Abnormality detection method, device and system, electronic equipment and storage medium

Abstract

The invention discloses an anomaly detection method, device and system, electronic equipment and a storage medium. Relates to the technical field of cloud computing. The method comprises the following steps: acquiring a first traffic feature corresponding to each first device in a first device set to obtain a first traffic feature set, and acquiring a second traffic feature corresponding to a second device set to obtain a second traffic feature set; the first device set is a device set corresponding to the target instance before change, and the second device set is a device set corresponding to the target instance after change; obtaining a change relationship between each first device in the first device set and each second device in the second device set; determining a reference traffic range of each second device based on the first traffic feature set and the change relationship; and determining whether the second equipment is abnormal or not according to the reference traffic range of the second equipment and the second traffic characteristic of the second equipment. According to the embodiment of the invention, the technical problem that whether the equipment is abnormal or not after instance change cannot be accurately detected in the related technology can be solved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to an anomaly detection method, device, system, electronic device and storage medium. Background Art

[0002] A product instance of a cloud network product usually corresponds to multiple devices at the bottom layer. In general, the traffic between multiple devices is balanced. However, after performing instance upgrades, expansions, reductions, and other change operations, the related devices may have abnormalities after the instance change, such as imbalanced traffic between devices after the instance change. In related technologies, manual sampling inspection methods are usually used to detect whether the device has abnormalities after the instance change. This method not only fails to accurately determine the abnormality, but also has low detection efficiency. Summary of the invention

[0003] In view of the above problems, the present application provides an anomaly detection method, device, system, electronic device and storage medium to at least solve the technical problem in the related art that it is impossible to accurately detect whether an abnormality occurs in the device after an instance is changed.

[0004] According to a first aspect of an embodiment of the present application, there is provided an anomaly detection method, comprising: obtaining first traffic characteristics corresponding to each first device in a first device set to obtain a first traffic characteristic set, and second traffic characteristics corresponding to a second device set to obtain a second traffic characteristic set; the first device set is a device set corresponding to a target instance before a change, and the second device set is a device set corresponding to the target instance after a change; obtaining a change relationship between each first device in the first device set and each second device in the second device set; the change relationship characterizes a traffic correspondence relationship between each first device and each second device; based on the first traffic characteristic set and the change relationship, determining a reference traffic range for each second device in the second device set; and determining whether an abnormality occurs to the second device based on the reference traffic range of any second device in the second device set and the second traffic characteristic of the second device.

[0005] According to a second aspect of an embodiment of the present application, an abnormality detection device is provided, the device comprising: a first acquisition unit, used to acquire first traffic characteristics corresponding to each first device in a first device set to obtain a first traffic characteristic set, and second traffic characteristics corresponding to a second device set to obtain a second traffic characteristic set; the first device set is a device set corresponding to a target instance before a change, and the second device set is a device set corresponding to the target instance after a change; a second acquisition unit, used to acquire a change relationship between each first device in the first device set and each second device in the second device set; the change relationship characterizes a traffic correspondence relationship between each first device and each second device; a first determination unit, used to determine a reference traffic range of each second device in the second device set based on the first traffic characteristic set and the change relationship; a second determination unit, used to determine whether an abnormality occurs in any second device in the second device set based on the reference traffic range of the second device and the second traffic characteristic of the second device.

[0006] According to a third aspect of an embodiment of the present application, there is provided an anomaly detection system, the anomaly detection system comprising: a first device set corresponding to a target instance before a change, a second device set corresponding to the target instance after a change, and a detection server; The detection server is used to obtain the first flow characteristics corresponding to each first device in the first device set to obtain a first flow characteristic set, and the second flow characteristics corresponding to the second device set to obtain a second flow characteristic set; obtain the change relationship between each first device in the first device set and each second device in the second device set; the change relationship represents the flow correspondence relationship between each first device and each second device; determine the reference flow range of each second device in the second device set based on the first flow characteristic set and the change relationship; determine whether the second device has an abnormality based on the reference flow range of any second device in the second device set and the second flow characteristic of the second device.

[0007] According to a fourth aspect of an embodiment of the present application, an electronic device is also provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the anomaly detection method of the first aspect through the computer program.

