Computer system fault detection method and system based on artificial intelligence

Abstract

The invention relates to a computer system fault detection method and system based on artificial intelligence, and belongs to the technical field of fault detection. The method comprises the following steps: acquiring initial computer system data, removing invalid data, incomplete data and duplicated data in the initial computer system data, and setting attribute classification corresponding to the initial computer system data according to a fault prediction index, extracting hardware state data and system operation state data in the initial computer system data according to attribute classification; constructing a two-dimensional difference value matrix, and constructing a multi-modal sample according to the two-dimensional difference value matrix; a fault recognition model is constructed, the fault recognition model is trained according to the multi-modal sample, and the training process comprises unsupervised pre-training and fully supervised fine tuning; and performing automatic modal matching on the computer system data observation value acquired in real time according to the fault identification model to obtain a system fault identification state. And the false report rate and the missing report rate of the fault detection model based on data driving are reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer fault diagnosis, and in particular relates to a computer system fault detection method and system based on artificial intelligence. Background Art

[0002] As digital transformation continues to deepen, enterprises are increasingly dependent on information technology systems. Traditional IT operations and maintenance models, which rely on manual monitoring and manual problem handling, can no longer meet the complex and changing business needs of the modern era. As cyber threat actors develop increasingly sophisticated strategies, cutting-edge cybersecurity has become a necessity for industry organizations and government agencies. A plethora of new threat strategies have overwhelmed many of the most advanced cybersecurity models. As new computing, storage, and energy efficiency advances have evolved to spawn new technological breakthroughs, such as the Internet of Things (IoT), security development faces the challenge of matching the advancement of new threats and technologies. IoT technology enables data collection, processing, and communication in autonomous vehicles, smart cities, smart grids, and e-health applications. Given the multitude of features and low cost of IoT devices, they are often distributed on a large scale rather than operating in a controlled and security-hardened environment. These uncontrolled variables expose opportunities for physical, network, and application attacks, often using newer and more easily exploited protocols with limited protection.

[0003] At present, intelligent fault diagnosis relies on AI systems, which require a large amount of high-quality data to provide accurate diagnosis and maintenance suggestions. However, real-world data is often noisy, missing or incomplete, which affects the accuracy of model training and results. In the AI ​​fault detection environment, ensuring that the data used to train AI is clear and unambiguous often relies on manual inspection, which is often subjective, and different inspectors may have different judgments on the same inspection results. Among them, the model-based diagnosis using AI technology depends on the accuracy of the system model and the quality and integrity of the data. As industrial systems become larger and more complex, the fault detection and prediction methods of computer systems rely on empirical models and rules, and face problems such as poor adaptability and low efficiency.

[0004] At present, big data is needed to explore various security scenarios, and there is a lack of available representative datasets for detection. Most works have shown great effectiveness in detecting anomalies in network traffic, system logs, and other types of data, but centralized learning methods require data collection from multiple edge computing systems, which violates the principle of data privacy. Summary of the invention

[0005] In order to solve the above problems existing in the prior art, the present invention provides a computer system fault detection method based on artificial intelligence.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A computer system fault detection method based on artificial intelligence, comprising:

[0008] S1: Acquire initial computer system data, remove invalid data, incomplete data and duplicate data in the initial computer system data, set attribute classification corresponding to the initial computer system data according to the fault prediction index, and extract hardware status data and system operation status data in the initial computer system data according to the attribute classification;

[0009] S2: constructing a two-dimensional difference matrix according to the data categories of the hardware status data and the system operation status data, and constructing a multimodal sample according to the two-dimensional difference matrix;

[0010] S3: constructing a fault recognition model, and training the fault recognition model according to the multimodal samples, wherein the training process includes unsupervised pre-training and fully supervised fine-tuning;

[0011] S4: Automatically perform modal matching on the real-time collected computer system data observation values ​​according to the fault identification model to obtain a system fault identification state.

