A graph contrastive learning approach for cloud system anomaly detection

Abstract

A cloud system anomaly detection method based on graph contrastive learning relates to the technical field of cloud system performance detection. By combining the time domain and frequency domain processing strategies in the data enhancement module, it not only ensures data diversity but also maintains the temporal continuity of the data, providing high-quality input for subsequent feature learning. The introduction of the GGRN module enables the model to learn the deep-level features of the cloud system from both the structural and temporal dimensions, providing rich semantic information for anomaly detection. The combination of lightweight linear attention encoder and contrastive learning not only optimizes the efficiency of the model in feature extraction, but also enhances the model's ability to distinguish different state modes through contrastive learning, thereby improving the accuracy and robustness of anomaly detection.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud system performance detection, and in particular to a cloud system anomaly detection method based on graph comparative learning. Background Art

[0002] With the rapid development of cloud computing technology, cloud systems have become one of the important infrastructures of modern society. However, the continuous growth in the scale and complexity of cloud systems has led to increasingly prominent performance anomalies. These anomalies mainly manifest as service delays caused by resource competition and job failures caused by resource shortages, posing a serious threat to the stability and reliability of cloud systems.

[0003] Deep learning models such as recurrent networks and convolutional networks have achieved good results in anomaly detection in cloud systems. However, the actual cloud computing system operation data is high-dimensional and complex, and the monitoring data is usually unlabeled, making it difficult for non-domain experts to directly identify its features. In addition, the frequency of abnormal events in cloud computing systems is low, and there may be unknown abnormal patterns. Therefore, when deep models are applied to anomaly detection tasks, the model does not learn abnormal features sufficiently, and its robustness and generalization capabilities are unstable.

[0004] To address these challenges, researchers have begun to use reconstruction-based methods to detect performance anomalies. Mainstream reconstruction methods mainly build feature representation models of normal sequences by reducing the error between input data and reconstructed data. However, cloud system performance data presents a variety of characteristics due to different resource types and configurations, resulting in significant differences between normal samples. In addition, abnormal events present multiple patterns, such as subsequence anomalies, context anomalies, etc. Training methods that rely solely on reducing reconstruction errors may not fully capture the high-level semantic information in the data. Summary of the invention

[0005] In order to overcome the deficiencies of the above technologies, the present invention provides a cloud system anomaly detection method that can effectively identify performance anomalies in a cloud system and has strong robustness and generalization ability.

[0006] The technical solution adopted by the present invention to overcome the technical problems is:

[0007] A cloud system anomaly detection method based on graph contrast learning, comprising:

[0008] a) Obtain the cloud system resource data S with a time span of L and the adjacency matrix E represented by the topological structure of the cloud system, S = [s1, s2, ..., s l ,...,s L ], where s l is the observed data at time step l, l∈{1,...,L};

[0009] b) Divide the cloud system resource data S into a training set St and a test set Sr;

[0010] c) Use a sliding window of length T to sample the training set St, slide the sliding window M times, and obtain an input sample set consisting of M input samples in is the continuous data collected by the mth sliding window, m∈{1,...,M}, x t is the observation data collected by the sliding window at the tth time step, t∈{1,...,T};

[0011] d) establishing a GCAD model consisting of a data enhancement module, a GGRN module, a contrastive learning module, and a reconstruction module;

[0012] e) The continuous data collected by the mth sliding window Input into the data enhancement module of the GCAD model, and output the time domain enhanced continuous data and frequency domain enhanced continuous data

[0013] f) Enhance continuous data in time domain Input into the GGRN module of the GCAD model and output the feature vector Enhance continuous data in frequency domain Input into the GGRN module of the GCAD model and output the feature vector

[0014] g) The feature vector Input into the contrast learning module of the GCAD model, and output the vector The feature vector Input into the contrast learning module of the GCAD model, and output the vector

[0015] h) training the GGRN module of the GCAD model through the loss function to obtain a trained GGRN module;

[0016] i) The continuous data collected by the mth sliding window It is input into the trained GGRN module and the reconstruction module of the GCAD model in turn, and the reconstructed sample X′ is output. 1:T ;

[0017] j) training the reconstruction module of the GCAD model through the loss function to obtain the trained GCAD model;

[0018] k) Use a sliding window of length T to sample the test set Sr, slide the sliding window N times, and obtain a test sample set consisting of N test samples. in is the continuous data collected by the nth sliding window, n∈{1,...,N}, is the observation data collected by the sliding window at the tth time step, t∈{1,...,T};

[0019] l) The continuous data collected by the mth sliding window Continuous data collected by the nth sliding window The input is into the trained GCAD model, and the state of the cloud system at the jth time step is determined according to the model output results.

