System anomaly detection method for adaptively fusing multi-dimensional sequence data

Abstract

The invention discloses a system anomaly detection method for adaptively fusing multi-dimensional sequence data. The method comprises the following steps: firstly, collecting original monitoring data related to time in a system execution stage, carrying out digital coding on the original monitoring data in a non-digital format, then carrying out normalization processing to obtain a multi-dimensional time sequence # imgabs0 #, then reconstructing the multi-dimensional time sequence # imgabs1 # through a time sequence reconstruction model, and calculating a data difference value before and after reconstruction, and a reconstruction difference value sequence X is obtained. And constructing a feature space for the data distribution of the reconstructed difference sequence X, and repeating for t times. And calculating a feature vector of the reconstructed difference sequence X based on the feature space constructed by t times of experiments. Dividing the feature vector of the reconstructed difference sequence X into a plurality of subsequences by using a sliding window with a fixed length; and finally, calculating the similarity between different subsequences by using kernel mean value embedding, and judging the time corresponding to the subsequences of which the similarity is smaller than a threshold value as the abnormal operation moment of the system. And multi-dimensional time series data are effectively utilized.

Description

Technical Field

[0001] The present invention belongs to the technical field of data analysis, relates to system abnormal operation detection of a large-scale Internet service center, and specifically relates to a system abnormality detection method for adaptively fusing multi-dimensional sequence data. Background Art

[0002] There are two problems with abnormal data detection in large Internet service centers: 1. Monitoring entities in large service clusters usually have a large amount of monitoring data to reflect various aspects of their health status. These monitoring data contain information on multiple dimensions, so abnormal states may manifest as complex interactions between data in multiple dimensions, such as shifts in data distribution, changes in clustering structure, and increases or decreases in correlation, rather than significant deviations in a single dimension. 2. Supervised anomaly detection algorithms require accurate anomaly labels, but due to the complexity of time series anomaly labeling and the massiveness of data, obtaining high-quality labels is a challenging problem.

[0003] The existing technologies have proposed different solutions to the problem of time series anomaly detection. For example, time series decomposition, which decomposes a one-dimensional time series into a two-dimensional time series with periodic information, is typically represented by TimesNet. The problem is that it gives the same importance to each dimension of the multidimensional time series and does not take advantage of the multidimensional time series. The graph attention network approach, which converts the time series into a graph and then uses the attention mechanism to fuse the information of key dimensions and adjacent time points for anomaly detection, is typically represented by MAD-STA. However, the learning of the graph attention network is heavily dependent on the quality of the graph structure. Constructing a graph that can express the complex relationship of multidimensional time series is a challenging problem. Secondly, graph neural networks are difficult to train. The complexity of time series makes it difficult to obtain a model with strong generalization ability.

[0004] In summary, it is very important to design a system operation anomaly detection method for multidimensional time series, make full use of the characteristics of multidimensional time series, and perform anomaly detection without using labels, so as to detect anomalies in time, take response measures before the anomalies have an adverse impact on the system, reduce the impact of anomalies on system performance, and improve the stability and reliability of the system. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention proposes a system anomaly detection method that adaptively fuses multidimensional sequence data. By collecting and analyzing the corresponding monitoring data, the method calculates the similarity of multidimensional time series to identify potential anomalies in the system operation. Abnormal labels are not included, so that the system can maintain good performance when performing different tasks, solving the problem that the existing anomaly detection methods lack effective use of multidimensional time series data.

[0006] A method for detecting system anomalies by adaptively fusing multidimensional sequence data, comprising the following steps:

[0007] Step 1: Collect the original monitoring data related to time during the system execution phase. The monitoring data includes multi-dimensional monitoring indicators, i.e., multi-dimensional sequence data. The original monitoring data in non-digital format is digitized and then normalized to obtain a multi-dimensional time series.

[0008] Step 2: Reconstruct the multidimensional time series through the time series reconstruction model Reconstruct and calculate the data difference before and after reconstruction to obtain the reconstructed difference sequence X.

