Abnormality detection method and device

Abstract

The invention provides an anomaly detection method and device, relates to the technical field of computers, and is used for improving the accuracy of anomaly detection and reducing the false alarm rate of abnormal data. The method comprises the following steps: obtaining index values of a target operation index of target equipment at different time points to obtain a plurality of target operation index values; determining an operation rule of the target operation indexes according to the multiple target operation index values; determining a target detection strategy based on the operation rule, and detecting each target operation index value based on the target detection strategy; the matching degree between the target detection strategy and the operation rule is greater than or equal to a preset threshold value.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to an anomaly detection method and device. Background Art

[0002] With the continuous increase in the number of cloud desktop users, it is becoming increasingly important to efficiently operate and maintain cloud desktops, to promptly and accurately detect abnormalities in various monitoring indicators of users' cloud desktops, and to provide professional technical support.

[0003] At present, the existing technology usually uses fixed thresholds to detect anomalies of various indicators of cloud desktops based on the experience of business experts. However, different users use cloud desktops in different ways, habits, and software, resulting in different operating indicator values ​​of cloud desktops for different users. Therefore, using the same threshold to detect cloud desktop indicators of different users usually leads to problems such as low anomaly detection accuracy or high false alarm rate. Summary of the invention

[0004] The present application provides an anomaly detection method and device for improving the accuracy of anomaly detection and reducing the false alarm rate of abnormal data.

[0005] In order to at least achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0006] In a first aspect, an anomaly detection method is provided, the method comprising: obtaining indicator values ​​of target operating indicators of a target device at different time points to obtain multiple target operating indicator values; determining an operating law of the target operating indicator based on the multiple target operating indicator values; determining a target detection strategy based on the operating law, and detecting each target operating indicator value based on the target detection strategy; the degree of matching between the target detection strategy and the operating law is greater than or equal to a preset threshold.

[0007] In a second aspect, a detection device is provided, which includes an acquisition unit, a determination unit and a detection unit; the acquisition unit is used to acquire the index value of the target operation index of the target device at different time points to obtain multiple target operation index values. The determination unit is used to determine the operation law of the target operation index according to the multiple target operation index values. The determination unit is also used to determine the target detection strategy based on the operation law. The detection unit is used to detect each target operation index value based on the target detection strategy; the matching degree between the target detection strategy and the operation law is greater than or equal to a preset threshold.

[0008] In a third aspect, an electronic device is provided, comprising: a processor and a memory for storing instructions executable by the processor; wherein the processor is configured to execute instructions so that the electronic device performs the abnormality detection method as described in the first aspect above.

[0009] In a fourth aspect, a computer-readable storage medium is provided, on which computer instructions are stored. When the computer instructions are executed on a computer, the computer executes the anomaly detection method of the first aspect described above.

[0010] In an embodiment of the present application, multiple target operation indicator values ​​are obtained by obtaining the indicator values ​​of the target operation indicator of the target device at different time points, and the operation law of the target operation indicator is determined according to the characteristics of these target operation indicator values. Furthermore, based on the operation law, the present application determines a target detection strategy whose degree of matching with the operation law is greater than or equal to a preset threshold, and detects each target operation indicator value based on the target detection strategy. In this way, different detection strategies are used for operation indicators with different operation laws. Compared with the single detection strategy with a fixed threshold set in the related art for indicator anomaly detection, the present application can use different detection strategies for data with different operation laws for detection, making data detection more targeted, thereby improving the accuracy of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solution in the present application, the drawings required for use in some embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only drawings of some embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0012] Figure 1 A schematic diagram of the structure of an anomaly detection system provided in some embodiments of the present application;

[0013] Figure 2 A schematic diagram of a detection scenario provided for some embodiments of the present application;

[0014] Figure 3 A flowchart of an anomaly detection method provided in some embodiments of the present application;

[0015] Figure 4 A schematic diagram of data collection provided for some embodiments of the present application;

[0016] Figure 5 A schematic diagram of a data preprocessing process provided for some embodiments of the present application;

[0017] Figure 6 A schematic diagram of time series data feature decomposition provided for some embodiments of the present application;

[0018] Figure 7 A schematic diagram of the structure of a detection device provided in some embodiments of the present application;

[0019] Figure 8A schematic diagram of the structure of an electronic device provided for some embodiments of the present application. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0021] In the description of the present application, unless otherwise specified, " / " means "or", for example, A / B can mean A or B. "And / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, "at least one" means one or more, and "plurality" means two or more. The words "first" and "second" do not limit the quantity and execution order, and the words "first" and "second" do not necessarily limit them to be different. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0022] It should be noted that, in this application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplarily" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

[0023] In the embodiment of the present application, "indication" may include direct indication and indirect indication. For example, taking the indication information in the following text as an example, the indication information may directly carry information A itself or its index to achieve the purpose of directly indicating information A. Alternatively, the indication information may also carry information B that is associated with information A, thereby achieving the purpose of indirectly indicating information A while indicating information B.

