A time series anomaly detection method and device based on a function approximation network

Abstract

A time series anomaly detection method based on a function approximation network is applied to a computing device, the computing device is deployed with a monitoring system, the monitoring system is used to monitor a plurality of key performance indicators KPIs in the computing device, and the method comprises: obtaining a historical feature vector of any one KPI data in the plurality of key performance indicators KPIs at a current time t; training a prediction model based on a plurality of historical feature vectors at different times; the prediction model is a function approximation network model; predicting the feature vector at time t through the trained prediction model to determine the predicted feature vector; and determining whether any one KPI data is abnormal based on the predicted feature vector and the vector of the true value of any one KPI data at time t. The method can model the dependency relationship between indicators in a fine-grained manner and improve the accuracy of anomaly detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a time series anomaly detection method and device based on a function approximation network. BACKGROUND

[0002] With the rapid development of Internet applications and the rapid increase in the number of users, it is crucial to ensure the stability of Internet application systems. In order to ensure the smooth operation of Internet application services, an operation and maintenance personnel will deploy a monitoring system in the system to monitor a plurality of key performance indicators (KPIs) in the system in real time, including but not limited to central processing unit (CPU) utilization, page visits per minute, and the like. Through the KPIs, it can be known whether the system is in a normal operating state. However, in a large Internet service, there can be tens of thousands or even hundreds of thousands of KPIs to be monitored. Therefore, how to determine that a system service is abnormal in a large amount of KPI data has become a problem to be solved. SUMMARY

[0003] In order to solve the problems in the prior art, the embodiments of the present application provide a time series anomaly detection method and device based on a function approximation network, a computing device, a computer storage medium, and a product containing a computer program, which can model the dependency relationship between indicators in a fine-grained manner and improve the accuracy of anomaly detection.

[0004] In a first aspect, the embodiments of the present application provide a time series anomaly detection method based on a function approximation network, applied to a computing device, the computing device being deployed with a monitoring system, the monitoring system being configured to monitor a plurality of key performance indicators (KPIs) in the computing device. The method comprises: obtaining a historical feature vector of any one KPI data in the plurality of KPIs at a current time t; training a prediction model based on a plurality of historical feature vectors at different times; the prediction model being a function approximation network model; predicting the feature vector at time t through the trained prediction model to determine a predicted feature vector; and determining whether any one KPI data is abnormal based on the predicted feature vector and a true value vector of the KPI data at time t.

[0005] In some possible implementation manners, the historical feature vector of any one of the plurality of KPIs at the current time t is obtained by: obtaining KPI data stored in the computing device; performing difference and normalization processing on each of the KPI data to determine a KPI data row matrix; each row in the KPI data matrix represents a type of KPI data; any one row is selected as any one type of KPI data; and according to a pre-set fixed-size sliding time window, the KPI data of the size of the sliding time window is determined by selecting from any one type of KPI data; and the feature vector of the KPI data of the size of the sliding time window is determined as the historical feature data.

[0006] In some possible implementation manners, the KPI data is subjected to difference and normalization processing according to the following formula:

[0007]

[0008] In the formula, v represents the processed KPI data value, v1 represents the first-order forward difference value of the KPI data in the corresponding dimension, v mean represents the mean value of the KPI data after the first-order forward difference in the corresponding dimension, v std represents the standard deviation of the KPI data after the first-order forward difference in the corresponding dimension.

[0009] In some possible implementation manners, the prediction model is trained by: transforming and combining the historical feature vector using a plurality of predefined basis functions to determine a basis function feature matrix; using the basis function feature matrix as an input of the prediction model to determine the weight of each basis function in the basis function feature matrix; and integrating the weight of each basis function to determine the prediction model.

[0010] In some possible implementation manners, the function approximation network includes a convolutional neural network and a feedforward neural network, and the prediction model is trained by: performing nonlinear transformation on the normalized KPI data to determine a basis function feature matrix, the basis function feature matrix being used to reduce the number of parameters; using the basis function feature matrix as an input of the convolutional neural network, the weight of the basis function being included in the parameters of the convolutional neural network; and inputting the output result of the convolutional neural network into the feedforward neural network.

[0011] In some possible implementation manners, the basis function is any one of a trigonometric function and an exponential function, or a combination of a plurality of trigonometric functions and exponential functions.