[0008] According to a fifth aspect of an embodiment of the present application, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the anomaly detection method of the first aspect described above when running.

[0009] According to a sixth aspect of an embodiment of the present application, a computer program product is also provided, including a computer program, wherein the computer program is executed by a processor to perform the anomaly detection method of the first aspect described above.

[0010] In an embodiment of the present application, a method is adopted in which a first flow feature corresponding to each first device in a first device set is obtained to obtain a first flow feature set, and a second flow feature corresponding to a second device set is obtained to obtain a second flow feature set; the first device set is a device set corresponding to a target instance before the change, and the second device set is a device set corresponding to the target instance after the change; a change relationship between each first device in the first device set and each second device in the second device set is obtained; the change relationship represents the flow correspondence relationship between each first device and each second device; based on the first flow feature set and the change relationship, a reference flow range of each second device in the second device set is determined; a method is used to determine whether an abnormality occurs in the second device according to the reference flow range of any second device in the second device set and the second flow feature of the second device; the present application can accurately obtain the reference flow range of the corresponding device after the change according to the flow features corresponding to the device set corresponding to the target instance before and after the change, and the flow correspondence relationship between the corresponding device sets before and after the change, and judge whether an abnormality occurs in the target instance after the change according to the reference flow range, Compared with the manual sampling detection method, the present application can not only accurately and quickly detect the device that has abnormalities after the instance change, but also improve the efficiency of instance change anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Moreover, the same reference numerals are used throughout the drawings to represent the same components. In the drawings: Figure 1 is a schematic diagram of an application environment of an optional anomaly detection method according to an embodiment of the present application; Figure 2 is a flowchart of an optional anomaly detection method according to an embodiment of the present application; Figure 3 is a flowchart of another optional anomaly detection method according to an embodiment of the present application; Figure 4 It is a schematic diagram of device mapping relationship before and after an optional instance change according to an embodiment of the present application; Figure 5 is a flowchart of another optional anomaly detection method according to an embodiment of the present application; Figure 6 is a schematic diagram of device mapping relationship before and after another optional instance change according to an embodiment of the present application; Figure 7 It is a schematic diagram of device mapping relationship before and after an optional instance change according to an embodiment of the present application; Figure 8 This is a flowchart of another optional anomaly detection method provided in an embodiment of the present application; Fig. 9 It is a schematic diagram of a flow similarity detection method provided in an embodiment of the present application; Fig.10 is a structural schematic diagram of an abnormality detection device provided in an embodiment of the present application; Fig.11 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only embodiments of a part of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0013] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0014] Optionally, according to one aspect of the embodiments of the present application, a method for detecting anomalies is provided. As an optional implementation, the method for detecting anomalies may be applied to, but is not limited to, Figure 1 In the application environment shown. Figure 1As shown, human-computer interaction can be performed between the user 102 and the electronic device 104. The electronic device 104 includes a memory 106 and a processor 108. The memory 106 is used to store the traffic characteristics of the device before and after the change, and the traffic correspondence between the devices before and after the instance change. The processor 108 is used to obtain the first traffic characteristics corresponding to each first device in the first device set, obtain the first traffic characteristic set, and the second traffic characteristics corresponding to the second device set, obtain the second traffic characteristic set; the first device set is the device set corresponding to the target instance before the change, and the second device set is the device set corresponding to the target instance after the change; obtain the change relationship between each first device in the first device set and each second device in the second device set; the change relationship represents the traffic correspondence between each first device and each second device; based on the first traffic characteristic set and the change relationship, determine the reference traffic range of each second device in the second device set; according to the reference traffic range of any second device in the second device set and the second traffic characteristics of the second device, determine whether the second device is abnormal.

[0015] Optionally, the electronic device 104 includes but is not limited to a mobile phone, a laptop computer, a tablet computer, a PDA, a MID (Mobile Internet Devices), a desktop computer, a smart TV, etc. In other examples, the electronic device 104 may also be a single server, or a server cluster consisting of multiple servers, or a cloud server, and the cloud server includes but is not limited to a private cloud server or a public cloud server. The above is only an example, and this embodiment does not impose any limitation on this.