[0012] Specifically, the hardware status data includes power supply current parameters, fan speed parameters, and hardware temperature parameters; the system operation status data includes CPU occupancy, interrupt statistical parameter values, queue and load parameter values, memory statistical parameter values, page statistical parameter values, network statistics and register values, I / O statistics and register values.

[0013] Specifically, the two-dimensional difference matrix is ​​the difference between the hardware status data and the system operation status data and the heterogeneous data attributes thereof, and the expression formula is:

[0014]

[0015] Among them, G is a two-dimensional difference matrix, n is the total number of data attributes of system operation status data, m is the total number of data attributes of hardware status data, a1, a2, a m are the first, second, and mth attribute values ​​in the hardware status data, a 1,2 、a 2,1 is the difference and opposite number of the attribute values ​​of the first and second categories in the hardware status data, a 1,m 、a m,1 is the difference and opposite number of the attribute values ​​of the first and mth categories, a 2,m 、a m,2 is the difference and opposite number of the attribute values ​​of the second category and the mth category; b1, b2, b nare the first, second, and nth attribute values ​​in the system operation status data, b 1,2 , b 2,1 is the difference and opposite number of the attribute values ​​of the first and second categories in the system operation status data, b 1,n , b n,1 is the difference and opposite number of the attribute values ​​of the first and nth categories in the system operation status data, b 2,n , b n,2 It is the difference and opposite number of the attribute values ​​of the second category and the nth category in the system operation status data.

[0016] Specifically, the fault identification model is based on a convolutional neural network, and takes the two-dimensional difference matrix as network input data. A weight sharing layer is added after the convolution layer. The convolution layer extracts a feature map of the input data through a local receptive field, and takes the feature map as the input of the weight sharing layer. According to the similarity between the convolution kernel and the matched filter structure, the convolution kernel weights of different convolution layers are used to construct a convolution filter with generalization ability for different parameters; the weight sharing layer includes a square sampling layer and a square root sampling layer.

[0017] Specifically, the unsupervised pre-training is performed by learning the weight of the square sampling layer in the weight sharing layer, the weight of the square root sampling layer is fixedly set and hard-coded to characterize the topological structure of the square sampling layer, and after the input data is given, the weight of the square sampling layer is learned by characterizing the coefficient features of the input data in the square root sampling layer, and the calculation formula is:

[0018]

[0019] Among them, W is the weight matrix of the square sampling layer, W T is the device matrix of the weight matrix of the square sampling layer, I is the unit matrix, T is the sampling period, m is the number of hidden units, n is the input data dimension size, V ik is the weight of the square root sampling layer, W kj is the weight of the square sampling layer, is the local feature of the input data.

[0020] Specifically, the fully supervised fine-tuning calculates the gradient through activation function softmax regression, and back-propagates the gradient error from the pooled unit output end of the convolutional neural network to gradually update the weight of the weight sharing unit of the convolutional neural network.

[0021] A computer system fault detection system based on artificial intelligence, comprising: a data acquisition module, a data encoding module, a model training module, and a model application module;

[0022] The data acquisition module is used to obtain initial computer system data, remove invalid data, incomplete data and duplicate data in the initial computer system data, set attribute classification corresponding to the initial computer system data according to the fault prediction index, and extract hardware status data and system operation status data in the initial computer system data according to the attribute classification;

[0023] The data encoding module is used to construct a two-dimensional difference matrix according to the data categories of the hardware status data and the system operation status data, and to construct a multimodal sample according to the two-dimensional difference matrix;

[0024] The model training module is used to construct a fault recognition model, and train the fault recognition model according to the multimodal samples, wherein the training process includes unsupervised pre-training and fully supervised fine-tuning;

[0025] The model application module is used to perform automatic modal matching on computer system data observation values ​​collected in real time according to the fault identification model to obtain a system fault identification state.