[0012] In some possible implementation manners, the predicted feature vector is determined, specifically including: inputting the historical feature vector of any one KPI data at the time t into a convolutional neural network to determine a characteristic feature vector of the any one KPI data; and processing the characteristic feature vector through a feedforward neural network to determine the predicted feature vector of the any one KPI data at the time t.

[0013] In some possible implementation manners, the predicted feature vector is determined according to the following formula:

[0014] y t = h (FAN (F (w t ))

[0015] In the formula, y t represents the predicted feature vector at the time t, h represents a mapping function of the KPI data, FAN represents a function approximation network, F represents a base function group, w t represents a historical feature vector of the KPI data at the time t.

[0016] In some possible implementation manners, whether the any one KPI data is abnormal is determined, specifically including: calculating a distance between the predicted feature vector and a real value vector; and determining that the any one KPI data is abnormal at the time t in a case where the distance is greater than a preset threshold.

[0017] In a second aspect, an embodiment of the present application provides a time series anomaly detection device based on a function approximation network, which is deployed on a computing device, the computing device is deployed with a monitoring system, the monitoring system is used to monitor a plurality of key performance indicators KPIs in the computing device, and the device includes: an acquisition module configured to acquire a historical feature vector of any one KPI data in the plurality of key performance indicators KPIs at a current time t; and a processing module configured to train a prediction model based on a plurality of historical feature vectors at different times, the prediction model being a function approximation network model, the processing module is further configured to predict a feature vector at the time t through the trained prediction model to determine a predicted feature vector, and the processing module is further configured to determine whether any one KPI data is abnormal based on the predicted feature vector and a real value vector of the any one KPI data at the time t.

[0018] In a third aspect, an embodiment of the present application provides a computer readable storage medium, including computer readable instructions, when a computer reads and executes the computer readable instructions, the computer executes the method in any one of the first aspect.

[0019] In a fourth aspect, an embodiment of the present application provides a computing device including a processor and a memory, wherein the memory stores computer program instructions, and the computer program instructions are executed by the processor to execute the method in any one of the first aspect.

[0020] In a fifth aspect, an embodiment of the present application provides a product containing a computer program, which, when running on a processor, causes the processor to execute the method according to any one of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0022] Figure 1 is a flowchart of an anomaly detection method provided by an embodiment of the present application;

[0023] Figure 2 is a schematic diagram of a KPI data matrix provided by an embodiment of the present application;

[0024] Figure 3 is a process schematic diagram of model prediction provided by an embodiment of the present application;

[0025] Figure 4 is a flowchart of a function approximation network processing KPI data provided by an embodiment of the present application;

[0026] Figure 5 is a structural schematic diagram of an anomaly detection apparatus provided by an embodiment of the present application;

[0027] Figure 6 is a structural schematic diagram of a computing device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort belong to the scope of protection of the present application.

[0029] The term "and / or" in this document is a description of the association relationship of the associated objects, which means that there can be three kinds of relationships, for example, A and / or B can mean that there are three cases of A alone, A and B together, and B alone. The symbol " / " in this document represents an or relationship of associated objects, for example, A / B represents A or B.

[0030] The terms "first" and "second" and the like in the description and claims of this patent document are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. For example, the first response message and the second response message are used for distinguishing between similar messages and not necessarily for describing a particular sequential or chronological order.

[0031] In the present application embodiments, the words "exemplary" and "for example" are used to mean serving as an example, instance, or illustration, at 5 2 least with respect to the matters to which they relate. For example, the

[0032] In the description of present application embodiments, unless otherwise specified, "a plurality of" means two or more, for example, a plurality of processing units means two or more processing units, and the like; a plurality of elements means two or more elements, and the like.

[0033] For the purpose of clarity, further explanation will be made with specific embodiments in connection with the accompanying drawings, which do not limit the present application embodiments.

[0034] In system service, the monitoring system usually collects a plurality of KPI data according to a certain time period (for example, every 10s, 1min, etc.), stores the collected KPI data, so that the KPI data forms a multi-dimensional time series data, in which each data point corresponds to the value of a certain KPI data at a certain data collection time. The correlation between the KPI time series and its historical change trend is called time series dependency relationship, and the correlation between different indicators is called inter-indicator dependency relationship. For example, at a certain time, the CPU utilization is high, and the memory utilization is also high, and the CPU utilization and the memory utilization are inter-indicator dependency relationship. The normal range of the KPI time series dependency relationship and the inter-indicator dependency relationship is preset, including threshold (for example, maximum threshold and minimum threshold), linear programming, etc.