[0016] As an optional implementation, Figure 2 As shown, the embodiment of the present application provides an abnormality detection method, the method comprising the following steps: S202, obtaining the first traffic characteristics corresponding to each first device in the first device set to obtain a first traffic characteristic set, and the second traffic characteristics corresponding to the second device set to obtain a second traffic characteristic set; the first device set is the device set corresponding to the target instance before the change, and the second device set is the device set corresponding to the target instance after the change.

[0017] Specifically, in an embodiment of the present application, the target instance may be different types of cloud services, each of which corresponds to one or more devices, and the devices may be various network devices, such as virtual network switches, elastic network cards, etc. The first traffic feature and the second traffic feature may include time series data corresponding to the traffic, that is, the traffic feature is a set of data that changes over time within a time period, and each feature is associated with a specific timestamp. The first traffic feature and the second traffic feature may be outbound traffic data and / or outbound traffic data. Changes to the target instance are generally divided into three types, namely, upgrade, expansion, and reduction. In one example, the first devices included in the first device set are, for example, device A, device B, and device C. When the change type of the target instance is an upgrade type, the second devices in the second device set are also devices A, device B, and device C. When the change type of the target instance is an expansion type, the second devices in the second device set may be devices A, device B, device C, and device D. When the change type of the target instance is a reduction type, the second devices in the second device set may be devices A and device C.

[0018] S204, obtaining a change relationship between each first device in the first device set and each second device in the second device set; the change relationship represents a flow correspondence relationship between each first device and each second device.

[0019] Specifically, in an embodiment of the present application, the traffic of each device of the target instance before and after the change is usually in a balanced state, that is, the traffic data corresponding to the target instance before the change and the traffic data corresponding to the change after the change usually do not fluctuate greatly. Therefore, there is a mapping relationship or a corresponding relationship between the traffic of each device in the first device set and the second device set. The above-mentioned change relationship is the corresponding relationship or mapping relationship of the traffic between the devices in the first device set and the devices in the second device set after the target instance changes (such as shrinking or expanding). Based on this change relationship, the distribution and change of traffic before and after the instance change can be identified.

[0020] In one example, for example, the first devices in the first device set include device A, device B, and device C. When the change type of the target instance is an upgrade type, the change relationship between each first device in the first device set and each second device in the second device set is: device A in the first device set corresponds to the flow of device A in the second device set, device B in the first device set corresponds to the flow of device B in the second device set, and device C in the first device set corresponds to the flow of device C in the second device set. Assuming that when the change type of the target instance is an expansion type, the second devices in the second device set include device A, device B, device C, and device D, the change relationship between each first device in the first device set and each second device in the second device set is: device A in the first device set can correspond to the flow of device B in the second device set, device B in the first device set corresponds to the flow of device C in the second device set, and device C in the first device set can correspond to the flow of devices A and D in the second device set.

[0021] S206: Determine a reference flow range of each second device in the second device set based on the first flow feature set and the change relationship.

[0022] Specifically, in the embodiment of the present application, the reference flow range of the second device can be the upper and lower envelopes of the predicted flow corresponding to the second device when no abnormality occurs. In one example, for example, the flow of device A in the first device set corresponds to the flow of device B in the second device set. Based on the change relationship and the first flow feature corresponding to device A, the reference flow range corresponding to device B can be predicted.

[0023] S208: Determine whether an abnormality occurs in any second device in the second device set according to a reference flow range of the second device and a second flow characteristic of the second device.

[0024] Specifically, in an embodiment of the present application, for example, the flow of device A in the first device set corresponds to the flow of device B in the second device set. According to the change relationship and the first flow characteristic corresponding to device A, after determining the reference flow range corresponding to device B, the second flow characteristic corresponding to device B is obtained. If the second flow characteristic data of device B exceeds the reference flow range, it can be considered that device B has an abnormality.

[0025] Based on the traffic characteristics corresponding to the device set corresponding to the target instance before and after the change, and the traffic correspondence between the device sets corresponding to the target instance before and after the change, the present application can accurately obtain the reference traffic range of the corresponding device after the change, and judge whether the target instance has an abnormality after the change based on the reference traffic range. Compared with the manual sampling detection method, the present application can not only accurately and quickly detect the device with abnormality after the instance change, but also improve the efficiency of instance change anomaly detection.

