Time sequence anomaly detection method and device based on function approximation network

Abstract

A time sequence anomaly detection method based on a function approximation network is applied to a computing device, the computing device is provided with a monitoring system, the monitoring system is used for monitoring a plurality of key performance indicators (KPI) in the computing device, and the method comprises the following steps: acquiring a historical feature vector of any one of the plurality of KPI data at a current moment t; training a prediction model based on the plurality of historical feature vectors at different moments; the prediction model is a function approximation network model; predicting the feature vector at the moment t through the trained prediction model, and determining a predicted feature vector; and determining whether any one piece of KPI data is abnormal or not based on the prediction feature vector and the vector of the true value of any one piece of KPI data at the t moment. According to the method, fine-grained modeling can be carried out on the dependency relationship between the indexes, and the accuracy of anomaly detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a time series anomaly detection method and device based on function approximation network. Background Art

[0002] With the rapid development of Internet applications and the rapid increase in the number of users, it is crucial to ensure the stability of the operation of Internet application systems. In order to ensure the smooth operation of Internet application services, operation and maintenance personnel will deploy a monitoring system in the system to monitor various key performance indicators (KPIs) in the system in real time, including but not limited to central processing unit (CPU) utilization, number of page visits per minute, etc. Through KPI, we can understand whether the system is in a normal operating state. However, in large-scale Internet services, there may be tens of thousands or even hundreds of thousands of KPIs that need to be monitored. Therefore, how to judge whether the system service is abnormal in a large amount of KPI data has become an urgent problem to be solved. Summary of the invention

[0003] In order to solve the problems existing in the prior art, the embodiments of the present application provide a method, apparatus, computing device, computer storage medium and product including a computer program for time series anomaly detection based on a function approximation network, which can perform fine-grained modeling of the dependencies between indicators and improve the accuracy of anomaly detection.

[0004] In a first aspect, an embodiment of the present application provides a time series anomaly detection method based on a function approximation network, which is applied to a computing device, wherein the computing device is deployed with a monitoring system, and the monitoring system is used to monitor multiple key performance indicators KPIs in the computing device. The method includes: obtaining a historical feature vector of any one of the multiple key performance indicators KPIs at the current time t; training a prediction model based on multiple historical feature vectors at different times; the prediction model is a function approximation network model; predicting the feature vector at time t through the trained prediction model to determine the predicted feature vector; determining whether any KPI data is abnormal based on the predicted feature vector and the vector of the true value of any KPI data at time t.

[0005] In some possible implementations, obtaining a historical feature vector of any one of a plurality of key performance indicators KPIs at the current time t includes: obtaining KPI data stored in a computing device; performing normalization processing on each data in the KPI data after differentiation to determine a KPI data row matrix; each row in the KPI data matrix represents a type of KPI data; arbitrarily selecting one of the rows as any one of the KPI data; selecting from any one of the KPI data according to a sliding time window of a preset fixed size to determine the KPI data of the sliding time window size; and determining a feature vector of the KPI data of the sliding time window size as the historical feature data.

[0006] In some possible implementations, the KPI data is normalized after being differentiated, according to the following formula:

[0007]

[0008] In the formula, v represents the processed KPI data value, v1 represents the first-order forward difference value of the KPI data in its corresponding dimension, and v mean Represents the mean value of the KPI data after the first-order forward difference in the corresponding dimension, v std Characterizes the standard deviation of the KPI data after the first-order forward difference in the corresponding dimension.

[0009] In some possible implementations, training the prediction model includes: using multiple predefined basis functions to transform and combine historical feature vectors to determine a basis function feature matrix; using the basis function feature matrix as input to the prediction model to determine the weights of each basis function in the basis function feature matrix; and integrating the weights of each basis function to determine the prediction model.

[0010] In some possible implementations, the function approximation network includes a convolutional neural network and a feedforward neural network, and training a prediction model specifically includes: performing a nonlinear transformation on the normalized KPI data to determine a basis function feature matrix, which is used to reduce the number of parameters; using the basis function feature matrix as the input of the convolutional neural network, and the parameters of the convolutional neural network include the weights of the basis functions; and inputting the output of the convolutional neural network into the feedforward neural network.