[0020] Furthermore, in step a), cloud system resource data S with a time span of L and an adjacency matrix E represented by the topological structure of the cloud system are obtained from the MBD cloud server resource usage dataset.

[0021] Furthermore, in step b), the cloud system resource data S is divided into a training set St and a test set Sr in a ratio of 7:3.

[0022] Further, step e) comprises the following steps:

[0023] e-1) The data enhancement module of the GCAD model consists of a time domain enhancement component and a frequency domain enhancement component;

[0024] e-2) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t The data is input into the time domain enhancement component of the data enhancement module, and a random masking method based on geometric distribution is used to apply a geometric mask to it to obtain the time domain enhanced data. T time-domain enhanced data constitute time-domain enhanced continuous data

[0025] e-3) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t The data is input into the frequency domain enhancement component of the data enhancement module, and a two-dimensional discrete Fourier transform is performed on it to obtain a spectrum. Gaussian noise is added to the amplitude spectrum and phase spectrum in the spectrum respectively, and the spectrum with Gaussian noise added is subjected to an inverse discrete Fourier transform to obtain frequency domain enhanced data. T frequency domain enhanced data Construct frequency domain enhanced continuous data Further, step f) comprises the following steps:

[0026] f-1) The GGRN module of the GCAD model consists of a graph neural network and a gating mechanism;

[0027] f-2) Time domain enhanced data and the adjacency matrix E are input into the graph neural network of the GGRN module, and the graph representation vector is output

[0028] f-3) Represent the graph as a vector Input into the gating mechanism of the GGRN module, the graph representation vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Representing a graph as a vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Hide the state With time domain augmented data of t-1 time steps After the splicing operation, it is input into the tanh activation function, and the output is the hidden state

[0029] f-4) will hide the state With hidden state The result of element-wise multiplication and With t-1 time domain enhanced data The result of element-by-element multiplication is summed to obtain the output of the tth time step The output of T time steps constitutes the feature vector

[0030] f-5) Enhance the frequency domain data and the adjacency matrix E are input into the graph neural network of the GGRN module, and the graph representation vector is output

[0031] f-6) Represent the graph as a vector Input into the gating mechanism of the GGRN module, the graph representation vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Representing a graph as a vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Hide the state With frequency domain augmented data at t-1 time steps After the splicing operation, it is input into the tanh activation function, and the output is the hidden state

[0032] f-7) will hide the state With hidden state The result of element-wise multiplication and With t-1 frequency domain enhanced data The result of element-by-element multiplication is summed to obtain the output of the tth time step The output of T time steps constitutes the feature vector

[0033] Further, step g) comprises the following steps:

[0034] g-1) The contrastive learning module of the GCAD model consists of an encoder and a projection layer. The encoder consists of a linear attention mechanism, a first layer normalization, a first residual connection, a feedforward neural network, a second layer normalization, and a second residual connection. The projection layer consists of a feedforward neural network.

[0035] g-2) The eigenvector Input into the linear attention mechanism of the encoder of the contrastive learning module to obtain the attention map The attention map Input into the first normalization layer and the first residual connection of the encoder in sequence, and output the embedded features Embed features Input into the encoder's feedforward neural network and output the feature The characteristics Input to the second normalized layer of the encoder, the second residual connection, and output the embedded feature Embed features Input into the feedforward neural network of the projection layer of the contrastive learning module to generate the output vector

[0036] g-3) The eigenvector Input into the linear attention mechanism of the encoder of the contrastive learning module to obtain the attention map The attention map Input into the first normalization layer and the first residual connection of the encoder in sequence, and output the embedded features Embed features Input into the encoder's feedforward neural network and output the feature The characteristics Input to the second normalized layer of the encoder, the second residual connection, and output the embedded feature Embed features Input into the feedforward neural network of the projection layer of the contrastive learning module to generate the output vector Further, step h) comprises the following steps:

[0037] h-1) The M input samples are output through the contrastive learning module of the GCAD model to form an output sample set and

[0038] h-2) will output the sample set And the output sample set Input into the InfoNCE loss function to calculate the contrast loss Loss con ;

[0039] h-3) Use the Adam optimizer to use the contrast loss Loss con Train the GGRN module of the GCAD model to obtain the trained GGRN module.