[0026] As an optional implementation, Figure 3 As shown, the embodiment of the present application provides an abnormality detection method, the method comprising the following steps: S302, obtain the first traffic characteristics corresponding to each first device in the first device set to obtain a first traffic characteristic set, and the second traffic characteristics corresponding to the second device set to obtain a second traffic characteristic set; the first device set is the device set corresponding to the target instance before the change, and the second device set is the device set corresponding to the target instance after the change.

[0027] S304, obtaining device identifications of the first devices and the second devices, wherein the number of devices in the first device set and the number of devices in the second device set are the same; S306: Determine the first device and the second device with the same device identifier as associated devices having the changed relationship.

[0028] Specifically, in the embodiment of the present application, the device identifier may be a device serial number, a media access control address (MAC), or a universally unique identifier (UUID). For example, if the device identifier is a device serial number, Figure 4As shown, when the change type of the target instance S is an upgrade type, the upgraded target instance S is changed to S'. Assume that the first devices included in the target instance S before the change are device A, device B and device C, respectively, and the device identification of device A is 1001, the device identification of device B is 1002, and the device identification of device C is 1003. The number of devices in instance S' is the same as that in S, and the device identification of device A in instance S' is also 1001, the device identification of device B is 1002, and the device identification of device C is 1003. At this time, the device A corresponding to instance S' and the device A corresponding to S can be determined as associated devices with the above-mentioned change relationship, the device B corresponding to instance S' and the device B corresponding to S can be determined as associated devices, and the device C corresponding to instance S' and the device C corresponding to S can be determined as associated devices with the above-mentioned change relationship. Based on the above technical means, when the instance is upgraded, the associated devices before and after the change can be quickly identified through the device identification, which not only simplifies the change management process, but also can accurately detect whether the device is abnormal after the instance is changed.

[0029] S308: Determine a reference flow range of each second device in the second device set based on the first flow feature set and the change relationship.

[0030] S310: Determine whether an abnormality occurs in any second device in the second device set according to a reference flow range of the second device and a second flow characteristic of the second device.

[0031] The above steps S302, S308-S310 have been explained in the previous text and will not be repeated here.

[0032] As an optional implementation, Figure 5 As shown, the embodiment of the present application provides an abnormality detection method, the method comprising the following steps: S502, obtaining the first traffic characteristics corresponding to each first device in the first device set to obtain a first traffic characteristics set, and the second traffic characteristics corresponding to the second device set to obtain a second traffic characteristics set; the first device set is the device set corresponding to the target instance before the change, and the second device set is the device set corresponding to the target instance after the change. The number of devices in the first device set and the second device set is different.

[0033] S504, for any first traffic feature in the first traffic feature set, respectively calculating the similarity between the first traffic feature and each second traffic feature in the second traffic feature set; S506, determining a second flow feature whose similarity to the first flow feature is greater than or equal to a preset threshold as a target flow feature; S508, determining the first device corresponding to the first traffic feature and the second device corresponding to the target traffic feature as associated devices having the change relationship; S510, determining a first remaining device set and a second remaining device set as an associated device set, wherein the first remaining device set refers to a set of first devices that do not constitute associated devices in the first device set, and the second remaining device set refers to a set of second devices that do not constitute associated devices in the second device set; Specifically, in the embodiment of the present application, when the target instance is expanded or reduced, the number of devices corresponding to it will change, that is, the number of devices in the first device set and the second device set is different. By calculating the similarity between the first traffic feature and the second traffic feature, the change in the traffic features of each device before and after the target instance is changed can be quantified, thereby identifying which devices maintain the same or similar traffic behavior before and after the change; then based on the result of the similarity calculation, the devices with similar traffic features are determined to have associated devices (device pairs) with a change relationship, and finally the remaining device sets that do not have a change relationship are determined as associated device sets; that is, a mapping relationship is established between the first remaining device set and the second remaining device set.