[0009] Step 3: Construct a feature space for the data distribution of the reconstructed difference sequence X and repeat t times.

[0010] Step 4: Based on the feature space constructed by t experiments, calculate the isolated kernel feature vector of the reconstructed difference sequence X according to the position of the data point in the feature space.

[0011] Step 5: Use a sliding window of fixed length to divide the reconstructed difference sequence X feature vector into multiple subsequences.

[0012] Step 6: Use kernel mean embedding to calculate the similarity between different subsequences, and determine that the time corresponding to the subsequence with a similarity less than a threshold is the time when the system is running abnormally.

[0013] The present invention has the following beneficial effects:

[0014] 1. Compared with the traditional method of setting a threshold for each dimension of the reconstructed data, this application fully utilizes the advantages of multidimensional time series by constructing a feature space for reconstructing the data distribution of the difference sequence X, excavates the rich information contained in the multidimensional data, and solves the challenges brought by setting multidimensional thresholds.

[0015] 2. Not using label information reduces the cost of manual labeling, avoids human errors introduced by the labeler's bias, and improves the accuracy of the model. At the same time, not including abnormal labels can also make the model more easily adapt to data changes, avoiding frequent re-labeling of data in an environment where data distribution changes dynamically.

[0016] 3. Using the difference after the time series reconstruction algorithm instead of directly using the original time series for correlation calculation solves the noise problem of the original data and clearly represents the originally hidden data features, which helps to simplify the subsequent anomaly detection process and improve the accuracy of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 Schematic diagram of a systematic anomaly detection method for adaptively fusing multi-dimensional sequence data;

[0018] Figure 2 This is a schematic diagram of a feature space established in an experiment in the embodiment;

[0019] Figure 3 This is a schematic diagram of the feature space established in the secondary experiment in the embodiment;

[0020] Figure 4 This is a schematic diagram of the time window to be detected in the embodiment;

[0021] Figure 5 Schematic diagram of historical data division for online detection. DETAILED DESCRIPTION

[0022] The present invention is further explained below in conjunction with the accompanying drawings; this embodiment takes Metrics data as an example to introduce a system anomaly detection method that adaptively fuses multi-dimensional sequence data, and how to identify potential anomalies in system operation by analyzing system monitoring data. The specific steps are as follows:

[0023] Step 1: Data preparation

[0024] The Metrics data includes a series of system-level indicators and user-perceived indicators, such as CPU utilization, memory utilization, and average response time, which are multi-dimensional digital data collected at certain time intervals. First, normalize to get the cleaned data

[0025]

[0026] It is a time series The value at timestamp i and dimension j, 1≤i≤N,1≤j≤D,N is a time series The length of time, D is the number of dimensions. represents the sequence of the jth dimension, yes The minimum value of yes e>0 is a minimum value that prevents the denominator from being zero.

[0027] Step 2: Construct the data distribution of multidimensional time series difference sequence

[0028] like Figure 1As shown, the normalized time series is reconstructed using the time series reconstruction model TSM (Time Series reconstruction Model) Reconstruct and output multidimensional reconstruction sequence Then in the reconstruction sequence Calculate the same value in each dimension as The reconstruction error between them is output as the corresponding reconstructed difference sequence of multidimensional time series.

[0029] The time series reconstruction model TSM is a deep learning model, specifically one of an autoencoder (AutoEncoder), a variational autoencoder (VariationalAutoencoder), a recurrent neural network (RecurrentNeuralNetworks), a long short-term memory network (LongShort-TermMemoryNetworks), a diffusion model (DiffusionModel), a temporal convolutional network (TemporalConvolutionalNetwork) or a generative adversarial network (GenerativeAdversarialNetworks).

[0030] By generating the data distribution of the difference sequence, in the subsequent anomaly detection, the similarity comparison is performed based on the data distribution of the difference sequence rather than the absolute size of a single data. This can effectively process sequences with different absolute sizes but similar data distributions, thereby adaptively responding to changes in the difference sequence.