[0011] In some possible implementations, the basis function is any one of a trigonometric function and an exponential function, or a combination of multiple trigonometric functions and exponential functions.

[0012] In some possible implementations, determining the prediction feature vector specifically includes: inputting the historical feature vector of any kind of KPI data at time t into a convolutional neural network to determine the characteristic feature vector of any kind of KPI data; processing the characteristic feature vector through a feedforward neural network to determine the prediction feature vector of any kind of KPI data at time t.

[0013] In some possible implementations, the prediction feature vector is determined according to the following formula:

[0014] y t =h(FAN(F(w t )))

[0015] In the formula, y t represents the predicted feature vector at time t, h represents the mapping function of KPI data, FAN represents the function approximation network, F represents the basis function group, and w t The historical feature vector that represents the KPI data at time t.

[0016] In some possible implementations, determining whether any KPI data is abnormal is specifically as follows: calculating the distance between the predicted feature vector and the vector of the true value; and when the distance is greater than a preset threshold, determining that any KPI data is abnormal at time t.

[0017] In the second aspect, an embodiment of the present application provides a time series anomaly detection device based on a function approximation network, which is deployed on a computing device. The computing device is deployed with a monitoring system, and the monitoring system is used to monitor multiple key performance indicators KPIs in the computing device. The device includes: an acquisition module, which is used to obtain the historical feature vector of any one of the multiple key performance indicators KPIs at the current time t; a processing module, which is used to train a prediction model based on multiple historical feature vectors at different times; the prediction model is a function approximation network model; the processing module is also used to predict the feature vector at time t through the trained prediction model to determine the predicted feature vector; the processing module also determines whether any KPI data is abnormal based on the predicted feature vector and the vector of the true value of any KPI data at time t.

[0018] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, comprising computer-readable instructions. When a computer reads and executes the computer-readable instructions, the computer executes the method described in any one of the first aspects.

[0019] In a fourth aspect, an embodiment of the present application provides a computing device, comprising a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the method described in any one of the first aspects is executed.

[0020] In a fifth aspect, an embodiment of the present application provides a product comprising a computer program. When the computer program product runs on a processor, the processor executes the method as described in any one of the first aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0022] Figure 1 It is a flowchart of an anomaly detection method provided in an embodiment of the present application;

[0023] Figure 2 is a schematic diagram of a KPI data matrix provided in an embodiment of the present application;

[0024] Figure 3 This is a schematic diagram of a model prediction process provided by an embodiment of the present application;

[0025] Figure 4 It is a schematic diagram of a process of processing KPI data by a function approximation network provided in an embodiment of the present application;

[0026] Figure 5 is a structural schematic diagram of an abnormality detection device provided in an embodiment of the present application;

[0027] Figure 6 It is a structural diagram of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0030] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of the objects. For example, a first response message and a second response message are used to distinguish different response messages rather than to describe a specific order of the response messages.

[0031] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0032] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0033] To facilitate the understanding of the embodiments of the present application, the following will further explain and illustrate specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.

[0034] When the system is in service, the monitoring system usually collects multiple KPI data at a certain time period (for example, every 10 seconds, 1 minute, etc.) and stores the collected KPI data. These KPI data form a multidimensional time series data. In this multidimensional time series data, each data point corresponds to the value of a certain KPI data at a certain data collection time. The relationship between the KPI time series and its historical change trend is called the time series dependency relationship, and the relationship between different indicators is the indicator dependency relationship. For example, at a certain moment, the CPU utilization rate is very high, and the memory utilization rate is also high. The CPU utilization rate and the memory utilization rate are the indicator dependency relationships. The normal ranges of the KPI time series dependency relationship and the indicator dependency relationship are pre-set, including thresholds (such as maximum thresholds and minimum thresholds), linear programming, etc.

[0035] Next, users (for example, operation and maintenance personnel) can compare the historical change patterns and trends of KPI data based on the current KPI time series to see whether the comparison results match. When an anomaly occurs, it means that the KPI data value at a certain time point exceeds the normal range of the time series dependency and the dependency between indicators. The KPI data at this time point can be called an anomaly point.