[0024] Driven by the wave of informatization, cloud computing and virtualization technologies continue to develop, cloud desktop technology continues to mature, and gradually become an important part of the next generation of information technology industry. Relevant departments have also successively issued support measures for "enterprises to go to the cloud" to encourage enterprises to accelerate the cloudification of Internet Technology (IT).

[0025] It should be noted that cloud desktop (Desktop as a Service, DaaS), also known as desktop virtualization and cloud computer, is a new model to replace traditional computers, providing computer desktop services to users based on cloud computing technology. This technology uses virtualization technology to store operating systems, user data, desktop applications, etc. in cloud data centers, which are managed uniformly by the data center. Users can connect to the remote desktop system through terminal clients and obtain resources on demand.

[0026] After adopting the cloud desktop, users no longer need to install a computer host. The central processing unit (CPU), memory, hard disk and other components contained in the host are all virtualized in the back-end server. Usually a single high-performance server can virtualize 1-50 virtual hosts. The mainstream front-end equipment is to use a thin client (a device similar to a TV set-top box) to connect the monitor and keyboard and mouse. After the user installs the client, he accesses the virtual machine host on the back-end server through a unique communication protocol to achieve interactive operations and achieve the same experience as the computer. At the same time, the cloud desktop not only supports the replacement of traditional computers, but also supports other smart devices such as mobile phones and tablets to access on the Internet. It is also the latest solution for mobile office.

[0027] The technical architectures that can be adopted by the cloud desktop in the embodiments of the present application include: Virtual Desktop Infrastructure (VDI), Virtual Operating System Infrastructure (VOI), and Intelligent Desktop Virtualization (IDV).

[0028] Cloud desktop can improve the work efficiency and flexibility of users, and has many advantages such as high efficiency, flexibility, security, reliability and cost saving. For example: 1. Easy to use. Users only need an Internet connection to access their cloud desktop anytime and anywhere, without worrying about device and location restrictions. 2. Safe and reliable. Cloud desktop stores user data and application resources on cloud servers, and can protect user data security through multiple security measures to avoid risks such as data loss and leakage. 3. Flexible expansion. The hardware resource configuration of cloud desktop can be flexibly expanded and elastically expanded according to user needs. Users can increase or decrease computing resources according to their needs, thereby improving resource utilization and flexibility. 4. Unified management. Cloud desktop can achieve unified management. Administrators can manage and maintain users' desktop environment and application resources through a centralized management platform, which improves management efficiency and convenience. 5. Cost saving. Cloud desktop can avoid the cost of users purchasing and maintaining local computers and servers and other hardware equipment, while also reducing software licenses and maintenance costs.

[0029] In recent years, scenarios such as working from home and remote working have increased the demand for cloud desktops, making cloud desktops widely used in multiple scenarios such as management departments, multimedia classrooms in universities, and communication operators. They have become a powerful tool for enterprise digital transformation and provide stable and efficient support for users' work and life. However, with the continuous increase in cloud desktop users, how to efficiently operate and maintain cloud desktops, timely and accurately detect abnormalities in various monitoring indicators of user cloud desktops, and provide professional technical support are becoming increasingly important.

[0030] In related technologies, indicator anomaly detection is usually performed by setting fixed thresholds or using statistical methods based on the experience of business experts. However, different users use cloud desktops in different ways, habits, and software, and their desktop CPU and other indicators have different levels and change trends. For the same user, the values ​​of different indicators on the desktop can be high or low, and the change patterns can also be cyclical or trendy. In addition, the changes before and after an abnormality occurs in a single indicator on the desktop and between multiple indicators are often intrinsically linked. Analyzing the isolated value of an indicator at a certain moment or using the same anomaly detection method for a single indicator separately usually leads to problems such as low anomaly detection accuracy or high false alarm rate, making it difficult to achieve satisfactory results.

[0031] The data of cloud desktop is uniformly managed and maintained by the background, which greatly facilitates the use and maintenance of users. However, with the increase in the number of users and the diversification of application scenarios, the data of cloud desktop has shown a geometric growth, which puts higher requirements on the background operation and maintenance personnel. It can be seen that the challenges currently faced by cloud desktop operation and maintenance are mainly: 1. Large amount of data. Cloud desktop operation and maintenance involves many system indicators in the desktop, including: CPU utilization, memory, disk, network delay, network packet loss, input / output (IO) reading and writing, bandwidth, etc. If the traditional manual method is used for anomaly detection, it will take a lot of time and manpower costs. 2. Multi-dimensional. The indicator data of cloud desktop usually has multi-dimensional characteristics, including time dimension, user dimension, application dimension, etc. If the traditional statistical method is used for anomaly detection, it is difficult to handle the characteristics of multi-dimensional data. 3. Multi-mode. The various indicator data in the user cloud desktop vary. Different usage scenarios and different users will lead to different indicator change patterns. If the same anomaly detection method is used, it is difficult to apply all indicators, resulting in low accuracy or high false positives. 4. Data imbalance. The indicator data of cloud desktops usually presents the characteristics of category imbalance, that is, the number of normal data is much larger than the number of abnormal data, which will cause traditional machine learning algorithms to perform poorly in anomaly detection. 5. High real-time requirements. The indicator anomaly detection of cloud desktops needs to be real-time and able to detect and handle abnormal situations in a timely manner, otherwise it will affect the user experience. 6. Model interpretability. The indicator anomaly detection of cloud desktops needs to have a certain model interpretability and be able to clearly explain the results of anomaly detection, otherwise it will affect the decision-making and processing of operation and maintenance personnel.

