0193] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0194] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), field-programmable gate arrays (Field-Programmab l eGate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0195] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0196] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of the database monitoring method, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0197] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run computer-readable instructions stored in the memory 41 or process data, such as computer-readable instructions for running the database monitoring method.

[0198] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0199] In the above embodiment, the present application discloses a computer device, which belongs to the field of big data technology. The present application collects historical monitoring data streams and applies time window segmentation processing, combines spatial clustering algorithms to identify potential anomalies in data subsets, and then trains a database abnormal state prediction model based on time series prediction and abnormal labeling. The model can receive monitoring instructions in real time, analyze the current database data stream, and predict and monitor the abnormal state of the database. The present application not only improves the accuracy and efficiency of database monitoring, but also realizes early warning of potential problems, effectively reduces the risk of database failures and operation and maintenance costs, and ensures the stability and security of database operation through intelligent anomaly detection and prediction, providing solid protection for database management and application.

[0200] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the database monitoring method as described above.

[0201] In the above embodiments, the present application discloses a computer-readable storage medium, which belongs to the field of big data technology. The present application collects historical monitoring data streams and applies time window segmentation processing, combines spatial clustering algorithms to identify potential anomalies in data subsets, and then trains a database abnormal state prediction model based on time series prediction and abnormal labeling. The model can receive monitoring instructions in real time, analyze the current database data stream, and predict and monitor the abnormal state of the database. The present application not only improves the accuracy and efficiency of database monitoring, but also realizes early warning of potential problems, effectively reduces the risk of database failures and operation and maintenance costs, and ensures the stability and security of database operation through intelligent anomaly detection and prediction, providing solid protection for database management and application.

[0202] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0203] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0204] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A database monitoring method, characterized in that: include: Acquire a historical monitoring data stream of a database, wherein the historical monitoring data stream is a data set carrying time series characteristics; Using a predefined time window to perform data segmentation processing on the historical monitoring data stream to obtain a plurality of data subsets; Using a spatial clustering algorithm to perform clustering operations on a plurality of data subsets, and determining potential outliers in each of the data subsets based on the clustering operation results; Marking potential abnormal points in each of the data subsets to obtain data abnormality marking results; An abnormal state prediction model of the database based on the time series prediction algorithm and the data abnormality marking result training; Receive a database monitoring instruction, obtain a real-time monitoring data stream of the database, generate an abnormal state prediction result of the database based on the real-time monitoring data stream and the abnormal state prediction model, and perform status monitoring on the database based on the abnormal state prediction result.

2. The database monitoring method according to claim 1, characterized in that: The historical monitoring data stream is a multi-dimensional indicator data stream. A spatial clustering algorithm is used to perform clustering operations on several data subsets, and potential abnormal points in each of the data subsets are determined based on the clustering operation results, specifically including: Mapping each of the data subsets into a multidimensional index space, and determining data points corresponding to each of the data subsets in the multidimensional index space; Using a density-based spatial clustering algorithm, cluster analysis is performed on the data points in the multidimensional indicator space to form clusters in the multidimensional indicator space; Calculating the nearest neighbor distance distribution between the clusters, and determining a cluster radius threshold based on the nearest neighbor distance distribution; A cluster sparse area is determined based on the cluster radius threshold, and a potential outlier in each of the data subsets is determined through the cluster sparse area.

3. The database monitoring method according to claim 2, characterized in that: Using a density-based spatial clustering algorithm to perform cluster analysis on the data points in the multidimensional indicator space to form clusters in the multidimensional indicator space specifically includes: In the multidimensional index space, the index value of each data point in each dimension is calculated to obtain the coordinates of each data point; Using the preset neighborhood radius parameter and the coordinates of each data point, the number of data points in the neighborhood is counted to obtain the density value of each data point; Determine whether the density value of each of the data points is greater than or equal to a preset minimum data point density threshold; If the density value of the data point is greater than or equal to the minimum data point density threshold, the data point is marked as a core point, otherwise, the data point is marked as a non-core point; Determine whether the non-core point is within the neighborhood of the core point; If the non-core point is within the neighborhood of the core point, the non-core point is marked as a boundary point, and the connectivity relationship between the boundary point and the core point is recorded; The cluster is constructed according to the core points, the boundary points and the connectivity relationship.