[0034] like Figure 6 As shown, after the target instance S is expanded, its corresponding devices change from three to four, and the first traffic features corresponding to each first device (device A, device B and device C) in the first device set are obtained to obtain a first traffic feature set, and the second traffic features corresponding to the second device set (device A, device B, device C and device D) are obtained to obtain a second traffic feature set. For any first traffic feature in the first traffic feature set, the similarity between the first traffic feature and each second traffic feature in the second traffic feature set is calculated respectively. When it is determined that the similarity between the traffic feature of device A in the first device set and the traffic feature of device B in the second device set is greater than or equal to a preset threshold, and the similarity between the traffic feature of device C of the first device and the traffic feature of device A of the second device is greater than or equal to the preset threshold, at this time, device A in the first device set and device B in the second device set can be determined as associated devices with the change relationship, and device C in the first device set and device A in the second device set can be determined as associated devices.

[0035] The set of first devices that do not constitute associated devices in the first device set includes device B and device D, that is, the first remaining device set includes the first device: device B. The set of second devices that do not constitute associated devices in the second device set includes device C and device D, that is, the second remaining device set includes the second devices: device C and device D. The first remaining device set {device B} and the second remaining device set {device C, device D} are associated device sets.

[0036] like Figure 7 As shown, after the target instance S is scaled down, its corresponding devices change from four to three, and the first traffic features corresponding to each first device (device A, device B, device C and device D) in the first device set are obtained to obtain a first traffic feature set, and the second traffic features corresponding to the second device set (device A, device B and device C) are obtained to obtain a second traffic feature set. For any first traffic feature in the first traffic feature set, the similarity between the first traffic feature and each second traffic feature in the second traffic feature set is calculated respectively. When it is determined that the similarity between the traffic feature of device A in the first device set and the traffic feature of device B in the second device set is greater than or equal to a preset threshold, and the similarity between the traffic feature of device C of the first device and the traffic feature of device A of the second device is greater than or equal to the preset threshold, at this time, device A in the first device set and device B in the second device set can be determined as associated devices, and device C in the first device set and device A in the second device set can be determined as associated devices with the said change relationship.

[0037] The set of first devices that do not constitute associated devices in the first device set includes device B and device D, that is, the first remaining device set includes first devices: device B and device D. The set of second devices that do not constitute associated devices in the second device set includes device C, that is, the second remaining device set includes the second device: device C. The first remaining device set {device B, device D} and the second remaining device set {device C} are associated device sets.

[0038] By calculating the similarity of traffic characteristics between devices before and after the target instance is changed, the embodiment of the present application can more accurately determine the devices associated before and after the change. It can not only accurately track and manage the devices, but also accurately detect whether there are any abnormalities in the devices after the instance is changed.

[0039] S512, determining a reference flow range of each second device in the second device set based on the first flow feature set and the change relationship; the change relationship represents the flow correspondence between the first devices and the second devices.

[0040] S514: Determine whether an abnormality occurs in any second device in the second device set according to a reference flow range of the second device and a second flow characteristic of the second device.

[0041] The above steps S502, S512-S514 have been explained in the previous text and will not be repeated here.

[0042] In one or more embodiments, respectively calculating the similarity between the first traffic feature and each second traffic feature in the second traffic feature set includes: Obtain statistical indicator data, the statistical indicator data including at least one of the following: a statistical indicator corresponding to the first flow feature, a statistical indicator corresponding to each second flow feature, and a statistical indicator of the correlation between the first flow feature and each second flow feature; A preset similarity prediction model is called to predict the statistical indicator data to obtain the similarity between the first flow feature and each second flow feature in the second flow feature set.

[0043] Specifically, in an embodiment of the present application, the above-mentioned similarity prediction model can be a binary classification model based on machine learning. In actual application, the above-mentioned preset threshold can be, for example, 0.5. If the probability output by the binary classification model is higher than this threshold, it is predicted to be a positive class, that is, the first flow feature and the second flow feature are similar; if it is lower than this threshold, it is predicted to be a negative class, that is, the first flow feature and the second flow feature are not similar. The training process of the above-mentioned similarity prediction model includes: first, obtaining a training sample set and a test sample set; the training sample set and the test sample set include statistical indicator data of traffic characteristics; then, obtaining the vectors corresponding to the statistical indicator data of the similarity to be compared in the training sample set, inputting the corresponding vectors into a pre-built similarity prediction pre-training model, and outputting the similarity prediction value corresponding to the statistical indicator data of the similarity to be compared; then, obtaining the similarity verification value corresponding to the statistical indicator data of the similarity to be compared from the test sample set, and calculating the training loss value based on the similarity verification value and the similarity prediction value; when the above-mentioned training loss value reaches the convergence condition, determining to obtain the similarity prediction model; when the above-mentioned convergence condition is not reached, adjusting the model parameters based on the training loss value to continue training until the above-mentioned similarity prediction model is obtained.