[0031] Step 3: Construct the feature space of difference distribution

[0032] From the reconstruction difference sequence of multidimensional time series X = {x1,…,x N} randomly extract ψ vectors Θ={θ1,…,θ ψ}, each vector corresponds to the coordinates of the center of a hypersphere, and each hypersphere θ k The radius r k is the same as the hypersphere θ k The minimum distance between the centers of other spheres other than k =min(dist(θ k ,Θ-{θ k})),in It means to calculate the distance between two vectors, m, k = 1, ..., ψ, and m ≠ k. Each hypersphere represents a partitioned subspace.

[0033] Based on the Monte Carlo method, the above method is repeated t times independently to obtain t segmentation results. Each segmentation method can obtain ψ hyperspheres.

[0034] This processing method enables the difference distribution to be mapped to the feature space, and fully considers the semantic information of each dimension in the D-dimensional space. Compared with the traditional method of anomaly detection based on single-dimensional reconstruction of differences, this method can more comprehensively understand the data characteristics, thereby significantly improving the accuracy of anomaly detection.

[0035] Step 4: Adaptive feature mapping of difference distribution

[0036] Determine a partition H l , including the range of ψ hyperspheres under the one-time segmentation method, l = 1,…,t. Define a ψ-dimensional binary column vector Φ l (x i )={Φ l,1 (x i ),…,Φ l,k (x i ),…Φ l,ψ (x i )}, for the reconstructed difference sequence X = {x1,…,x N Any vector x in} i , either falls into only one of these ψ hyperspheres, or does not fall into any hypersphere. If min(dist(x i ,Θ)) <r k , indicating point x i Falling on the hypersphere θ k In the equation, let Φ l,k (x i )=1, otherwise Φ l,k (x i )=0.

[0037] For a given t types of segmentation results, is composed of t binary column vectors Φ1(x i ),…,Φ t (x i ), M = t × ψ. As the feature vector of the reconstructed difference sequence X.

[0038] Figure 2 , 3 Two different results of space division are shown, where the red dot represents the center of the hypersphere, and θ1 to θ3 are the three subspaces divided in one experiment. Figure 2 In , point x1 falls into θ2, so Φ1(x1) = {0,1,0}, and point x2 falls into θ3, so Φ1(x2) = {0,0,1}. Figure 3Among them, the point x1 falls into θ1, so Φ2(x1) = {1, 0, 0}. After two experiments, Φ(x1) is composed of Φ1(x1) and Φ2(x1) spliced together, so Φ(x1) = {0, 1, 0, 1, 0, 0}.

[0039] This processing method represents the data distribution of the difference sequence as a vector in the feature space. When calculating the similarity, it is calculated based on different feature vectors mapped from different distributions. Therefore, the comparison strategy can be adaptively adjusted according to the difference distribution.

[0040] Step 5: Construct the difference sequence distribution of the time window to be detected

[0041] Construct a time window S to be detected with a length of L v , v = 1, 2, … N - L + 1, 0 < L < N, and the specific value of L is set according to actual needs. Through the time window S to be detected v Convert the feature vector Φ(X) of the reconstructed difference sequence X into a sliding window sequence As Figure 4 shown, set L = 4, then the reconstructed difference sequence X with a length of 8 can be divided into 5 time windows to be detected in sequence.

[0042] Through windowing, the feature vector of the difference sequence for a continuous period of time is converted into a distribution. Compared with a single time point, this method considers the semantic information of the data in the time dimension, converts the difference distribution into a difference window with a fixed period, enables the system to adaptively respond to changes in the difference data distribution, and thus improves the sensitivity and accuracy of anomaly detection.

[0043] Step 6: Calculate the adaptive similarity of the difference sequence

[0044] For the feature vector of any given difference window sequence with a length of L Use the isolated kernel feature mean to replace the feature vector of the difference window sequence S v

[0045] For any two feature vectors of the difference window sequence S v 、S u , their similarity The calculation method is as follows:

[0046]

[0047] Among them, u ≠ v, <,> represents the multiplication calculation between matrices.