[0040] Further, step i) comprises the following steps:

[0041] i-1) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t Input into the trained GGRN module and output the embedded feature h m ;

[0042] i-2) The reconstruction module of the GCAD model consists of an encoder and a decoder. The encoder consists of a linear attention mechanism, a first layer of normalization, a first residual connection, a feedforward neural network, a second layer of normalization, and a second residual connection. The decoder consists of a two-layer feedforward neural network.

[0043] i-3) Embed the feature h m Input into the encoder of the reconstruction module, output the hidden feature R, input the hidden feature R into the decoder of the reconstruction module, and output the reconstructed data x t ′, T reconstructed data constitute the reconstructed sample X′ 1:T , X′ 1:T =[x′1,x′2,...,x′ t ,...,x′ T ].

[0044] Further, step j) comprises the following steps:

[0045] j-1) Calculate the continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t and reconstructed sample X′ 1:TThe reconstructed data x at the tth time step in t The difference between ′ t ;

[0046] j-2) According to the difference Z t The reconstruction loss Loss is calculated using the mean square error rec ;

[0047] j-3) Use Adam optimizer to utilize reconstruction loss Loss rec Train the decoder of the reconstruction module to obtain the optimized GCAD model.

[0048] Further, step 1) comprises the following steps:

[0049] l-1) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t Input it into the GGRN module of the trained GCAD model to obtain the output h at the tth time step t ′, h t ′ is input into the reconstruction module of the trained GCAD model, and the reconstructed data y is output t , T reconstructed data constitute the reconstructed sample Y m , Y m =[y1,y2,...,y t ,...,y T ]; l-2) Calculate the continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t and reconstructed sample Y m The reconstructed data y at the tth time step in t The square of the difference between the two gives the anomaly score at the t-th time step T anomaly scores constitute the anomaly score set Z of the input sample m , The anomaly score set of M input samples in the input sample set constitutes the anomaly score set of the training set [Z 1 ,Z 2 ,...,Z m ,...,Z M ];

[0050] l-3) Calculate the anomaly score set [Z 1 ,Z 2 ,...,Z m ,...,Z M The mean μ of all anomaly scores and the standard deviation ε of all anomaly scores in ] are used to calculate the anomaly threshold Z′ by the formula Z′=μ+2ε;

[0051] l-4) The continuous data collected by the nth sliding window The observation data collected by the sliding window at the tth time step Input into the GGRN module of the trained GCAD model to get the output of the tth time step Will Input into the reconstruction module of the trained GCAD model, and output the reconstructed data T reconstructed data constitute a reconstructed sample

[0052] l-5) Calculate the continuous data collected by the nth sliding window The observation data collected by the sliding window at the tth time step And reconstructed samples The reconstructed data of the jth time step in The square of the difference between the two gives the anomaly score at the jth time step

[0053] l-6) When the anomaly score When the anomaly score is greater than the anomaly threshold Z′, the cloud system is judged to be in an abnormal state at the jth time step. When it is less than or equal to the abnormal threshold Z′, the cloud system is judged to be in a normal state at the jth time step.