[0044] In one example, the structure of the above binary classification model can be (GRU, Dropout, LSTM, LSTM, Normalization, Sigmoid); among them, GRU (Gated Recurrent Unit) is a popular recurrent neural network (RNN) variant, which controls the flow of information by updating gates and resetting gates, thereby reducing the problem of gradient disappearance. Dropout is a regularization method for neural network models. It randomly ignores some neurons during the training process. It can make a neuron unit work with other randomly selected neural units to achieve better results, weaken the joint adaptability between neural nodes, and enhance the generalization ability. Long Short-Term Memory Network (LSTM) is a time recurrent neural network that can learn long-term dependent information. Normalization is a normalization layer that can pull data back to a standard normal distribution. Sigmoid is an activation function used by the activation layer, which is used to map linear output to the (0, 1) interval and is used to convert output into probability in binary classification problems.

[0045] Based on the above two-classification model, the present application can accurately identify the similarity between the first flow feature and each second flow feature in the second flow feature set, thereby improving the reliability of device anomaly detection.

[0046] In one or more embodiments, the statistical indicator data includes at least one of the following: The Euclidean distance between the first flow feature and each of the second flow features; A correlation coefficient between the first flow characteristic and each of the second flow characteristics; The peak values ​​of the first flow characteristic and the second flow characteristics; The first flow feature and the variances of each of the second flow features.

[0047] Specifically, in the embodiment of the present application, the above correlation coefficient may be a Pearson correlation coefficient. The present application combines multiple statistical indicators to enable the model to analyze traffic characteristics from different angles, which not only improves the comprehensiveness of the analysis, but also improves the model's ability to predict the similarity of traffic characteristics.

[0048] In one or more embodiments, the reference flow range includes an upper envelope and a lower envelope, and determining the reference flow range of each second device in the second device set based on the first flow feature set and the change relationship includes: Acquire each associated device that meets the change relationship; For any associated device among the associated devices, obtaining a first traffic feature corresponding to a first device among the associated devices; Calling a preset time series prediction algorithm to determine a first flow value that meets a first preset ratio and a second flow value that meets a second preset ratio in the first flow feature, wherein the first preset ratio is greater than the second preset ratio; The upper limit flow parameter of the reference flow range is the first flow value, and the lower limit flow parameter of the reference flow range is the second flow value.

[0049] Specifically, in the embodiment of the present application, the above-mentioned time series prediction algorithm can be, for example, a seasonal and trend decomposition using Loess (STL) time series data decomposition algorithm, the above-mentioned first preset ratio can be an upper quantile, and the above-mentioned second preset ratio can be a lower quantile. In one example, the above-mentioned upper quantile can be an upper quartile, and the above-mentioned lower quantile can be a lower quartile. The above-mentioned upper limit flow parameter can be an upper envelope of the flow, and the above-mentioned lower limit flow parameter can be a lower envelope of the flow. For any associated device among the associated devices, after obtaining the first flow feature corresponding to the first device in any associated device, call the preset STL algorithm to obtain the upper quantile and lower quantile corresponding to the first flow feature; use the upper quantile as the upper envelope (upper limit flow parameter) corresponding to the reference flow range, and use the lower quantile as the lower envelope (lower limit flow parameter) corresponding to the reference flow range. According to the upper envelope and the lower envelope, the reference flow range corresponding to the second device in each associated device can be accurately determined.