[0036] Although this method can be used for anomaly detection, manual detection of anomalies requires users to have knowledge in related fields and invest a lot of energy. In the case of huge amounts of data, this method requires extremely high labor costs and is not realistic in modern Internet systems that generate high-dimensional massive data all the time.

[0037] In view of this, an embodiment of the present application provides an anomaly detection method, which is a time series anomaly detection method based on a function approximation network. Through a pre-trained prediction model, the KPI data at the current moment is predicted, and the distance between the predicted KPI data and the actual KPI data is determined. When the distance exceeds the threshold, the KPI data is determined to be abnormal, that is, the system service is abnormal. The detection effect of this method is more accurate, and no human participation is required throughout the process, which can save a lot of labor costs. The method is described in detail below with reference to the accompanying drawings.

[0038] For example, Figure 1 Schematic diagram of a flow chart of an anomaly detection method provided in an embodiment of the present application, which is applied to anomaly detection of single-dimensional KPI data. Figure 1 As shown, the anomaly detection method includes the following steps:

[0039] S11: Obtain the historical feature vector of the KPI data in a single dimension at the current time t.

[0040] In this embodiment, the stored single-dimensional KPI data can be obtained in the storage medium, and each KPI data is collected according to a certain time period (for example, every 10s, 1min, etc.). When the KPI data of each dimension is stored in the storage medium, it is stored in chronological order. Among them, the storage medium can be a database. After obtaining the KPI data, the historical feature vector of the KPI data of each dimension can be determined. The historical feature vector is used to characterize the feature vector before time t. When determining the historical feature vector of the KPI data, the collected single-dimensional KPI data is first normalized after being differentiated to determine the KPI data matrix. In the KPI data matrix, each element is in the same dimension. Obtain the KPI data sorted in time series, use a pre-set fixed-size sliding time window, slide on the KPI data sorted in time series, select the KPI data of fixed length, and record the sliding time window size as w, then 1≤w<t. By sliding the time window, we can get w-sized KPI data, which are integrated into a one-dimensional vector. The elements in the vector are w-sized KPI data in the sliding time window. Since the one-dimensional vector is the KPI data before the current time t, the one-dimensional vector can be called the historical feature vector of the current time t. Please refer to Figure 2 , Figure 2Schematic diagram of a KPI data matrix provided in an embodiment of the present application. Figure 2 As shown in the matrix, each column represents the KPI data at a certain time. The KPI data at time t is recorded as x t , the sliding time window size is recorded as w, then at a time t, its historical feature vector can be expressed as [x t-w ,…,x t-1 ].

[0041] In some possible embodiments, the normalization process may specifically be: calculating the features of the first-order forward difference single-dimensional KPI data, the features including the mean and the standard deviation. The mean is denoted as v mean , the standard deviation is denoted as v std Based on the characteristics of the dimension, the KPI data is scaled to the same dimension to obtain the KPI data to be processed.

[0042] In some possible embodiments, the specific formula for scaling the KPI data is:

[0043]

[0044] In the formula, v represents the scaled KPI data value, v1 represents the first-order forward difference value of the KPI data in its corresponding dimension, and v mean Represents the mean value of the KPI data after the first-order forward difference in the corresponding dimension, v std Characterizes the standard deviation of the KPI data after the first-order forward difference in the corresponding dimension.

[0045] S12: Train a prediction model based on multiple historical feature vectors.

[0046] In this embodiment, after obtaining the historical feature vectors of multiple historical moments t (i.e., moment t, t-1, t-2, etc.), these historical feature vectors can be integrated into a training set. The KPI prediction model is trained using the data in the training set. Specifically, after obtaining the feature vector of the single-dimensional KPI data, a prediction model can be constructed based on the single-dimensional KPI data and its feature vector, so that the prediction model can be trained unsupervised. Among them, the prediction model is a function approximation network model.

[0047] In some possible embodiments, the function approximation network model is a neural network model.