[0054] The beneficial effects of the present invention are as follows: by combining the processing strategies of the time domain and the frequency domain in the data enhancement module, not only the data diversity is ensured, but also the temporal continuity of the data is maintained, providing high-quality input for subsequent feature learning. The introduction of the GGRN module enables the model to learn the deep-level features of the cloud system from both the structural and temporal dimensions, providing rich semantic information for anomaly detection. The combination of lightweight linear attention encoder and contrastive learning not only optimizes the efficiency of the model in feature extraction, but also enhances the model's ability to distinguish different state modes through contrastive learning, thereby improving the accuracy and robustness of anomaly detection. In summary, the GCAD model has achieved a good balance in improving detection efficiency, reducing false alarm rate, and reducing computing costs, providing strong technical support for the stable operation and security management of cloud systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a structural diagram of the GCAD cloud system anomaly detection model of the present invention;

[0056] Figure 2 It is the GGRN module structure diagram of the present invention;

[0057] Figure 3It is a structural diagram of the comparative learning module of the present invention. DETAILED DESCRIPTION

[0058] The following is combined with Figure 1 , Attachment Figure 2 , Attachment Figure 3 The present invention is further described.

[0059] As attached Figure 1 As shown, a cloud system anomaly detection method based on graph contrast learning includes:

[0060] a) Obtain the cloud system resource data S with a time span of L and the adjacency matrix E represented by the topological structure of the cloud system, S = [s1, s2, ..., s l ,...,s L ], where s l is the observation data at time step l, l∈{1,...,L}.

[0061] b) Divide the cloud system resource data S into a training set St and a test set Sr.

[0062] c) Use a sliding window of length T to sample the training set St, slide the sliding window M times, and obtain an input sample set consisting of M input samples in is the continuous data collected by the mth sliding window, m∈{1,...,M}, x t is the observation data collected by the sliding window at the tth time step, t∈{1,...,T}.

[0063] d) Establish a GCAD model consisting of a data enhancement module, a GGRN module, a contrastive learning module, and a reconstruction module.

[0064] e) The continuous data collected by the mth sliding window Input into the data enhancement module of the GCAD model, and output the time domain enhanced continuous data and frequency domain enhanced continuous data

[0065] f) Enhance continuous data in time domain Input into the GGRN module of the GCAD model and output the feature vector Enhance continuous data in frequency domain Input into the GGRN module of the GCAD model and output the feature vector

[0066] g) The feature vector Input into the contrast learning module of the GCAD model, and output the vector The feature vector Input into the contrast learning module of the GCAD model, and output the vector

[0067] h) Training the GGRN module of the GCAD model through the loss function to obtain the trained GGRN module.

[0068] i) The continuous data collected by the mth sliding window It is input into the trained GGRN module and the reconstruction module of the GCAD model in turn, and the reconstructed sample X′ is output. 1:T .

[0069] j) Training the reconstruction module of the GCAD model through the loss function to obtain the trained GCAD model.

[0070] k) Use a sliding window of length T to sample the test set Sr, slide the sliding window N times, and obtain a test sample set consisting of N test samples. in is the continuous data collected by the nth sliding window, n∈{1,...,N}, is the observation data collected by the sliding window at the tth time step, t∈{1,...,T}.

[0071] l) The continuous data collected by the mth sliding window Continuous data collected by the nth sliding window The input is into the trained GCAD model, and the state of the cloud system at the jth time step is determined according to the model output results.

[0072] It can effectively identify performance anomalies in cloud systems and has the characteristics of strong robustness and generalization ability.

[0073] In one embodiment of the present invention, in step a), cloud system resource data S with a time span of L and an adjacency matrix E represented by the topological structure of the cloud system are obtained from the MBD cloud server resource usage dataset (https: / / github.com / QAZASDEDC / TopoMAD).

[0074] In one embodiment of the present invention, in step b), the cloud system resource data S is divided into a training set St and a test set Sr in a ratio of 7:3.

[0075] In one embodiment of the present invention, step e) comprises the following steps:

[0076] e-1) The data enhancement module of the GCAD model consists of a time domain enhancement component and a frequency domain enhancement component.

[0077] e-2) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t The data is input into the time domain enhancement component of the data enhancement module, and a random masking method based on geometric distribution is used to apply a geometric mask to it to obtain the time domain enhanced data. T time-domain enhanced data constitute time-domain enhanced continuous data The random masking method based on geometric distribution is an existing technology. For details, please refer to the paper entitled “Reconstruction-based anomaly detection for multivariate time series using contrastive generative adversarial networks” published in Information Processing and Management in November 2023 by Miao Jiawei, Tao Haicheng, Xie Haoran, etc.