[0032] Based on the deficiencies in the above-mentioned related technologies, the anomaly detection method provided in the embodiment of the present application establishes time series indicators and performs data preprocessing according to the relevant operating data of the cloud desktop system, and then performs feature analysis on the preprocessed time series indicator data. Different types of feature time series indicators use different anomaly detection algorithms, so that different detection algorithms can be used for data with different features, making data detection more targeted, thereby improving the accuracy of cloud desktop anomaly detection.

[0033] The anomaly detection method provided by the embodiment of the present application is described in detail below in conjunction with the accompanying drawings. It should be noted that the embodiments of the present application can refer to each other, for example, the same or similar steps, method embodiments, system embodiments and device embodiments can refer to each other without limitation.

[0034] The anomaly detection method provided in this application can be applied to an anomaly detection system. Figure 1 A structural diagram of the anomaly detection system is shown in FIG. Figure 1As shown, the abnormality detection system 10 includes a detection device 11 and a device to be detected 12. The detection device 11 is connected to the device to be detected 12. The detection device 11 and the device to be detected 12 can be connected in a wired manner or in a wireless manner, which is not limited in the embodiment of the present application.

[0035] The detection device 11 can be any electronic device with a detection function. For example, the electronic device can be a server, a mobile phone, a tablet computer, a desktop, a laptop, a notebook computer, an ultra-mobile personal computer (UMPC), a handheld computer, a netbook, a personal digital assistant (PDA), a wearable electronic device, a smart watch, and the like. The present application does not specifically limit the specific form of the electronic device.

[0036] The device to be detected 12 can be a physical device or a virtual device. For example, the device to be detected 12 can be any one of a plurality of computer devices (also referred to as a target device). The device to be detected 12 can also be any virtual machine virtualized on a server, such as a cloud desktop.

[0037] Among them, the server can be a single server, or it can be a server cluster consisting of multiple servers. In some implementations, the server cluster can also be a distributed cluster. Optionally, the server can also be implemented on a cloud platform, for example, the cloud platform can include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an inter-cloud, and a multi-cloud, etc., or any combination thereof. The embodiments of the present application are not limited to this.

[0038] When the device to be detected 12 is a virtual machine on a server, the detection apparatus 11 may be the server itself.

[0039] The detection device 11 can be used to perform abnormality detection on the device to be detected 12. The specific detection process can refer to the abnormality detection method introduced in the following method embodiment, and will not be repeated here.

[0040] For example, Figure 2 As shown, the detection device 11 can perform abnormal detection on the cloud desktop system and notify the operation and maintenance personnel of the detection results. Among them, the detection device 11 includes a data acquisition module, a data processing module, a feature analysis module, an abnormal detection module and an alarm contact module. The functions of each logic module can be found in the introduction of the following method embodiment, which will not be repeated here.

[0041] It should be noted that the execution subject of the anomaly detection method provided in the embodiment of the present application may be the above-mentioned detection device 11. As mentioned above, the detection device 11 may be an electronic device with computing and processing functions such as a computer or a server. Optionally, the detection device 11 may also be a processor (such as a central processing unit (CPU)) in the aforementioned electronic device; or, the detection device 11 may also be an application (application, APP) with a detection function installed in the aforementioned electronic device; or, the detection device 11 may also be a functional module with a detection function in the aforementioned electronic device, etc. The embodiment of the present application does not limit this.

[0042] The application scenarios of the embodiments of the present application are not limited. The above application scenarios and the structure of the electronic device described in the embodiments of the present application are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those skilled in the art that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0043] The following is an introduction to the anomaly detection method provided in the embodiments of the present application.

[0044] Figure 3 The flowchart of the anomaly detection method provided in the embodiment of the present application may include the following steps:

[0045] S201. Obtain indicator values ​​of target operation indicators of a target device at different time points to obtain multiple target operation indicator values.

[0046] The target device may be any device to be detected, which may be a physical device or a virtual device (such as a cloud desktop system). The target operating indicator may be any operating indicator of the target device. For example, the target operating indicator may be any indicator such as CPU utilization, memory utilization, disk utilization, network latency, disk read / write rate, etc. of a cloud desktop system.

[0047] As a possible implementation method, the detection device selects any operating indicator of the cloud desktop system from the background server of the user cloud desktop system as the target operating indicator, and collects the indicator value of the target operating indicator at different times to obtain multiple target operating indicator values.

[0048] Exemplarily, the detection device collects indicator data of the user's cloud desktop system at different time points, and the indicator data includes multiple indicators such as CPU utilization, memory utilization, disk utilization, network delay, disk read and write rate of the cloud desktop system at different time points, and then constructs an initial data set D0.