4. The database monitoring method according to claim 3, characterized in that: Calculating the nearest neighbor distance distribution between the clusters, and determining the cluster radius threshold based on the nearest neighbor distance distribution, specifically includes: Obtain the nearest neighbor distances between each cluster, and construct a nearest neighbor distance matrix based on the nearest neighbor distances between each cluster; Calculating the nearest neighbor distance distribution between the clusters based on the nearest neighbor distance matrix; A peak value of the nearest neighbor distance distribution is determined, and the peak value of the nearest neighbor distance distribution is determined as the clustering radius threshold.

5. The database monitoring method according to claim 2, characterized in that: Determining a cluster sparse area based on the cluster radius threshold, and determining a potential outlier in each of the data subsets through the cluster sparse area, specifically includes: Calculating the density distribution of the clusters in the multidimensional index space; Identify key clusters based on the density distribution of the clusters, and use the key cluster as the center and the area with the cluster radius threshold as the radius as the key area of ​​the cluster; Taking the area outside the cluster key area in the multidimensional index space as the cluster sparse area; Data points in the sparse region of the clusters are identified, and the data points in the sparse region of the clusters are used as the potential outliers.

6. The database monitoring method according to claim 2, characterized in that: The abnormal state prediction model of the database based on the time series prediction algorithm and the data abnormality marking result training includes: Constructing a training data set, wherein the training data set includes a data subset carrying anomaly labels and a data subset not carrying anomaly labels; Performing weight assignment on a data subset in the training data set, and performing feature extraction on the training data set after the weight assignment is completed to obtain training data features; An initial prediction model is constructed using a long short-term memory network, the dependency relationship in the training data features is learned through the initial prediction model, and an initial prediction result is output; The initial prediction model is iterated by using a back propagation algorithm or a stochastic gradient descent method in combination with the initial prediction result until the model is fitted, thereby obtaining the abnormal state prediction model.

7. The database monitoring method according to claim 6, characterized in that: The weights of the data subsets in the training data set are assigned, and the features of the training data set after the weight assignment are extracted to obtain the training data features, specifically including: The anomaly detection model is constructed using the support vector machine algorithm; Importing the training data set into the anomaly detection model to obtain a data point anomaly detection result for each of the data subsets, wherein the data point anomaly detection result includes normal data points and abnormal data points; Based on the data point anomaly detection result of each of the data subsets, weights are assigned to the data subsets, wherein a first weight is assigned to normal data points, and a second weight is assigned to abnormal data points, and the second weight is greater than the first weight; The training data set after weight allocation is vectorized to obtain a training data feature vector, and training data features are extracted from the training data feature vector.

8. A database monitoring device, characterized in that: include: A data acquisition module is used to acquire a historical monitoring data stream of a database, wherein the historical monitoring data stream is a data set carrying time series characteristics; A data segmentation module, used to perform data segmentation processing on the historical monitoring data stream using a predefined time window to obtain a plurality of data subsets; A clustering operation module, used to perform clustering operations on a plurality of data subsets using a spatial clustering algorithm, and determine potential abnormal points in each of the data subsets based on the clustering operation results; An anomaly marking module is used to mark potential anomalies in each of the data subsets to obtain data anomaly marking results; A model training module, used for training an abnormal state prediction model of a database based on a time series prediction algorithm and the data abnormality marking result; The state prediction module is used to receive database monitoring instructions, obtain the real-time monitoring data stream of the database, generate an abnormal state prediction result of the database based on the real-time monitoring data stream and the abnormal state prediction model, and perform state monitoring on the database based on the abnormal state prediction result.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the database monitoring method according to any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the database monitoring method according to any one of claims 1 to 7 are implemented.

Images