[0026] The beneficial effects of the present invention are:

[0027] Through data-driven fault prediction, the initial computer system data is collected, clustered, and then the pattern is extracted, which can reduce redundancy without losing important information. The distributed data collection method can obtain more comprehensive operating status data of the computing nodes, including hardware and software, effectively utilize communication resources, reduce I / O overhead, further reduce data transmission and storage overhead, and improve the scalability of data collection methods. The TCNNs-based method is used to build and update the fault identification model. Through unsupervised training, the sample classification prediction can better adapt to the data fluctuations and concept drift in the prediction. The supervised fine-tuning is performed to classify the computing node hardware and system operating status data samples collected in real time, and a higher classification accuracy is obtained. Based on the classification prediction of the status of real-time collected data samples, a good accuracy rate and fault prediction lead time are achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0029] Figure 1 The present invention is a flowchart of a computer system fault detection method based on artificial intelligence. DETAILED DESCRIPTION

[0030] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0031] See also Figure 1 , a computer system fault detection method based on artificial intelligence, comprising:

[0032] S1: Acquire initial computer system data, remove invalid data, incomplete data and duplicate data in the initial computer system data, set attribute classification corresponding to the initial computer system data according to the fault prediction index, and extract hardware status data and system operation status data in the initial computer system data according to the attribute classification;

[0033] S2: constructing a two-dimensional difference matrix according to the data categories of the hardware status data and the system operation status data, and constructing a multimodal sample according to the two-dimensional difference matrix;

[0034] S3: constructing a fault recognition model, and training the fault recognition model according to the multimodal samples, wherein the training process includes unsupervised pre-training and fully supervised fine-tuning;

[0035] S4: Automatically perform modal matching on the real-time collected computer system data observation values ​​according to the fault identification model to obtain a system fault identification state.

[0036] Specifically, the hardware status data includes power supply current parameters, fan speed parameters, and hardware temperature parameters; the system operation status data includes CPU occupancy, interrupt statistical parameter values, queue and load parameter values, memory statistical parameter values, page statistical parameter values, network statistics and register values, I / O statistics and register values.

[0037] In this embodiment, the method for acquiring and collecting hardware environment status data is to monitor the blocks through the SMC (System Management Controller) board. Based on the maintenance control network and the SMC system, the client-server (Client-Server) structure is adopted to obtain the hardware environment status data records of 16 computing nodes in the frame maintained by the SMC board server of each frame at a time. Using TCP / IP sockets, multi-frame SMC data is collected in parallel in a multi-threaded manner, reducing the resource occupation of the management node when collecting multi-node data, and avoiding the bottleneck problem of the management node. The system operation status data is obtained by the method of dividing the / proc file system; by analyzing the cpuinfo, meminfo, slabinfo, uptime, net / , sys / , scsi / and other files in the / proc or related files in the folder, the status information of the system operation including CPU, memory, network and I / O can be obtained.

[0038] Specifically, the two-dimensional difference matrix is ​​the difference between the hardware status data and the system operation status data and the heterogeneous data attributes thereof, and the expression formula is:

[0039]

[0040] Among them, G is a two-dimensional difference matrix, n is the total number of data attributes of system operation status data, m is the total number of data attributes of hardware status data, a1, a2, a m are the first, second, and mth attribute values ​​in the hardware status data, a 1,2 、a 2,1 is the difference and opposite number of the attribute values ​​of the first and second categories in the hardware status data, a 1,m 、a m,1 is the difference and opposite number of the attribute values ​​of the first and mth categories, a 2,m 、a m,2 is the difference and opposite number of the attribute values ​​of the second category and the mth category; b1, b2, b n are the first, second, and nth attribute values ​​in the system operation status data, b 1,2 , b 2,1 is the difference and opposite number of the attribute values ​​of the first and second categories in the system operation status data, b 1,n , b n,1 is the difference and opposite number of the attribute values ​​of the first and nth categories in the system operation status data, b 2,n , b n,2 It is the difference and opposite number of the attribute values ​​of the second category and the nth category in the system operation status data.