[0049] Assume that the time window size is W, that is, D0 contains W data, each data corresponds to a timestamp, and contains M cloud desktop indicators, as shown in Table 1. The initial data set D0 under this time window is a two-dimensional time series matrix of W*M.

[0050] Table 1

[0051] metric_1 metric_2 ... metric_M TIME_1 <![CDATA[v 11 ]]> <![CDATA[v 21 ]]> <![CDATA[v m1 ]]> TIME_2 <![CDATA[v 12 ]]> <![CDATA[v 22 ]]> <![CDATA[v m2 ]]> ... TIME_W <![CDATA[v 1w ]]> <![CDATA[v 2w ]]> <![CDATA[v mw ]]>

[0052] Among them, metric_1-metric_M represent different operating indicators, for example, metric_1 is CPU utilization, and metric_2 is memory utilization. 11 -v 1w Indicates the indicator value of the running indicator metric_1 at different time points. For example, the indicator value of CPU utilization at TIME_1 is v 11 , the indicator value at TIME_2 is v 12 .

[0053] In some embodiments, in combination Figure 2 , the detection device can collect various performance data and event data of the user's cloud desktop system through the data collection module. In order to detect cloud desktop anomalies in a timely and accurate manner, the frequency of data collection, the degree of detail, the timeliness and the data storage cost can be fully considered when designing the collection module. To this end, the data collection module can adopt a combination of multiple collection schemes such as code embedding and fixed frequency.

[0054] like Figure 4 As shown, for the desktop parameter configuration and user basic information of the cloud desktop system, the detection device can adopt a one-time collection scheme; for the desktop performance data of the cloud desktop system, such as CPU utilization, memory usage, etc., the detection device can adopt a fixed-frequency collection scheme; for certain event data, the detection device can adopt a code point collection scheme. In addition, the above data will be reported and stored in the database with time information when collected.

[0055] It is understandable that the embodiment of the present application performs anomaly detection based on a time window, which has better real-time performance. Subsequently, the detection device can also perform further root cause analysis and fault self-healing based on the anomaly detection results, which has good scalability and can quickly adapt to changes in the cloud desktop system.

[0056] S202: Determine an operation rule of a target operation indicator according to multiple target operation indicator values.

[0057] As a possible implementation method, the detection device sorts multiple target operation index values ​​in chronological order to obtain time series data. Further, the detection device performs feature analysis on the time series data to obtain the operation law of the target operation index.

[0058] As another possible implementation, the detection device sorts the multiple target operation index values ​​in chronological order to obtain time series data. Further, the detection device preprocesses the time series data to obtain preprocessed data. The data noise of the preprocessed data is less than the data noise of the time series data. The detection device performs feature analysis on the preprocessed data to obtain the operation law of the target operation index.

[0059] In practical applications, the cloud desktop raw data obtained by the detection device through the data acquisition module usually has problems such as disordered timestamps, extreme outliers, missing values, noise, etc. In addition, when applying machine learning algorithms or deep learning algorithms to time series data, it is usually necessary to normalize or standardize the data first. Therefore, the detection device needs to pre-process the collected operating indicator values ​​through the data processing module for subsequent feature analysis.

[0060] It should be noted that the preprocessing process may include one or more of disordered timestamp processing, extreme outlier processing, missing value processing, noise data processing, and standardization processing.

[0061] For example, Figure 5 As shown, the detection device can first sort the time series data through the data processing module, and filter out the data outside the normal range of indicator changes, then interpolate the missing values ​​of the time series data, and then smooth and denoise the time series indicator data based on the time window, and finally select different standardized processing methods according to different subsequent anomaly detection algorithms.

[0062] In some embodiments, the detection device can set conditions according to the normal fluctuation range of the corresponding indicator to filter out abnormal values ​​of the time series data. For example, the normal fluctuation range of CPU usage is between [0%, 100%], but due to data collection errors or other factors, the CPU utilization at a certain moment is 120%, then the data needs to be filtered out.

[0063] In some embodiments, during the data collection process and when the abnormal data is filtered out in the above steps, missing values ​​may exist in the time series data, so the detection device may perform interpolation processing on the missing values.

[0064] It should be noted that the interpolation method can adopt a time-based piecewise cubic spline interpolation method. Cubic spline interpolation has good smoothness and approximation performance. Its basic idea is to use a cubic polynomial function on each small segment to approximate the unknown function between data points while satisfying the interpolation condition and the derivative continuity condition. The cubic polynomial function can be:

[0065] S(x)=S i (x) = a i +b i (xx i )+c i (xx i ) 2 +d i (xx i ) 2

[0066] Among them, a i ,b i ,c i ,d i is an unknown coefficient, the detection device passes through several known point coordinates (x i ,y i ) can solve the system of equations to obtain the equation of the entire curve and then perform interpolation.

[0067] In some embodiments, due to the high frequency of data collection or the data itself, the cloud desktop timing indicators usually have more noise, and the detection device can perform denoising on the timing data.

[0068] The denoising method may be sliding average denoising or exponential smoothing denoising.