[0078] e-3) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t The data is input into the frequency domain enhancement component of the data enhancement module, and a two-dimensional discrete Fourier transform is performed on it to obtain a spectrum. Gaussian noise is added to the amplitude spectrum and phase spectrum in the spectrum respectively, and the spectrum with Gaussian noise added is subjected to an inverse discrete Fourier transform to obtain frequency domain enhanced data. T frequency domain enhanced data Construct frequency domain enhanced continuous data As attached Figure 2 As shown, in one embodiment of the present invention, step f) comprises the following steps:

[0079] f-1) The GGRN module of the GCAD model consists of a graph neural network and a gating mechanism.

[0080] f-2) Time domain enhanced data and the adjacency matrix E are input into the graph neural network of the GGRN module, and the graph representation vector is output

[0081] f-3) Represent the graph as a vector Input into the gating mechanism of the GGRN module, the graph representation vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Representing a graph as a vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Hide the state With time domain augmented data of t-1 time steps After the splicing operation, it is input into the tanh activation function, and the output is the hidden state

[0082] f-4) will hide the state With hidden state The result of element-wise multiplication and With t-1 time domain enhanced data The result of element-by-element multiplication is summed to obtain the output of the tth time step The output of T time steps constitutes the feature vector

[0083] f-5) Enhance the frequency domain data and the adjacency matrix E are input into the graph neural network of the GGRN module, and the graph representation vector is output

[0084] f-6) Represent the graph as a vector Input into the gating mechanism of the GGRN module, the graph representation vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Representing a graph as a vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Hide the state With frequency domain augmented data at t-1 time steps After the splicing operation, it is input into the tanh activation function, and the output is the hidden state

[0085] f-7) will hide the state With hidden state The result of element-wise multiplication and With t-1 frequency domain enhanced data The result of element-by-element multiplication is summed to obtain the output of the tth time step The output of T time steps constitutes the feature vector

[0086] As attached Figure 3As shown, in one embodiment of the present invention, step g) comprises the following steps:

[0087] g-1) The contrastive learning module of the GCAD model consists of an encoder and a projection layer. The encoder consists of a linear attention mechanism, a first layer normalization, a first residual connection, a feedforward neural network, a second layer normalization, and a second residual connection. The projection layer consists of a feedforward neural network.

[0088] g-2) The eigenvector Input into the linear attention mechanism of the encoder of the contrastive learning module to obtain the attention map The attention map Input into the first normalization layer and the first residual connection of the encoder in sequence, and output the embedded features Embed features Input into the encoder's feedforward neural network and output the feature The characteristics Input to the second normalized layer of the encoder, the second residual connection, and output the embedded feature Embed features Input into the feedforward neural network of the projection layer of the contrastive learning module to generate the output vector

[0089] g-3) The eigenvector Input into the linear attention mechanism of the encoder of the contrastive learning module to obtain the attention map The attention map Input into the first normalization layer and the first residual connection of the encoder in sequence, and output the embedded features Embed features Input into the encoder's feedforward neural network and output the feature The characteristics Input to the second normalized layer of the encoder, the second residual connection, and output the embedded feature Embed features Input into the feedforward neural network of the projection layer of the contrastive learning module to generate the output vector In one embodiment of the present invention, step h) comprises the following steps:

[0090] h-1) The M input samples are output through the contrastive learning module of the GCAD model to form an output sample set and

[0091] h-2) will output the sample set And the output sample set Input into the InfoNCE loss function to calculate the contrast loss Losscon .

[0092] h-3) Use the Adam optimizer to use the contrast loss Loss con Train the GGRN module of the GCAD model to obtain the trained GGRN module.

[0093] In one embodiment of the present invention, step i) comprises the following steps:

[0094] i-1) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t Input into the trained GGRN module and output the embedded feature h m .

[0095] i-2) The reconstruction module of the GCAD model consists of an encoder and a decoder. The encoder consists of a linear attention mechanism, a first layer of normalization, a first residual connection, a feedforward neural network, a second layer of normalization, and a second residual connection. The decoder consists of two layers of feedforward neural networks.

[0096] i-3) Embed the feature h m Input into the encoder of the reconstruction module, and output the hidden feature R.