[0048] In this embodiment, during the training process, the convolutional neural network can calculate the weights of each basis function feature vector according to the input of the current basis function feature matrix. The basis function is used to perform nonlinear transformation on the normalized KPI data, which can reduce the number of parameters. The basis function can be nonlinear, such as trigonometric functions of nonlinear transformation, or nonlinear functions, such as exponential functions, or any combination thereof, for example, a combination of multiple trigonometric functions (such as sin(x) / sin(x)+cos(x)). In an embodiment of the present application, trigonometric functions can be selected as basis functions, such as cos(x), sin(x), cos(2x), sin(2x), etc. Each trigonometric function serves as a basis function, and a group of basis functions can be formed by multiple basis functions. For example, cos(x) is a basis function, and cos(x), cos(2x),…, cos(nx) constitute a group of basis functions. The convolutional neural network model performs weighted fusion on the output results to obtain the final model output. Please refer to Figure 3 , Figure 3 The schematic diagram of the process of model prediction provided by the embodiment of the present application is shown. Figure 3 As shown, in this embodiment, a function approximation network is used to extract features from the historical feature vectors at time t. When extracting the feature vector, the feature vector at the current time t is input into the function approximation network, and the feature vector is transformed and combined using a set of predefined basis functions to obtain a basis function feature matrix. Then, after the basis function feature matrix is ​​input into the function approximation network, the independent weights of the feature vectors of each basis function can be obtained, and the function approximation network model is determined after combining them according to the independent weights. The function approximation network model can greatly compress the model parameters. By introducing the basis function feature matrix and directly learning the coefficients of this matrix, the model parameter amount is reduced and the efficiency is improved.

[0049] S13: Predict the feature vector at time t using the trained prediction model to determine the predicted feature vector.

[0050] In this embodiment, after the model training is completed, the trained prediction model can be used to predict the feature vector at time t to obtain the prediction vector of the KPI data at time t. For example, Figure 4 The structure diagram of the process of processing KPI data by a function approximation network provided in an embodiment of the present application is shown. Figure 4As shown in the figure, the function approximation network contains a convolutional neural network and a layer of feedforward neural network. When the function approximation network processes the feature vector, it first uses a set of predefined basis functions to transform the feature vector and combines them into a basis function feature matrix. Then, the basis function feature matrix is ​​processed using the convolutional neural network to obtain a characteristic feature vector containing KPI data. The characteristic feature vector is input into the feedforward neural network. After being processed by the feedforward neural network, the prediction vector of the KPI data at time t can be obtained.

[0051] In some possible embodiments, the prediction feature vector may be determined according to the following formula:

[0052] y t =h(FAN(F(w t )))

[0053] In the formula, y t represents the predicted feature vector at time t, h represents the mapping function of KPI data, FAN represents the function approximation network, F represents the basis function group, and w t The historical feature vector that represents the KPI data at time t.

[0054] S14: Determine whether the KPI data is abnormal based on the predicted feature vector and the vector of the actual KPI data value.

[0055] In this embodiment, after obtaining the predicted feature vector at time t, the KPI data collected in real time can be obtained in the data collection system. The real-time data is the true value of the KPI data. The true value of the KPI data at time t is scaled, and the values ​​of each dimension are scaled to the same dimension. When scaling, the same scaling formula is used for normalization when obtaining the historical feature value at time t. The vector of the true value of the scaled KPI data is recorded as x t . After obtaining the predicted vector and the vector of the true value of the KPI data at time t, the distance between the predicted vector and the vector of the true value can be calculated, and the distance can be used as the anomaly score. When the anomaly score is greater than the preset threshold, it indicates that the actual KPI data at time t is far from the estimated normal value. The data at this moment is likely to violate the time series dependency and the dependency between indicators of the KPI data, and it is determined that the KPI data at time t is abnormal. When an abnormality occurs, an abnormal alarm can be issued so that the user can handle the abnormality.