[0069] Exemplarily, for the time series data of a certain indicator, the size (Winsize) of the time window and the moving step (Winstep) are set, and the detection device controls the window to start from the starting position of the time series and move backward Winstep each time until the window covers the entire data sequence. For each window, the detection device calculates the average or weighted average of the data in the window as the smoothed value at the center of the window. The detection device updates the smoothed value to the data sequence as the new value of the position. Generally, the larger the window size, the more obvious the smoothing effect.

[0070] In some embodiments, in order to eliminate the impact of dimensions between different cloud desktop indicators, the detection device can also perform standardization processing on the time series data.

[0071] Among them, standardization processing includes Min-Max standardization (also known as normalization) and Z-score standardization (also known as normalization). Min-Max standardization can process the range of time series data into the interval [0, 1]. Z-score standardization can process time series data into a time series with a mean of 0 and a variance of 1.

[0072] For example, the time series data in the current window metric_1 = [v 11 ,v 12 ,...,v 1W ] as an example, Vmax and Vmin are the maximum and minimum values ​​of the time series data, μ and σ are the mean and standard deviation of the time series data, respectively. The calculation formulas for Min-Max standardization and Z-score standardization of the time series data are as follows:

[0073] Min-Max Normalization:

[0074] Z-score normalization:

[0075] In some embodiments, in order to obtain the operating law of the target operating indicator, the detection device can obtain a feature analysis strategy, wherein the feature analysis strategy is used to verify whether the time series data conforms to the target operating law. Further, the detection device performs feature verification on the time series data according to the feature analysis strategy, and when the verification passes, determines the target operating law as the operating law of the target operating indicator.

[0076] It is understandable that the time series data of different indicators of the cloud desktop system or different users of the same indicator often have different characteristics. A single anomaly detection method is difficult to apply to all indicators at the same time, which can easily lead to low anomaly detection accuracy or high false alarm rate. Therefore, before anomaly detection, it is necessary to perform feature analysis and extraction on the user cloud desktop time series data for subsequent anomaly detection modeling analysis.

[0077] It should be noted that the operating rules of the target operating indicators can be divided into characteristics such as periodicity, stability, trend, heteroscedasticity, skewness and kurtosis. Among them, the trend type operating rule is used to indicate whether the time series data shows an obvious upward or downward trend. The periodic (also known as seasonal) operating rule is used to indicate whether the time series data shows obvious periodicity or seasonality. The heteroscedasticity operating rule is used to indicate whether the variance in the time series data changes over time. The stationary operating rule is used to indicate whether the time series data has stable statistical characteristics. Skewness and kurtosis refer to the skewness and kurtosis of the time series data distribution, which are used to describe the distribution of time series data.

[0078] The operating rules of different characteristics can be verified by different feature analysis strategies. For example, the detection device can use the Mann-Kendall method to detect the trend of time series data, use the Augmented Dickey-Fuller test (ADF) to detect the stationarity of time series data, use the autocorrelation analysis method (ACF and PACF, etc.) to analyze the seasonality and periodicity of time series data, and use statistical-based metrics to analyze the variance, skewness and kurtosis of time series data.

[0079] In some embodiments, for some complex time series indicators, they may be a superposition of periodic data, trend data and random data, such as Figure 6 As shown, the detection device can use the time series decomposition method to decompose the cloud desktop time series data into three sub-time series: periodic, stable and trend, and then calculate the proportion of the change range of each sub-time series to the change range of the total time series, so as to determine the overall characteristics of the indicator.

[0080] In practical applications, the detection device can perform feature analysis on the pre-processed cloud desktop time series index D1 to detect the periodicity, stability, trend and other characteristics of the time series data of each index.

[0081] In one exemplary embodiment, the detection device can use the Mann-Kendall method to verify the trend of time series data. The basic idea of ​​the Mann-Kendall method is to compare the size relationship between adjacent data points, calculate the rank of each data point, and then judge whether the data has a trend by the change of the rank. For each data point in the time series data, the detection device calculates the sign difference between it and the subsequent data point (that is, the sign of the subsequent data point minus the sign of the current data point), and adds the sign difference values ​​to obtain the sum of the sign differences S. The detection device calculates the Mann-Kendall statistic Z according to the number of data points n and the sum of the sign differences S. The specific calculation formula can be: Z = (SE[S]) / Var[S]. Among them, E[S] is the expected value of the sum of the sign differences, and Var[S] is the variance of the sum of the sign differences. Further, the detection device searches the standard normal distribution table according to the value and significance level of the Mann-Kendall statistic Z to determine whether to reject the null hypothesis (that is, the data does not have a trend change). If the null hypothesis is rejected, it is considered that the data has a trend change.