[0035] Then, the user (for example: operation and maintenance personnel) can compare the current KPI time series with the historical change mode and trend of the KPI data, and see whether the comparison result matches. When an anomaly occurs, it means that the KPI data value at a certain time point is out of the normal range of the time series dependency relationship and the inter-indicator dependency relationship, and this KPI data at the time point can be called an abnormal point.

[0036] Although this can perform anomaly detection, the detection of abnormal points in an artificial manner requires users to have knowledge in the relevant field and invest a lot of effort, and in the case of a large amount of data, this manner requires extremely high human cost, which is not very realistic in modern Internet systems that produce high-dimensional massive data at all times.

[0037] Therefore, an embodiment of the present application provides an anomaly detection method, which is a time series anomaly detection method based on a function approximation network. The KPI data at the current time is predicted by a pre-trained prediction model, the distance between the predicted KPI data and the real KPI data is judged, and the KPI data is determined to be abnormal, i.e., the system service is abnormal, if the distance exceeds a threshold. The detection effect of this method is more accurate, and no manual intervention is required throughout the process, which can save a lot of human cost. The method will be described in detail below with reference to the accompanying drawings.

[0038] Exemplarily, Figure 1 is a flowchart of an anomaly detection method provided by an embodiment of the present application, which is applied to anomaly detection of single-dimensional KPI data. As Figure 1 shown, the anomaly detection method comprises the following steps:

[0039] S11: Obtain the historical feature vector of the KPI data under the single dimension at the current time t.

[0040] In this embodiment, the stored single-dimensional KPI data can be obtained in the storage medium. Each KPI data is collected according to a certain time period (for example, every 10s, 1min, etc.), and each dimensional KPI data is stored in the storage medium in time sequence. The storage medium can be a database. After obtaining the KPI data, the historical feature vector of each dimensional KPI data can be determined. The historical feature vector is used to represent the feature vector before time t. When determining the historical feature vector of the KPI data, the collected single-dimensional KPI data is first differentiated and then normalized to determine the KPI data matrix. In the KPI data matrix, each element is in the same dimension. The KPI data sorted in time sequence is obtained, a pre-set fixed-size sliding time window is used to slide on the KPI data sorted in time sequence, and a fixed-length KPI data is selected. The size of the sliding time window is denoted as w, and there is 1≤w Figure 2 , Figure 2is a schematic diagram of a KPI data matrix provided by an embodiment of the present application. As shown in the matrix, each column represents KPI data at a time. Figure 2 The KPI data at time t is denoted as x t , and the size of the sliding time window is denoted as w. At time t, the historical feature vector can be represented as [x t-w ,…,x t-1 ].

[0041] In some possible embodiments, the normalization process can be as follows: calculate the features of the first-order forward difference one-dimensional KPI data, which include the mean and the standard deviation. Denote the mean as v mean and the standard deviation as v std . Based on the features of the dimension, scale the KPI data to the same dimension to obtain the KPI data to be processed.

[0042] In some possible embodiments, the specific formula for scaling the KPI data is as follows:

[0043]

[0044] In the formula, v represents the scaled KPI data value, v1 represents the value of the first-order forward difference of the KPI data in the dimension, v mean represents the mean of the first-order forward difference of the KPI data in the dimension, and v std represents the standard deviation of the first-order forward difference of the KPI data in the dimension.

[0045] S12: Train the prediction model based on the plurality of historical feature vectors.

[0046] In the present embodiment, after obtaining the historical feature vectors of a plurality of historical times t (i.e., times t, t-1, t-2, etc.), the historical feature vectors can be integrated into a training set. Through the data in the training set, the KPI prediction model is trained. Specifically, after obtaining the feature vector of the one-dimensional KPI data, the prediction model can be constructed according to the one-dimensional KPI data and the feature vector thereof, so that the prediction model can be trained unsupervisedly. The prediction model is a function approximation network model.

[0047] In some possible embodiments, the function approximation network model is a neural network model.