[0097] The hidden feature R is input into the decoder of the reconstruction module, and the reconstructed data x is output. t ′, T reconstructed data constitute the reconstructed sample X′ 1:T , X′ 1:T =[x′1,x′2,...,x′ t ,...,x′ T ].

[0098] In one embodiment of the present invention, step j) comprises the following steps:

[0099] j-1) Calculate the continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t and reconstructed sample X′ 1:T The reconstructed data x at the tth time step in t The difference between ′ t .

[0100] j-2) According to the difference Z t The reconstruction loss Loss is calculated using the mean square error rec .

[0101] j-3) Use Adam optimizer to utilize reconstruction loss Loss recTrain the decoder of the reconstruction module to obtain the optimized GCAD model.

[0102] In one embodiment of the present invention, step 1) comprises the following steps:

[0103] l-1) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t Input it into the GGRN module of the trained GCAD model to obtain the output h at the tth time step t ′, h t ′ is input into the reconstruction module of the trained GCAD model, and the reconstructed data yt is output. T reconstructed data constitute the reconstructed sample Y m , Y m =[y1,y2,...,y t ,...,y T ].

[0104] l-2) Calculate the continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t and reconstructed sample Y m The reconstructed data y at the tth time step in t The square of the difference between the two gives the anomaly score at the t-th time step T anomaly scores constitute the anomaly score set Z of the input sample m , The anomaly score set of M input samples in the input sample set constitutes the anomaly score set of the training set [Z 1 ,Z 2 ,...,Z m ,...,Z M ].

[0105] l-3) Calculate the anomaly score set [Z 1 ,Z 2 ,...,Z m ,...,Z M The mean μ of all anomaly scores and the standard deviation ε of all anomaly scores in ] are used to calculate the anomaly threshold Z′ using the formula Z′=μ+2ε.

[0106] l-4) The continuous data collected by the nth sliding window The observation data collected by the sliding window at the tth time step Input into the GGRN module of the trained GCAD model to get the output of the tth time step Will Input into the reconstruction module of the trained GCAD model, and output the reconstructed data T reconstructed data constitute a reconstructed sample

[0107] l-5) Calculate the continuous data collected by the nth sliding window The observation data collected by the sliding window at the tth time step And the reconstruction sample The reconstructed data of the jth time step in The square of the difference between the two gives the anomaly score at the jth time step

[0108] l-6) When the anomaly score When the anomaly score is greater than the anomaly threshold Z′, the cloud system is judged to be in an abnormal state at the jth time step. When it is less than or equal to the abnormal threshold Z′, the cloud system is judged to be in a normal state at the jth time step.

[0109] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A cloud system anomaly detection method based on graph contrast learning, characterized in that: include: a) Obtain the cloud system resource data S with a time span of L and the adjacency matrix E represented by the topological structure of the cloud system, S = [s1, s2, ..., s l ,...,s L ], where s l is the observed data at time step l, l∈{1,...,L}; b) Divide the cloud system resource data S into a training set St and a test set Sr; c) Use a sliding window of length T to sample the training set St, slide the sliding window M times, and obtain an input sample set consisting of M input samples in is the continuous data collected by the mth sliding window, m∈{1,...,M}, x t is the observation data collected by the sliding window at the tth time step, t∈{1,...,T}; d) Establishing a GCAD model consisting of a data enhancement module, a GGRN module, a contrastive learning module, and a reconstruction module. The GGRN module of the GCAD model consists of a graph neural network and a gating mechanism; e) The continuous data collected by the mth sliding window Input into the data enhancement module of the GCAD model, and output the time domain enhanced continuous data and frequency domain enhanced continuous data f) Enhance continuous data in time domain Input into the GGRN module of the GCAD model and output the feature vector Enhance continuous data in frequency domain Input into the GGRN module of the GCAD model and output the feature vector g) The feature vector Input into the contrast learning module of the GCAD model, and output the vector The feature vector Input into the contrast learning module of the GCAD model, and output the vector h) training the GGRN module of the GCAD model through the loss function to obtain a trained GGRN module; i) The continuous data collected by the mth sliding window It is input into the trained GGRN module and the reconstruction module of the GCAD model in turn, and the reconstructed sample X1′ is output. :T ; j) training the reconstruction module of the GCAD model through the loss function to obtain the trained GCAD model; k) Use a sliding window of length T to sample the test set Sr, slide the sliding window N times, and obtain a test sample set consisting of N test samples. in is the continuous data collected by the nth sliding window, n∈{1,...,N}, is the observation data collected by the sliding window at the tth time step, t∈{1,...,T}; l) The continuous data collected by the mth sliding window Continuous data collected by the nth sliding window The input is into the trained GCAD model, and the state of the cloud system at the jth time step is determined according to the model output results.