[0082] In the second exemplary embodiment, the detection device can use the ADF hypothesis test to verify the stability of the time series data. The ADF test method represents the time series data as an autoregressive model (AR model), and then tests the unit root characteristics in the model. If the unit root exists, it means that the data is not stable; if it does not exist, it means that the data is stable. Assume that the time series data is y_t, which is represented by an autoregressive model: y t =ρy t-1 +ε t , where ρ is the autoregressive coefficient, ε t is a white noise error term. The detection device calculates the ADF statistic to test the unit root characteristics in the model. The calculation method of the ADF statistic includes the steps of logarithmic transformation, difference operation and OLS regression. The detection device determines whether the data is stable according to the value of the ADF statistic and the significance level. If the ADF statistic is less than the critical value and the p-value is less than the significance level, the null hypothesis is rejected and the detection device considers that the time series data is not stable. Otherwise, the null hypothesis cannot be rejected and the detection device considers that the time series data is stable.

[0083] Example 3: If the time series data is a superposition of multiple feature types, the detection device further decomposes the time series data into periodic subsequences, trend subsequences and random subsequences, and performs weight calculation on the decomposed subsequences to determine the overall characteristics of the time series data. The above-mentioned time series data decomposition algorithm can adopt the trend decomposition (Seasonal and Trend decomposition using Loess, STL) algorithm, which decomposes the time series data into three parts: trend, seasonality and randomness, and has the advantages of generality and flexibility. The detection device represents the time series data as an additive model: y_t=T_t+S_t+R_t, where y_t is the original time series data, T_t is the trend item subsequence, S_t is the seasonal item subsequence, and R_t is the random item subsequence. The detection device can use the local weighted regression (Loess) method to smooth the trend item and the seasonal item to obtain the smoothed trend item T_t and the seasonal item S_t. The detection device can use the original data to subtract the smoothed trend item and the seasonal item to obtain the random item R_t. Furthermore, the detection device determines the validity and reliability of the decomposition result by checking the stability and white noise of the decomposition result.

[0084] S203: Determine a target detection strategy based on the operating rules.

[0085] Among them, the degree of matching between the target detection strategy and the operating law is greater than or equal to a preset threshold.

[0086] It is understandable that the detection device can select different target detection strategies according to different operating rules of the time series data. For example, the operating rules may include periodic rules, stable rules, and trend rules. Among them, the periodic rule corresponds to the first preset detection strategy (that is, the matching degree between the first preset detection strategy and the periodic rule is greater than or equal to the preset threshold), the stable rule corresponds to the second preset detection strategy, and the trend rule corresponds to the third preset detection strategy.

[0087] As a possible implementation, when the operating law is a periodic law, the detection device determines the first preset detection strategy as the target detection strategy. When the operating law is a stable law, the detection device determines the second preset detection strategy as the target detection strategy. When the operating law is a trend law, the detection device determines the third preset detection strategy as the target detection strategy.

[0088] It should be noted that the above target detection strategies include threshold-based anomaly detection methods, statistics-based anomaly detection methods, and anomaly detection algorithms based on machine learning and deep learning. Generally, rule-based and statistics-based anomaly detection algorithms have the advantages of simple implementation and fast detection speed, while algorithms based on machine learning and deep learning have better anomaly detection effects.

[0089] In practical applications, the detection device can be used Figure 2 The anomaly detection module in the feature analysis module determines the target detection strategy. This module selects different anomaly detection algorithms as target detection strategies based on the results of the feature analysis module. For example, for periodic time series data, the month-on-month method and the deep learning algorithm based on the long short-term memory network (LSTM) can be used. For stationary time series data, fixed thresholds, k-sigma algorithms, box plot algorithms, etc. can be used. For trend time series data, logistic regression or dynamic threshold methods can be used. For multidimensional time series data, machine learning or deep learning methods such as the distributed gradient boosting library (XGboost) and the single classification algorithm (OneClassSVM) can be used.

[0090] As another possible implementation, the detection device obtains a mapping relationship including multiple preset detection strategies and multiple preset operating rules; the multiple preset operating rules include the operating rules of the target operating indicators. Further, the detection device determines the target detection strategy corresponding to the operating rule from the mapping relationship.

[0091] For the design of the mapping relationship, please refer to the selection of the above anomaly detection algorithm, which will not be repeated here.

[0092] The embodiment of the present application can establish time series indicators and perform interpolation and filtering based on relevant data of the cloud desktop system, and then perform feature analysis on the time series indicators. Different types of feature time series indicators use different anomaly detection algorithms, so as to better respond to the diversity of cloud desktop users and the diversity of cloud desktop system indicators, improve the accuracy of cloud desktop anomaly detection, reduce the false alarm rate, help operation and maintenance personnel quickly locate and solve problems, and improve the stability and security of cloud desktop operation and maintenance.

[0093] S204: Detect each target operation indicator value based on the target detection strategy.

[0094] As a possible implementation, the detection device detects each target operation index value based on the target detection strategy to obtain a detection result, wherein the detection result is used to reflect the abnormality degree corresponding to each target operation index value.

[0095] In some embodiments, after obtaining the detection results, the detection device can also determine whether to issue an alarm based on the detection results, or design alarm rules and alarm methods according to the results of the above-mentioned abnormality detection or the abnormality score, as well as the severity of the abnormality, the affected population, and the degree of urgency.