[0048] In this embodiment, during training, the convolutional neural network can calculate the weights of each basis function feature vector based on the input of the current basis function feature matrix. Basis functions are used to perform nonlinear transformations on the normalized KPI data, reducing the number of parameters. Basis functions can be nonlinear, such as nonlinearly transformed trigonometric functions, or nonlinear functions such as exponential functions, or any combination thereof, such as a combination of multiple trigonometric functions (e.g., sin(x) / sin(x)+cos(x)). In this embodiment, trigonometric functions can be selected as basis functions, such as cos(x), sin(x), cos(2x), sin(2x), etc. Each trigonometric function serves as a basis function, and multiple basis functions can form a set of basis functions. For example, cos(x) is a basis function, and cos(x), cos(2x), ..., cos(nx) form a set of basis functions. The convolutional neural network model performs weighted fusion of the output results to obtain the final model output. Please refer to... Figure 3 , Figure 3 A schematic diagram illustrating the model prediction process provided in an embodiment of this application is shown. Figure 3 As shown, in this embodiment, a function approximation network is used to extract features from the historical feature vectors at time t. During feature vector extraction, the feature vector at the current time t is input into the function approximation network. The feature vectors are transformed and combined using a predefined set of basis functions to obtain the basis function feature matrix. Then, after feeding the basis function feature matrix into the function approximation network, the independent weights of each basis function feature vector are obtained. These independent weights are then combined to determine the function approximation network model. This function approximation network model can significantly compress model parameters. By introducing the basis function feature matrix and directly learning its coefficients, the number of model parameters is reduced, improving efficiency.

[0049] S13: Using the trained prediction model, predict the feature vector at time t and determine the predicted feature vector.

[0050] In this embodiment, after the model has been trained, the trained prediction model can be used to predict the feature vector at time t, thus obtaining the predicted vector of the KPI data at time t. For example, Figure 4 This illustration shows a structural diagram of a function approximation network for processing KPI data, as provided in an embodiment of this application. Figure 4As shown, the function approximation network comprises a convolutional neural network and a layer of feedforward neural network. When the function approximation network processes the feature vector, the feature vector is first transformed using a predefined set of basis functions to form a basis function feature matrix, and then the convolutional neural network is used to process the basis function feature matrix to obtain a characteristic feature vector containing KPI data. The characteristic feature vector is input into the feedforward neural network, and after processing by the feedforward neural network, a prediction vector of the KPI data at time t can be obtained.

[0051] In some possible embodiments, the determination of the prediction feature vector can be calculated according to the following formula:

[0052] y t = h (FAN (F (w t ))

[0053] In the formula, y t represents the prediction feature vector at time t, h represents the mapping function of the KPI data, FAN represents the function approximation network, F represents the basis function set, w t represents the historical feature vector of the KPI data at time t.

[0054] S14: Based on the prediction feature vector and the vector of the actual KPI data value, determine whether the KPI data is abnormal.

[0055] In this embodiment, after obtaining the prediction feature vector at time t, the real-time collected KPI data can be obtained from the data acquisition system, and the real-time data is the true value of the KPI data. The true value of the KPI data at time t is scaled, and the values of each dimension are scaled to the same dimension. When scaling, the same scaling formula used for normalization processing when obtaining the historical feature vector at time t is used. The vector of the scaled KPI data true value is denoted as x t After obtaining the prediction vector and the vector of the true value of the KPI data at time t, the distance between the prediction vector and the vector of the true value can be calculated, and the distance is taken as an abnormal score. In the case where the abnormal score is greater than a preset threshold, it indicates that the real KPI data at time t has a large difference with the estimated normal value, and the data at this time is likely to violate the time sequence dependence and the dependence between indicators of the KPI data, and it is determined that the KPI data at time t is abnormal. When the abnormality occurs, an abnormal alarm can be performed so that the user can process the abnormality.

[0056] In some possible embodiments, the distance between the prediction feature vector and the vector of the true value can be the Euclidean distance, denoted as

[0057] From the above various embodiments, the method provided by the application can obtain historical KPI data, process the historical KPI data, obtain various parameters in the prediction model, determine the various parameters in the model, predict the KPI data at the current time based on the historical KPI data, obtain the real KPI data at the current time, and determine the distance between the predicted data and the real data. In the case where the distance exceeds the threshold value, it is indicated that the data at this time is likely to violate the time sequence dependence relationship and the dependence relationship between indicators of the KPI data, and may be abnormal data, and the user can be prompted to process the anomaly. The method does not require human intervention throughout, and can reduce a large amount of human cost. Through the method, the dependence relationship between indicators can be modeled in a fine-grained manner, the accuracy of anomaly detection is improved, and the detection effect in the KPI anomaly detection scene is significantly improved.