[0050] In one or more embodiments, determining the reference flow range of each second device in the second device set based on the first flow feature set and the change relationship includes: Encode the first traffic feature corresponding to each device in the first remaining device set to obtain a traffic encoding vector; Calling the time series prediction pre-training model to process each traffic encoding vector, and obtaining the predicted traffic range corresponding to each device in the first remaining device set; Based on each of the predicted flow ranges and the change coefficient, a reference flow range corresponding to each device in the second remaining device set is obtained; the change coefficient is obtained according to the number of devices in the first remaining device set and the number of devices in the second remaining device set.

[0051] Specifically, in an embodiment of the present application, the above-mentioned time series prediction pre-training model can be a model obtained by training the traffic data before and after the sample instance is changed based on the Transformer neural network model. First, the first traffic feature corresponding to each device in the first remaining device set is normalized, and the normalized traffic feature is encoded to obtain a traffic encoding vector, and the time series prediction pre-training model is called to process each traffic encoding vector to obtain the predicted traffic range corresponding to each device in the first remaining device set. The above-mentioned change coefficient can be obtained, for example, based on the ratio between the number of devices in the first remaining device set and the number of devices in the second remaining device set; it can also be obtained based on the number of devices in the first remaining device set and the first weight coefficient corresponding to the first remaining device set, and the number of devices in the second remaining device set and the second weight coefficient corresponding to the second remaining device set.

[0052] In one example, the number of devices in the first remaining device set is first calculated, recorded as N1, and the number of devices in the second remaining device set is calculated, recorded as N2, and the change coefficient C=N1 / N2. The reference flow range corresponding to the first remaining device set is the weighted sum of the predicted flow ranges corresponding to each device in the first remaining device set. Assuming that the reference flow range corresponding to the first remaining device set is [L, U], where L is the lower limit and U is the upper limit, then the reference flow range corresponding to each device in the second remaining device set can be [L*C, U*C].

[0053] The embodiment of the present application can effectively capture the long-distance dependencies in the sequence data corresponding to the traffic data based on the Transformer model, and can significantly improve the accuracy of traffic prediction. Based on the change coefficient, the system can dynamically adjust the traffic prediction and reference range according to the changes in the number of devices in the network, thereby enhancing the flexibility and accuracy of change anomaly detection.

[0054] In one or more embodiments, obtaining a reference flow range corresponding to each device in the second remaining device set based on each predicted flow range and the change coefficient includes: Acquire a first number of devices included in the first remaining device set and a second number of devices included in the second remaining device set; Using the ratio of the first quantity to the second quantity as the change coefficient; The weighted value of the upper limit flow parameter corresponding to each predicted flow range is used as the flow peak value, and the weighted value of the lower limit flow parameter corresponding to each predicted flow range is used as the flow valley value; The product of the flow peak value and the change coefficient is determined as the upper limit flow parameter of the reference flow range corresponding to each device in the second remaining device set; and the product of the flow valley value and the change coefficient is determined as the lower limit flow parameter of the reference flow range corresponding to each device in the second remaining device set.

[0055] Specifically, in the embodiments of the present application, Figure 6 As shown, the first number of devices included in the first remaining device set and the second number of devices included in the second remaining device set are obtained, the first number value is 1, the second number value is 2, and the change coefficient is determined to be 0.5. Figure 7 As shown, the first number of devices included in the first remaining device set and the second number of devices included in the second remaining device set are obtained, and the first number value is 2 and the second number value is 1. At this time, the change coefficient is 2.

[0056] like Figure 7 As shown, taking the change type of the target instance as shrinkage as an example, assuming that the reference flow range corresponding to device B in the first remaining device set is [L B , U B ], where L B is the lower limit flow parameter, U B is the upper limit flow parameter, and the reference flow range corresponding to device D is [L D , U D ], where L D is the lower limit flow parameter, U D is the upper limit flow parameter. Assuming that the weight coefficients of device B and device D are both 0.5, the flow peak value is (U B +U D ) / 2, then the flow valley value is (L B + L D ) / 2. The upper limit flow parameter corresponding to device C in the second remaining device set is U B +U D , the lower limit flow parameter corresponding to device C in the second remaining device set is (L B + L D ).

[0057] Based on the above technical means, the embodiments of the present application can dynamically adjust the traffic prediction and reference range according to the changes in the number of devices in the network, enhance the flexibility and accuracy of change anomaly detection, and can also quickly locate the change abnormal devices, reducing the false positives and missed positives of anomaly detection.