[0096] For example, the detection device can be Figure 2 The alarm contact module in the system notifies the operation and maintenance personnel of abnormal alarms by setting different alarm levels and alarm methods, and performs abnormal analysis, root cause location and abnormal recovery.

[0097] In some embodiments, the cloud desktop system anomaly can be divided into an indicator value anomaly and a user experience anomaly. The detection device can analyze the specific detection results to determine the specific anomaly type of the cloud desktop.

[0098] Among them, the indicator numerical anomaly refers to the difference in the value of a certain indicator from other points, which can usually be divided into point anomalies, contextual anomalies and collective anomalies. Point anomalies are abnormal instances relative to other global data. Contextual anomalies usually have relatively large / small values ​​in their own context, but not globally. Collective anomalies are defined as a collection of related abnormal data instances that are abnormal relative to the entire data set.

[0099] User experience abnormality refers to the deterioration of the user experience of using the cloud desktop due to the influence of abnormal values ​​of multiple indicators, including but not limited to: cloud desktop freezes, disconnections, black screens, keyboard and mouse freezes, etc.

[0100] In an embodiment of the present application, multiple target operation indicator values ​​are obtained by obtaining the indicator values ​​of the target operation indicator of the target device at different time points, and the operation law of the target operation indicator is determined according to the characteristics of these target operation indicator values. Furthermore, based on the operation law, the present application determines a target detection strategy whose degree of matching with the operation law is greater than or equal to a preset threshold, and detects each target operation indicator value based on the target detection strategy. In this way, different detection strategies are used for operation indicators with different operation laws. Compared with the single detection strategy with a fixed threshold set in the related art for indicator anomaly detection, the present application can use different detection strategies for data with different operation laws for detection, making data detection more targeted, thereby improving the accuracy of anomaly detection.

[0101] The above-mentioned embodiment mainly introduces the scheme provided by the embodiment of the present application from the perspective of the device (equipment). It is understandable that, in order to implement the above-mentioned method, the device or equipment includes a hardware structure and / or software module corresponding to the execution of each method flow, and these hardware structures and / or software modules corresponding to the execution of each method flow can constitute an electronic device. It should be easy for those skilled in the art to realize that, in conjunction with the algorithm steps of each example described in the embodiment applied for herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but this implementation should not be considered to exceed the scope of the present application.

[0102] The embodiment of the present application can divide the functional modules of the device or equipment according to the above method example. For example, the device or equipment can divide each functional module corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0103] In the case of dividing each functional module into corresponding functional modules, Figure 7 FIG. 3 is a schematic diagram showing the structure of a detection device 30 of a functional module, and the detection device 30 of the functional module can be used to execute the abnormality detection method provided in the above embodiment. Figure 7 As shown, the detection device 30 includes an acquisition unit 301 , a determination unit 302 and a detection unit 303 .

[0104] The acquisition unit 301 is used to obtain the index values ​​of the target operation index of the target device at different time points to obtain multiple target operation index values. The determination unit 302 is used to determine the operation law of the target operation index based on the multiple target operation index values. The determination unit 302 is also used to determine the target detection strategy based on the operation law. The detection unit 303 is used to detect each target operation index value based on the target detection strategy; the matching degree between the target detection strategy and the operation law is greater than or equal to a preset threshold.

[0105] In an exemplary implementation, the determination unit 302 is specifically configured to: sort multiple target operation indicator values ​​in chronological order to obtain time series data; and perform feature analysis on the time series data to obtain the operation rules of the target operation indicator.

[0106] In an exemplary embodiment, the determination unit 302 is specifically used to: obtain a feature analysis strategy, the feature analysis strategy is used to verify whether the time series data conforms to the target operating law; perform feature verification on the time series data according to the feature analysis strategy, and if the verification passes, determine the target operating law as the operating law of the target operating indicator.

[0107] In an exemplary embodiment, the determination unit 302 is specifically used to: obtain a mapping relationship including multiple preset detection strategies and multiple preset operating rules; the multiple preset operating rules include operating rules of target operating indicators; and determine the target detection strategy corresponding to the operating rule from the mapping relationship.

[0108] In an exemplary embodiment, the operating rules include periodic rules, stable rules, and trend rules; the periodic rules correspond to the first preset detection strategy, the stable rules correspond to the second preset detection strategy, and the trend rules correspond to the third preset detection strategy.

[0109] In an exemplary embodiment, the determination unit 302 is specifically used to: sort multiple target operation indicator values ​​in chronological order to obtain time series data; preprocess the time series data to obtain preprocessed data; the data noise of the preprocessed data is less than the data noise of the time series data; perform feature analysis on the preprocessed data to obtain the operation law of the target operation indicator.

[0110] In an exemplary implementation, the determination unit 302 is specifically configured to: interpolate missing values ​​in the time series data to obtain intermediate time series data; and perform smoothing filtering on the intermediate time series data to obtain preprocessed data.

[0111] In an exemplary embodiment, the detection unit 303 is specifically used to: detect each target operation index value based on the target detection strategy to obtain a detection result; the detection result is used to reflect the degree of abnormality corresponding to each target operation index value; after obtaining the detection result, the determination unit 302 is also used to determine whether to issue an alarm based on the detection result.