[0058] It can be understood that the size of the serial number of each step in the above various embodiments does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the application. In addition, in some possible implementations, each step in the above embodiments can be selectively executed, partially executed, or fully executed according to actual conditions, which is not limited here. All or part of any feature of any embodiment of the application can be freely and arbitrarily combined under the premise of no contradiction. The combined technical solution is also within the scope of the application.

[0059] Based on the method in the above embodiments, the embodiments of the application also provide a time series anomaly detection device based on a function approximation network. Exemplarily, Figure 5 An anomaly detection device is shown, which is deployed in a computing device, and the computing device is deployed with a monitoring system for monitoring a plurality of key performance indicators KPI in the computing device. The anomaly detection device comprises an acquisition module 501 and a processing module 502.

[0060] The acquisition module 501 is configured to acquire a historical feature vector of any one KPI data in the plurality of key performance indicators KPI at a current time t.

[0061] The processing module 502 is configured to train a prediction model based on a plurality of historical feature vectors at different times. The prediction model is a function approximation network model.

[0062] The processing module 502 is further configured to predict the feature vector at time t through the trained prediction model, and determine a predicted feature vector.

[0063] The processing module 502 is further configured to determine whether any one KPI data is abnormal based on the predicted feature vector and a real value vector of the KPI data at time t.

[0064] It should be understood that the above device is used to execute the method in the above embodiment, the corresponding program module in the device, the implementation principle and technical effect are similar to the description in the above method, and the working process of the device can refer to the corresponding process in the above method, which will not be described here.

[0065] The present application also provides a computing device 600. As shown in the figure, the computing device 600 includes a bus 602, a processor 604, a memory 606 and a communication interface 608. The processor 604, the memory 606 and the communication interface 608 communicate through the bus 602. The computing device 600 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 600. Figure 6

[0066] The bus 602 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For the convenience of representation, Figure 6 only one line is used, but it does not mean that there is only one bus or one type of bus. The bus 604 can include a channel for transmitting information between various components of the computing device 600 (for example, the memory 606, the processor 604, the communication interface 608).

[0067] The processor 604 can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP) processor, etc.

[0068] The memory 606 can include a volatile memory (volatile memory), such as a random access memory (RAM). The processor 604 can also include a non-volatile memory (non-volatile memory), such as a read-only memory (ROM), a flash memory, a mechanical hard disk drive (HDD) or a solid state drive (SSD).

[0069] ​The executable program code stored in the memory 606 is executed by the processor 604 to realize the functions of the aforementioned acquisition module 501 and processing module 502 respectively, so as to realize all or part of the steps of the method in the above embodiments. That is, the memory 606 stores instructions for executing all or part of the steps of the method in the above embodiments.

[0070] Alternatively, the executable program code stored in the memory 606 is executed by the processor 604 to realize the functions of the aforementioned exception detection apparatus 700 respectively, so as to realize all or part of the steps of the method in the above embodiments. That is, the memory 606 stores instructions for executing all or part of the steps of the method in the above embodiments.

[0071] The communication interface 608 uses a transceiver module such as, but not limited to, a network interface card and a transceiver, to realize the communication between the computing device 600 and other devices or communication networks.

[0072] Based on the method in the above embodiments, the embodiments of the present application provide a computer readable storage medium, which stores a computer program. When the computer program is run on a processor, the processor executes the method in the above embodiments.

[0073] Based on the method in the above embodiments, the embodiments of the present application provide a computer program product, which, when run on a processor, makes the processor execute the method in the above embodiments.

[0074] It can be understood that the processor in the embodiments of the present application can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0075] The method steps in the embodiments of the present application can be implemented by hardware, or by a combination of software and hardware executed by a processor. The software instructions can be composed of a corresponding software module, which can be stored in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read-only memory (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), a register, a hard disk, a mobile hard disk, a CD-ROM, or any other form of storage medium well known in the art. An exemplary storage medium is coupled to a processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0076] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transmitted by the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

[0077] It can be understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of differentiation, and do not limit the scope of the embodiments of the present application.