[0048] ​The difference distribution of the time window is mapped to a feature vector in the feature space, and then the kernel mean embedding is used to calculate the similarity between the difference distributions of the two time windows. Since the difference distributions of different time windows can be represented by different feature vectors in the feature space, the comparison strategy can be adaptively adjusted according to the changes in the difference data. This method can be used to process differences with large absolute size differences that may appear in the windows to be detected in different periods. Unlike the traditional anomaly detection method based on difference threshold, the anomaly detection method based on similarity calculation can adaptively compare the distribution of difference data in the time window, thereby maintaining the relative stability of the similarity calculation and improving the stability of anomaly detection.

[0049] Step 7: System anomaly detection

[0050] Anomaly detection is performed based on the similarity calculation results. The specific method is as follows:

[0051] s7.1. Offline anomaly detection

[0052] Given the abnormal data in the entire time series The proportion of The similarity with the normal subsequence is high, and the similarity with the abnormal subsequence is low. Therefore, the complete time series is converted into The reconstructed difference sequence X is divided into multiple subsequences, and then the similarity between each subsequence and the complete reconstructed difference sequence X is calculated in turn. Set a threshold τ1, if The current window to be detected is determined to be an abnormal time period.

[0053] As an embodiment, the method for determining the threshold τ1 is: arrange the similarity scores of all windows to be detected in ascending order to obtain an array Score with a length of N-L+1, and select a similarity score from Score as the threshold τ1 according to a preset abnormality rate.

[0054] s7.2, Online Anomaly Detection

[0055] For the online monitoring of system operation data, the similarity between the data to be detected S and the historical data T is calculated and compared with the set threshold τ2. The data to be detected whose similarity with the historical data is less than the threshold τ2 is identified as abnormal data.

[0056] It should be noted that with the change of time, the historical data T will also change, such as Figure 5As shown in the figure, at the current moment, historical data T = {x1, x2, x3, x4, x5}, and the data to be detected S = {x6, x7, x8}. At the next moment, historical data T = {x1, x2, x3, x4, x5, x6}, and the data to be detected S = {x7, x8, x9}. By continuously adding the new data after detection to the queue of historical data and updating the historical data information, the adaptive optimization of online detection is realized.

[0057] It should be noted that the contents not described in detail in this specification belong to the prior art known to the professional and technical personnel in this field. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for the technical personnel in this field to modify the technical solutions recorded in the aforementioned embodiments, or to replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A system anomaly detection method for adaptively fusing multi-dimensional sequence data, collecting time-related raw monitoring data during the system execution phase for anomaly detection, characterized by: The specific steps are as follows: Step 1: Digitally encode the original monitoring data in non-digital format to obtain a multidimensional time series Where N is the length of the time series; Step 2: Reconstruct the multidimensional time series through the time series reconstruction model Reconstruct and calculate the data difference before and after reconstruction to obtain the reconstructed difference sequence X = {x1,…,x N }; Step 3: construct a feature space for the data distribution of the reconstructed difference sequence X; Step 4: Calculate the feature vector of the reconstructed difference sequence X according to the position of the data point of the reconstructed difference sequence X in the feature space; Step 5: Use a sliding window of fixed length to divide the reconstructed difference sequence X feature vector into multiple subsequences, and calculate the feature vectors of the subsequences; Step 6: Calculate the similarity between different subsequences, and determine that the time corresponding to the subsequence with a similarity less than a threshold is the time when the system is abnormally running.

2. A method for detecting system anomalies by adaptively fusing multidimensional sequence data as claimed in claim 1, characterized in that: The original monitoring data after digitization Perform normalization: It is a time series The value at timestamp i and dimension j, 1≤i≤N,1≤j≤D, where D is the number of dimensions; represents the sequence of the jth dimension, yes The minimum value of yes The maximum value; e>0, used to prevent the denominator from being 0.