[0112] In the case of implementing the functions of the above-mentioned integrated modules in the form of hardware, the embodiments of the present application provide a possible structure of the electronic device involved in the above-mentioned embodiments. Figure 8 As shown, the electronic device 40 includes: a processor 402 and a bus 404. In an exemplary embodiment, the electronic device 40 may further include a memory 401; optionally, the electronic device 40 may further include a communication interface 403.

[0113] Processor 402 may be a processor that implements or executes various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. The processor 402 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the embodiments of the present application. The processor 402 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, and the like.

[0114] The communication interface 403 is used to connect with other devices via a communication network, such as Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0115] The memory 401 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0116] As a possible implementation, the memory 401 may exist independently of the processor 402, and the memory 401 may be connected to the processor 402 via a bus 404 for storing instructions or program codes. When the processor 402 calls and executes the instructions or program codes stored in the memory 401, the anomaly detection method provided in the embodiment of the present application can be implemented.

[0117] In another possible implementation, the memory 401 may also be integrated with the processor 402 .

[0118] The bus 404 may be an extended industry standard architecture (EISA) bus, etc. The bus 404 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0119] Some embodiments of the present application provide a computer-readable storage medium (e.g., a non-transitory computer-readable storage medium), which stores computer program instructions. When the computer program instructions are executed on a computer, the computer executes the anomaly detection method as described in any of the above embodiments.

[0120] Exemplarily, the above-mentioned computer-readable storage media may include, but are not limited to: magnetic storage devices (e.g., hard disks, floppy disks or magnetic tapes, etc.), optical disks (e.g., compact disks (CD), digital versatile disks (DVD), etc.), smart cards and flash memory devices (e.g., erasable programmable read-only memory (EPROM), cards, sticks or key drives, etc.). The various computer-readable storage media described in this application may represent one or more devices and / or other machine-readable storage media for storing information. The term "machine-readable storage medium" may include, but is not limited to, wireless channels and various other media capable of storing, containing and / or carrying instructions and / or data.

[0121] An embodiment of the present application provides a computer program product comprising instructions. When the computer program product is run on a computer, the computer is enabled to execute the anomaly detection method described in any one of the above embodiments.

[0122] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Obtain the index values ​​of the target operating index of the target device at different time points to obtain multiple target operating index values; Determining an operating rule of the target operating indicator according to the multiple target operating indicator values; Based on the operating rules, a target detection strategy is determined, and each target operating indicator value is detected based on the target detection strategy; the degree of matching between the target detection strategy and the operating rules is greater than or equal to a preset threshold.

2. The method according to claim 1, characterized in that Determining the operating rule of the target operating indicator according to the multiple target operating indicator values ​​includes: Sorting the multiple target operation indicator values ​​in chronological order to obtain time series data; Perform feature analysis on the time series data to obtain the operating rules of the target operating indicators.

3. The method according to claim 2, characterized in that The performing feature analysis on the time series data to obtain the operation law of the target operation indicator includes: Acquire a feature analysis strategy, wherein the feature analysis strategy is used to verify whether the time series data conforms to a target operation rule; The feature verification of the time series data is performed according to the feature analysis strategy, and when the verification passes, the target operating law is determined as the operating law of the target operating indicator.

4. The method according to claim 1, characterized in that: The determining of the target detection strategy based on the operating rule includes: Acquire a mapping relationship including multiple preset detection strategies and multiple preset operating rules; the multiple preset operating rules include the operating rules of the target operating indicators; From the mapping relationship, determine the target detection strategy corresponding to the operating rule.

5. The method according to claim 4, characterized in that The operating rules include periodic rules, stable rules, and trend rules; the periodic rules correspond to the first preset detection strategy, the stable rules correspond to the second preset detection strategy, and the trend rules correspond to the third preset detection strategy.

6. The method according to claim 1, characterized in that Determining the operating rule of the target operating indicator according to the multiple target operating indicator values ​​includes: Sorting the multiple target operation indicator values ​​in chronological order to obtain time series data; Preprocessing the time series data to obtain preprocessed data; the data noise of the preprocessed data is smaller than the data noise of the time series data; Perform feature analysis on the preprocessed data to obtain the operating rules of the target operating indicators.

7. The method according to claim 6, characterized in that The preprocessing of the time series data to obtain preprocessed data includes: Interpolating missing values ​​in the time series data to obtain intermediate time series data; The intermediate time series data is smoothed and filtered to obtain the preprocessed data.

8. The method according to claim 1, characterized in that The detecting of each target operation indicator value based on the target detection strategy includes: The target operation index value is detected based on the target detection strategy to obtain a detection result; the detection result is used to reflect the abnormality degree corresponding to each target operation index value; After obtaining the detection result, the method further includes: determining whether to issue an alarm based on the detection result.

9. An electronic device, characterized in that: include: a processor and a memory for storing instructions executable by the processor; The processor is configured to execute the instruction so that the electronic device performs the abnormality detection method as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is enabled to execute the anomaly detection method according to any one of claims 1 to 8.

Images