[0041] Specifically, the fault identification model is based on a convolutional neural network, and takes the two-dimensional difference matrix as network input data. A weight sharing layer is added after the convolution layer. The convolution layer extracts a feature map of the input data through a local receptive field, and takes the feature map as the input of the weight sharing layer. According to the similarity between the convolution kernel and the matched filter structure, the convolution kernel weights of different convolution layers are used to construct a convolution filter with generalization ability for different parameters; the weight sharing layer includes a square sampling layer and a square root sampling layer.

[0042] Specifically, the unsupervised pre-training is performed by learning the weight of the square sampling layer in the weight sharing layer, the weight of the square root sampling layer is fixedly set and hard-coded to characterize the topological structure of the square sampling layer, and after the input data is given, the weight of the square sampling layer is learned by characterizing the coefficient features of the input data in the square root sampling layer, and the calculation formula is:

[0043]

[0044] Among them, W is the weight matrix of the square sampling layer, W T is the device matrix of the weight matrix of the square sampling layer, I is the unit matrix, T is the sampling period, m is the number of hidden units, n is the input data dimension size, V ik is the weight of the square root sampling layer, W kj is the weight of the square sampling layer, is the local feature of the input data.

[0045] Specifically, the fully supervised fine-tuning calculates the gradient through activation function softmax regression, and back-propagates the gradient error from the pooled unit output end of the convolutional neural network to gradually update the weight of the weight sharing unit of the convolutional neural network.

[0046] A computer system fault detection system based on artificial intelligence, comprising: a data acquisition module, a data encoding module, a model training module, and a model application module;

[0047] The data acquisition module is used to obtain initial computer system data, remove invalid data, incomplete data and duplicate data in the initial computer system data, set attribute classification corresponding to the initial computer system data according to the fault prediction index, and extract hardware status data and system operation status data in the initial computer system data according to the attribute classification;

[0048] The data encoding module is used to construct a two-dimensional difference matrix according to the data categories of the hardware status data and the system operation status data, and to construct a multimodal sample according to the two-dimensional difference matrix;

[0049] The model training module is used to construct a fault recognition model, and train the fault recognition model according to the multimodal samples, wherein the training process includes unsupervised pre-training and fully supervised fine-tuning;

[0050] The model application module is used to perform automatic modal matching on computer system data observation values ​​collected in real time according to the fault identification model to obtain a system fault identification state.

[0051] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device.

[0052] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0053] The program code included on the computer readable medium can be transmitted with any appropriate medium, including but not limited to wireless, electric wire, optical cable, RF, etc., or any suitable combination of the above. The computer program code for performing the operation of the present invention can be written in one or more programming languages ​​or their combinations, and the programming language includes object-oriented programming languages-such as Java, Smalltalk, C++, and also includes conventional procedural programming languages-such as "C" language or similar programming languages. The program code can be executed completely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0054] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. A computer system fault detection method based on artificial intelligence, characterized in that: include: S1: Acquire initial computer system data, remove invalid data, incomplete data and duplicate data in the initial computer system data, set attribute classification corresponding to the initial computer system data according to the fault prediction index, and extract hardware status data and system operation status data in the initial computer system data according to the attribute classification; S2: constructing a two-dimensional difference matrix according to the data categories of the hardware status data and the system operation status data, and constructing a multimodal sample according to the two-dimensional difference matrix; S3: constructing a fault recognition model, and training the fault recognition model according to the multimodal samples, wherein the training process includes unsupervised pre-training and fully supervised fine-tuning; S4: Automatically perform modal matching on the real-time collected computer system data observation values ​​according to the fault identification model to obtain the system fault identification state.

2. The method according to claim 1, characterized in that The hardware status data includes power supply current parameters, fan speed parameters, and hardware temperature parameters; the system operation status data includes CPU occupancy, interrupt statistical parameter values, queue and load parameter values, memory statistical parameter values, page statistical parameter values, network statistics and register values, and I / O statistics and register values.