2. The cloud system anomaly detection method based on graph contrast learning according to claim 1, characterized in that: In step a), cloud system resource data S with a time span of L and an adjacency matrix E represented by the topological structure of the cloud system are obtained from the MBD cloud server resource usage dataset.

3. The cloud system anomaly detection method based on graph contrast learning according to claim 1, characterized in that: In step b), the cloud system resource data S is divided into a training set St and a test set Sr in a ratio of 7:

3.

4. The cloud system anomaly detection method based on graph contrast learning according to claim 1, characterized in that: Step e) comprises the following steps: e-1) The data enhancement module of the GCAD model consists of a time domain enhancement component and a frequency domain enhancement component; e-2) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t The data is input into the time domain enhancement component of the data enhancement module, and a random masking method based on geometric distribution is used to apply a geometric mask to it to obtain the time domain enhanced data. T time-domain enhanced data constitute time-domain enhanced continuous data e-3) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t The data is input into the frequency domain enhancement component of the data enhancement module, and a two-dimensional discrete Fourier transform is performed on it to obtain a spectrum. Gaussian noise is added to the amplitude spectrum and phase spectrum in the spectrum respectively, and the spectrum with Gaussian noise added is subjected to an inverse discrete Fourier transform to obtain frequency domain enhanced data. T frequency domain enhanced data Construct frequency domain enhanced continuous data 5. The cloud system anomaly detection method based on graph contrast learning according to claim 4 is characterized in that: Step f) comprises the following steps: f-1) Time domain enhanced data and the adjacency matrix E are input into the graph neural network of the GGRN module, and the graph representation vector is output f-2) Represent the graph as a vector Input into the gating mechanism of the GGRN module, the graph representation vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Representing a graph as a vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Hide the state With time domain augmented data of t-1 time steps After the splicing operation, it is input into the tanh activation function, and the output is the hidden state f-3) will hide the state With hidden state The result of element-wise multiplication and With t-1 time domain enhanced data The result of element-by-element multiplication is summed to obtain the output of the tth time step The output of T time steps constitutes the feature vector f-4) Enhance the frequency domain data and the adjacency matrix E are input into the graph neural network of the GGRN module, and the graph representation vector is output f-5) Represent the graph as a vector Input into the gating mechanism of the GGRN module, the graph representation vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Representing a graph as a vector With weight After multiplication, it is input into the Sigmoid activation function to obtain the hidden state Hide the state With frequency domain augmented data at t-1 time steps After the splicing operation, it is input into the tanh activation function, and the output is the hidden state f-6) will hide the state With hidden state The result of element-wise multiplication and With t-1 frequency domain enhanced data The result of element-by-element multiplication is summed to obtain the output of the tth time step The output of T time steps constitutes the feature vector 6. The cloud system anomaly detection method based on graph contrast learning according to claim 1, characterized in that: Step g) comprises the following steps: g-1) The contrastive learning module of the GCAD model consists of an encoder and a projection layer. The encoder consists of a linear attention mechanism, a first layer normalization, a first residual connection, a feedforward neural network, a second layer normalization, and a second residual connection. The projection layer consists of a feedforward neural network. g-2) The eigenvector Input into the linear attention mechanism of the encoder of the contrastive learning module to obtain the attention map The attention map Input into the first normalization layer and the first residual connection of the encoder in sequence, and output the embedded features Embed features Input into the encoder's feedforward neural network and output the feature The characteristics Input to the second normalized layer of the encoder, the second residual connection, and output the embedded feature Embed features Input into the feedforward neural network of the projection layer of the contrastive learning module to generate the output vector g-3) The eigenvector Input into the linear attention mechanism of the encoder of the contrastive learning module to obtain the attention map The attention map Input into the first normalization layer and the first residual connection of the encoder in sequence, and output the embedded features Embed features Input into the encoder's feedforward neural network and output the feature The characteristics Input to the second normalized layer of the encoder, the second residual connection, and output the embedded feature Embed features Input into the feedforward neural network of the projection layer of the contrastive learning module to generate the output vector 7. The cloud system anomaly detection method based on graph contrast learning according to claim 1, characterized in that: Step h) comprises the following steps: h-1) The M input samples are output through the contrastive learning module of the GCAD model to form an output sample set and h-2) will output the sample set And the output sample set Input into the InfoNCE loss function to calculate the contrast loss Loss con ; h-3) Use the Adam optimizer to use the contrast loss Loss con Train the GGRN module of the GCAD model to obtain the trained GGRN module.