[0056] In some possible embodiments, the distance between the predicted feature vector and the true value vector may be the Euclidean distance, expressed as

[0057] It can be seen from the various embodiments described above that the method provided by the present application can obtain various parameters in the prediction model by acquiring historical KPI data and processing the historical KPI data. After determining the various parameters in the model, the KPI data at the current moment can be predicted based on the historical KPI data, and then the real KPI data at the current moment can be obtained to determine the distance between the predicted data and the real data. When the distance exceeds the threshold, it indicates that the data at this moment is likely to violate the temporal dependency relationship and the dependency relationship between indicators of the KPI data, and may be abnormal data, and the user can be prompted to handle the anomaly. This method does not require manual participation throughout the process, which can reduce a lot of labor costs. Through this method, the dependency relationship between indicators can be modeled in a fine-grained manner, which improves the accuracy of anomaly detection, and the detection effect in the KPI anomaly detection scenario is significantly improved.

[0058] It is understandable that the size of the sequence number of each step in the above-mentioned embodiments does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. In addition, in some possible implementations, the steps in the above-mentioned embodiments can be selectively executed according to actual conditions, and can be partially executed or fully executed, which is not limited here. All or part of any feature of any embodiment of the present application can be freely and arbitrarily combined without contradiction. The combined technical solution is also within the scope of the present application.

[0059] Based on the method in the above embodiment, the embodiment of the present application also provides a time series anomaly detection device based on a function approximation network. For example, Figure 5 The invention shows an abnormality detection device, which is deployed in a computing device, and a monitoring system is deployed in the computing device, and the monitoring system is used to monitor a plurality of key performance indicators (KPIs) in the computing device. The abnormality detection device includes an acquisition module 501 and a processing module 502 .

[0060] The acquisition module 501 is used to acquire the historical feature vector of any one of the multiple key performance indicators KPI at the current time t.

[0061] The processing module 502 is used to train a prediction model based on multiple historical feature vectors at different times; the prediction model is a function approximation network model.

[0062] The processing module 502 is further used to predict the feature vector at time t through the trained prediction model to determine the predicted feature vector.

[0063] The processing module 502 also determines whether any KPI data is abnormal based on the predicted feature vector and the vector of the true value of any KPI data at time t.

[0064] It should be understood that the above-mentioned device is used to execute the method in the above-mentioned embodiment. The implementation principle and technical effect of the corresponding program module in the device are similar to those described in the above-mentioned method. The working process of the device can refer to the corresponding process in the above-mentioned method, which will not be repeated here.

[0065] The present application also provides a computing device 600. Figure 6 As shown, computing device 600 includes: bus 602, processor 604, memory 606 and communication interface 608. Processor 604, memory 606 and communication interface 608 communicate through bus 602. Computing device 600 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in computing device 600.

[0066] The bus 602 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 The bus 604 is represented by only one line, but does not mean that there is only one bus or one type of bus. The bus 604 may include a path for transmitting information between various components of the computing device 600 (eg, the memory 606, the processor 604, and the communication interface 608).

[0067] The processor 604 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0068] The memory 606 may include a volatile memory, such as a random access memory (RAM). The processor 604 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0069] The memory 606 stores executable program codes, and the processor 604 executes the executable program codes to respectively implement the functions of the acquisition module 501 and the processing module 502, thereby implementing all or part of the steps of the method in the above embodiment. That is, the memory 606 stores instructions for executing all or part of the steps in the method in the above embodiment.

[0070] Alternatively, the memory 606 stores executable codes, and the processor 604 executes the executable codes to respectively implement the functions of the aforementioned abnormality detection device 700, thereby implementing all or part of the steps in the above-mentioned embodiment method. That is, the memory 606 stores instructions for executing all or part of the steps in the above-mentioned embodiment method.

[0071] The communication interface 608 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 600 and other devices or communication networks.

[0072] Based on the methods in the above embodiments, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program runs on a processor, the processor executes the methods in the above embodiments.

[0073] Based on the methods in the above embodiments, an embodiment of the present application provides a computer program product. When the computer program product runs on a processor, the processor executes the methods in the above embodiments.