3. The method for detecting system anomalies by adaptively fusing multidimensional sequence data according to claim 1, characterized in that: The time series reconstruction model is one of an autoencoder, a variational autoencoder, a recurrent neural network, a long short-term memory network, a diffusion model, a temporal convolutional network or a generative adversarial network.

4. The method for detecting system anomalies by adaptively fusing multidimensional sequence data according to claim 1, characterized in that: The method for constructing the feature space for reconstructing the data distribution of the difference sequence X is: Randomly extract ψ vectors Θ = {θ1,…,θ ψ }, each vector corresponds to a hypersphere θ k The coordinates of the center of the sphere and its radius And m≠k; Each hypersphere represents a partitioned subspace.

5. A method for detecting system anomalies by adaptively fusing multidimensional sequence data as claimed in claim 4, characterized in that: Based on the Monte Carlo method, the construction of the feature space is repeated t times independently to obtain t segmentation results. Each segmentation method can obtain ψ hyperspheres.

6. A method for detecting system anomalies by adaptively fusing multidimensional sequence data as claimed in claim 5, characterized in that: The calculation method of reconstructing the characteristic vector of the difference sequence X is: Determine a partition H l , including the range of ψ hyperspheres under the one-time segmentation method, l = 1,…,t; define a ψ-dimensional binary column vector Φ l (x i )={Φ l,1 (x i ),…,Φ l,k (x i ),…Φ l,ψ (x i )}, for the reconstructed difference sequence X = {x1,…,x N Any vector x in} i , if min(dist(x i ,Θ)) <r k , indicating point x i Falling on the hypersphere θ k In the equation, let Φ l,k (x i )=1, otherwise Φ l,k (x i )=0; For a given t types of segmentation results, is composed of t binary column vectors Φ1(x i ),…,Φ t (x i ), M=t×ψ; As the feature vector of the reconstructed difference sequence X.

7. A method for detecting system anomalies by adaptively fusing multidimensional sequence data as claimed in claim 6, characterized in that: Construct a time window \(S\) to be detected with length \(L\). v , where \(v = 1, 2, \ldots, N - L + 1\), \(0 < L < N\). Through the time window \(S\) to be detected v transform the feature vector \(\varPhi(X)\) of the reconstructed difference sequence \(X\) into a sliding window sequence \(S\) v =\(\{\varPhi(x\) v ), \ldots, \varPhi(x\) v+L-1 )\}\); use the isolated kernel feature mean to replace the feature vector of the difference window sequence \(S\) v . For any two difference window sequences S v , S u , its similarity The calculation method is: Among them, u≠v, <,> represents the multiplication calculation between matrices.

8. A method for detecting system anomalies by adaptively fusing multidimensional sequence data as claimed in claim 7, characterized in that: For anomaly detection of system historical operation, multidimensional time series After the reconstructed difference sequence X is divided into multiple subsequences, each subsequence S is calculated in turn. v The similarity between the complete reconstructed difference sequence X Set a threshold τ1, if Then determine the subsequence S v The corresponding time is the time period when the system is abnormal.

9. A method for detecting system anomalies by adaptively fusing multidimensional sequence data as claimed in claim 8, characterized in that: The method for determining the threshold τ1 is: the similarity between all subsequences and the complete reconstructed difference sequence X Arrange them in ascending order to obtain the array Score, and select a similarity score from the Score as the threshold τ1 according to the preset abnormality rate.

10. A method for detecting system anomalies by adaptively fusing multidimensional sequence data as claimed in claim 7, characterized in that: For the anomaly detection of the system running online, by calculating the similarity between the data to be detected S and the historical data T, and comparing it with the set threshold τ2, the data to be detected whose similarity with the historical data is less than the threshold τ2 is identified as abnormal data; At the next moment, the detected data is added to the historical data, and the historical data information is updated to achieve adaptive optimization of online detection.

Images