8. The cloud system anomaly detection method based on graph contrast learning according to claim 1, characterized in that: Step i) comprises the following steps: i-1) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t Input into the trained GGRN module and output the embedded feature h m ; i-2) The reconstruction module of the GCAD model consists of an encoder and a decoder. The encoder consists of a linear attention mechanism, a first layer of normalization, a first residual connection, a feedforward neural network, a second layer of normalization, and a second residual connection. The decoder consists of a two-layer feedforward neural network. i-3) Embed the feature h m Input into the encoder of the reconstruction module, and output the hidden feature R. The hidden feature R is input into the decoder of the reconstruction module, and the reconstructed data x is output. t , T reconstructed data constitute the reconstructed sample X′ 1:T , X′ 1:T =[x′1,x′2,...,x′ t ,...,x′ T ].

9. The cloud system anomaly detection method based on graph contrast learning according to claim 8, characterized in that: Step j) comprises the following steps: j-1) Calculate the continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t and reconstructed sample X′ 1:T The reconstructed data x at the tth time step in t The difference between ′ t ; j-2) According to the difference Z t The reconstruction loss Loss is calculated using the mean square error rec ; j-3) Use Adam optimizer to utilize reconstruction loss Loss rec Train the decoder of the reconstruction module to obtain the optimized GCAD model.

10. The cloud system anomaly detection method based on graph contrast learning according to claim 8, characterized in that: Step 1) comprises the following steps: l-1) The continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t Input it into the GGRN module of the trained GCAD model to obtain the output h at the tth time step t′ , h t′ Input into the reconstruction module of the trained GCAD model, and output the reconstructed data y t , T reconstructed data constitute the reconstructed sample Y m , Y m =[y1,y2,...,y t ,...,y T ]; l-2) Calculate the continuous data collected by the mth sliding window The observation data x collected at the tth time step in the sliding window t and reconstructed sample Y m The reconstructed data y at the tth time step in t The square of the difference between the two gives the anomaly score at the t-th time step T anomaly scores constitute the anomaly score set Z of the input sample m , The anomaly score set of M input samples in the input sample set constitutes the anomaly score set of the training set [Z 1 ,Z 2 ,...,Z m ,...,Z M ]; l-3) Calculate the anomaly score set [Z 1 ,Z 2 ,...,Z m ,...,Z M The mean μ of all anomaly scores and the standard deviation ε of all anomaly scores in ] are used to calculate the anomaly threshold Z′ by the formula Z′=μ+2ε; l-4) The continuous data collected by the nth sliding window The observation data collected by the sliding window at the tth time step Input into the GGRN module of the trained GCAD model to get the output of the tth time step Will Input into the reconstruction module of the trained GCAD model, and output the reconstructed data T reconstruction data constitute the reconstruction sample l-5) Calculate the continuous data collected by the nth sliding window The observation data collected by the sliding window at the tth time step And the reconstruction sample The reconstructed data of the jth time step in The square of the difference between the two gives the anomaly score at the jth time step l-6) When the anomaly score When the anomaly score is greater than the anomaly threshold Z′, the cloud system is judged to be in an abnormal state at the jth time step. When it is less than or equal to the abnormal threshold Z′, the cloud system is judged to be in a normal state at the jth time step.

Images