[0074] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0075] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0076] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0077] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

Claims

1. A time series anomaly detection method based on function approximation network, characterized in that: Applied to a computing device, the computing device is deployed with a monitoring system, the monitoring system is used to monitor multiple key performance indicators (KPIs) in the computing device, the method includes: Obtaining a historical feature vector of any one of the multiple key performance indicators KPI data at the current time t; Based on multiple historical feature vectors at different times, a prediction model is trained; the prediction model is a function approximation network model; Predicting the feature vector at time t by using the trained prediction model to determine the predicted feature vector; Based on the predicted feature vector and the vector of the true value of any one of the KPI data at time t, it is determined whether any one of the KPI data is abnormal.

2. The method according to claim 1, characterized in that The obtaining of the historical feature vector of any one of the multiple key performance indicators KPI data at the current time t includes: Acquiring KPI data stored in the computing device; Each data in the KPI data is normalized after being differentiated to determine a KPI data row matrix; each row in the KPI data matrix represents a type of KPI data; and one row is randomly selected as any one type of KPI data; According to a sliding time window of a preset fixed size, selecting from any one of the KPI data, and determining KPI data of the sliding time window size; A feature vector of the KPI data of the sliding time window size is determined as the historical feature data.

3. The method according to claim 2, characterized in that The KPI data is normalized after being differentiated according to the following formula: In the formula, v represents the processed KPI data value, v1 represents the first-order forward difference value of the KPI data in its corresponding dimension, and v mean Represents the mean value of the KPI data after the first-order forward difference in the corresponding dimension, v std Characterizes the standard deviation of the KPI data after the first-order forward difference in the corresponding dimension.

4. The method according to claim 2, characterized in that: The training prediction model comprises: Using a plurality of predefined basis functions to transform and combine the historical feature vectors, and determining a basis function feature matrix; Using the basis function feature matrix as the input of the prediction model, and determining the weight of each basis function in the basis function feature matrix; The weights of the various basis functions are integrated to determine the prediction model.

5. The method according to claim 4, characterized in that The function approximation network includes a convolutional neural network and a feedforward neural network, and the training prediction model specifically includes: Performing nonlinear transformation on the normalized KPI data to determine a basis function characteristic matrix, wherein the basis function characteristic matrix is ​​used to reduce the amount of parameters; Using the basis function feature matrix as the input of the convolutional neural network, the parameters of the convolutional neural network include the weights of the basis functions; The output result of the convolutional neural network is input into the feedforward neural network.

6. The method according to claim 5, characterized in that The basis function is any one of a trigonometric function and an exponential function, or a combination of multiple trigonometric functions and / or exponential functions.

7. The method according to any one of claims 4 to 6, characterized in that: The determining of the prediction feature vector specifically includes: Inputting the historical feature vector of any one of the KPI data at time t into the convolutional neural network to determine the characteristic feature vector of any one of the KPI data; The characteristic feature vector is processed by the feedforward neural network to determine the predicted feature vector of any one of the KPI data at time t.

8. The method according to claim 1, characterized in that The prediction feature vector is determined according to the following formula: y t =h(FAN(F(w t ))) In the formula, y t represents the predicted feature vector at time t, h represents the mapping function of KPI data, FAN represents the function approximation network, F represents the basis function group, and w t The historical feature vector that represents the KPI data at time t.

9. The method according to claim 1, characterized in that: The determining whether any of the KPI data is abnormal is specifically: Calculating the distance between the predicted feature vector and the vector of the true value; When the distance is greater than a preset threshold, it is determined that any one of the KPI data is abnormal at time t.

10. A time series anomaly detection device based on a function approximation network, characterized in that: Deployed on a computing device, the computing device is deployed with a monitoring system, the monitoring system is used to monitor multiple key performance indicators KPI in the computing device, the device includes: An acquisition module, used to acquire a historical feature vector of any one of the multiple key performance indicators KPIs at a current time t; A processing module, used for training a prediction model based on multiple historical feature vectors at different times; the prediction model is a function approximation network model; The processing module is further used to predict the feature vector at time t by using the trained prediction model to determine the predicted feature vector; The processing module further determines whether any one of the KPI data is abnormal based on the predicted feature vector and a vector of a true value of any one of the KPI data at time t.

Images