Claims

1. A time series anomaly detection method based on function approximation networks, characterized in that, Applied to a computing device, the computing device being equipped with a monitoring system, the monitoring system being used to monitor multiple key performance indicators (KPIs) in the computing device, the method includes: Obtain the historical feature vector of any one of the multiple key performance indicators (KPIs) at the current time t. A prediction model is trained based on multiple historical feature vectors at different times. The prediction model is a function approximation network model, which includes a convolutional neural network and a feedforward neural network. Training the prediction model includes: transforming and combining the historical feature vectors using multiple predefined basis functions to determine a basis function feature matrix, which is used to reduce the number of parameters; using the basis function feature matrix as input to the convolutional neural network, the parameters of which include the weights of the basis functions; and inputting the output of the convolutional neural network into the feedforward neural network to determine the prediction model. The basis functions are any one of trigonometric functions and exponential functions, or a combination of multiple trigonometric functions and / or exponential functions. The prediction model, after training, predicts the feature vector at time t and determines the predicted feature vector, including: inputting the historical feature vector of any KPI data at time t into the convolutional neural network to determine the characteristic feature vector of any KPI data; and processing the characteristic feature vector through the feedforward neural network to determine the predicted feature vector of any KPI data at time t. Based on the predicted feature vector and the vector of the true value of any KPI data at time t, it is determined whether any KPI data is abnormal.

2. The method according to claim 1, characterized in that, The step of obtaining the historical feature vector of any one of the multiple key performance indicators (KPIs) at the current time t includes: Obtain the KPI data stored in the computing device; After differentiating each data point in the KPI data, normalization is performed to determine the KPI data matrix; each row in the KPI data matrix represents a type of KPI data; any row is randomly selected as any type of KPI data. Based on a pre-set fixed-size sliding time window, select from any type of KPI data to determine the size of the sliding time window; The feature vector of the KPI data with a determined sliding time window size is used as the historical feature vector.

3. The method according to claim 2, characterized in that, The KPI data is then normalized after differencing, according to the following formula: In the formula, Characterizes the processed KPI data values. This represents the value of the first-order forward difference of the KPI data within its respective dimension. This represents the mean of the KPI data after first-order forward differencing within its respective dimension. The standard deviation of KPI data after first-order forward differencing in its respective dimension.

4. The method according to claim 1, characterized in that, The predicted feature vector is determined according to the following formula: In the formula, The predicted feature vector representing time t. Mapping function representing KPI data, The representation function approximates the network. Characterize the basis function set, The historical feature vector representing the KPI data at time t.

5. The method according to claim 1, characterized in that, The specific steps for determining whether any one of the KPI data points is abnormal are as follows: Calculate the distance between the predicted feature vector and the vector of the true value; If the distance is greater than a preset threshold, it is determined that any one of the KPI data points is abnormal at time t.

6. A time series anomaly detection device based on a function approximation network, characterized in that, Deployed on a computing device, the computing device having a monitoring system, the monitoring system being used to monitor multiple key performance indicators (KPIs) of the computing device, the device comprising: The acquisition module is used to acquire the historical feature vector of any one of the multiple key performance indicators (KPIs) at the current time t. A processing module is used to train a prediction model based on multiple historical feature vectors at different times. The prediction model is a function approximation network model, wherein the function approximation network includes a convolutional neural network and a feedforward neural network. The training of the prediction model includes: transforming and combining the historical feature vectors using multiple predefined basis functions to determine a basis function feature matrix, which is used to reduce the number of parameters; using the basis function feature matrix as input to the convolutional neural network, the parameters of which include the weights of the basis functions; and inputting the output of the convolutional neural network into the feedforward neural network to determine the prediction model. The basis functions are any one of trigonometric functions and exponential functions, or a combination of multiple trigonometric functions and / or exponential functions. The processing module is further configured to predict the feature vector at time t using the trained prediction model, and determine the predicted feature vector, including: inputting the historical feature vector of any KPI data at time t into the convolutional neural network to determine the characteristic feature vector of any KPI data; and processing the characteristic feature vector through the feedforward neural network to determine the predicted feature vector of any KPI data at time t. The processing module further determines whether any one of the KPI data points is abnormal based on the predicted feature vector and the vector of the true value of any one of the KPI data points at time t.

Images