3. The method according to claim 2, characterized in that The two-dimensional difference matrix is ​​the difference between the hardware status data and the system operation status data and the heterogeneous data attributes thereof, and the expression formula is: Among them, G is a two-dimensional difference matrix, n is the total number of data attributes of system operation status data, m is the total number of data attributes of hardware status data, a1, a2, a m are the first, second, and mth attribute values ​​in the hardware status data, a 1,2 、a 2,1 is the difference and opposite number of the attribute values ​​of the first and second categories in the hardware status data, a 1,m 、a m,1 is the difference and opposite number of the attribute values ​​of the first and mth categories, a 2,m 、a m,2 is the difference and opposite number of the attribute values ​​of the second category and the mth category; b1, b2, b n are the first, second, and nth attribute values ​​in the system operation status data, b 1,2 、b 2,1 is the difference and opposite number of the attribute values ​​of the first and second categories in the system operation status data, b 1,n 、b n,1 is the difference and opposite number of the attribute values ​​of the first and nth categories in the system operation status data, b 2,n 、b n,2 It is the difference and opposite number of the attribute values ​​of the second category and the nth category in the system operation status data.

4. The method according to claim 1, characterized in that: The fault recognition model is based on a convolutional neural network. The two-dimensional difference matrix is ​​used as network input data. A weight sharing layer is added after the convolution layer. The convolution layer extracts a feature map of the input data through a local receptive field. The feature map is used as the input of the weight sharing layer. According to the similarity between the convolution kernel and the matched filter structure, the convolution kernel weights of different convolution layers are used to construct a convolution filter with generalization ability for different parameters; the weight sharing layer includes a square sampling layer and a square root sampling layer.

5. The method according to claim 4, characterized in that The unsupervised pre-training is performed by learning the weight of the square sampling layer in the weight sharing layer, the weight of the square root sampling layer is fixedly set and hard-coded to characterize the topological structure of the square sampling layer, and after the input data is given, the weight of the square sampling layer is learned by characterizing the coefficient features of the input data in the square root sampling layer, and the calculation formula is: Among them, W is the weight matrix of the square sampling layer, W T is the device matrix of the weight matrix of the square sampling layer, I is the unit matrix, T is the sampling period, m is the number of hidden units, n is the input data dimension size, V ik is the weight of the square root sampling layer, W kj is the weight of the square sampling layer, is the local feature of the input data.

6. The method according to claim 4, characterized in that The fully supervised fine-tuning calculates the gradient through activation function softmax regression, and back-propagates the gradient error from the pooled unit output end of the convolutional neural network to gradually update the weight of the weight sharing unit of the convolutional neural network.

7. A fault detection system using the artificial intelligence-based computer system fault detection method according to claim 1, characterized in that: include: Data acquisition module, data encoding module, model training module, model application module; The data acquisition module is used to obtain initial computer system data, remove invalid data, incomplete data and duplicate data in the initial computer system data, set attribute classification corresponding to the initial computer system data according to the fault prediction index, and extract hardware status data and system operation status data in the initial computer system data according to the attribute classification; The data encoding module is used to construct a two-dimensional difference matrix according to the data categories of the hardware status data and the system operation status data, and to construct a multimodal sample according to the two-dimensional difference matrix; The model training module is used to construct a fault recognition model, and train the fault recognition model according to the multimodal samples, wherein the training process includes unsupervised pre-training and fully supervised fine-tuning; The model application module is used to perform automatic modal matching on computer system data observation values ​​collected in real time according to the fault identification model to obtain a system fault identification state.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the artificial intelligence-based computer system fault detection method as described in any one of claims 1 to 6 is implemented.

9. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions are used to execute the artificial intelligence-based computer system fault detection method as described in any one of claims 1 to 6 when executed by a computer processor.

Images