[0058] In one or more embodiments, obtaining the first traffic feature corresponding to each first device in the first device set and the second traffic feature corresponding to the second device set includes: A first traffic characteristic of the first device set corresponding to a first duration and a second traffic characteristic of the second device set corresponding to a second duration are obtained, wherein the first duration is greater than the second duration.

[0059] Specifically, the value range of the above-mentioned first time length can be [5, 7] days, and the value range of the above-mentioned second time length can be [5, 20] minutes. The present application is based on obtaining the first traffic feature of the above-mentioned first time length, which is conducive to identifying the long-term trends and periodic patterns corresponding to the traffic features, and can provide more accurate prediction benchmark data for predicting the traffic features of the changed equipment; based on obtaining the first traffic feature of the above-mentioned second time length, it is conducive to quickly discovering sudden changes in traffic. The combination of the two can improve the accuracy of anomaly detection.

[0060] In one or more embodiments, determining whether the second device is abnormal according to the reference flow range of any second device in the second device set and the second flow characteristic of the second device includes: Based on the presence of data in the second flow characteristic corresponding to the second device that is not within the reference flow range corresponding to the second device, it is determined that the second device is abnormal.

[0061] In addition, when it is determined that any second device in the second device set has an abnormality, it can be determined that the target instance has an abnormality after the change.

[0062] Based on the above example, Figure 8 As shown, in an application embodiment, a method for detecting anomalies is provided, the method comprising the following steps: S1. Obtain the indicators of the changed object according to the change plan, including the traffic data of each change instance and each device (gateway) in the instance. Usually, a single change generally includes the traffic data (traffic characteristics) of multiple instances. Obtain the traffic data 7 days before the change as the pre-change data, and obtain the data 10 minutes after the change is completed for subsequent traffic balancing anomaly detection.

[0063] S2, for each change instance, map the change object according to the flow data of the device before the change and the flow data of the device after the change obtained in the previous step. Because the flow time series length before and after the change is quite different, the noise generated when the flow similarity calculation is directly based on the traditional Euclidean distance and Pearson correlation coefficient is large, and the accuracy of the flow similarity calculation is low. In order to improve the accuracy of the flow similarity calculation, Fig. 9As shown, the classification model of this application is based on deep learning. The Euclidean distance, Pearson correlation coefficient, and statistical indicators such as the peak and variance of the two traffic time series are used as input features of the classification model, and the similarity of the two traffic time series is judged according to the classification results. The classification model is a binary classification model with a model structure of (GRU, Dropout, LSTM, LSTM, Normalization, Sigmoid). The training data of the model comes from expert annotations. The model can better identify similar traffic time series, and the model prediction accuracy is high. The similarity of the traffic time series of the corresponding devices before and after the instance change is calculated pairwise, and similar traffic time series are determined as associated devices, and devices other than associated devices are divided into a group. Specifically, it includes the following three situations: 1. If the number of instances before and after the change remains unchanged, it is determined that the mapping of the change object is completed, that is, the same device corresponding to the instance before and after the change is associated; 2. If the number of devices increases after the change, the remaining minority devices before the change except the associated devices after the similarity matching calculation can be mapped to the majority devices after the change; 3. If the number of devices decreases after the change, the remaining majority devices before the change except the associated devices after the similarity matching calculation can be mapped to the minority devices after the change.

[0064] S3. After completing the mapping of the change object, for devices (associated devices) with similar traffic before and after the change, the traffic carried by the associated devices has not changed before and after the change. Therefore, the timing prediction is performed directly based on the device traffic data before the change. The timing prediction algorithm used in this application is the STL timing prediction algorithm using seasonal and trend decomposition. Based on this timing prediction algorithm, the upper and lower envelopes of the device traffic data after the instance change can be obtained, that is, the upper and lower boundary ranges, and the traffic data of each device after the instance change is compared with their corresponding upper and lower envelopes, so as to determine whether the device has abnormalities after the instance change.

[0065] For the remaining devices (non-associated devices), because the changes such as expansion and reduction of capacity cause the device carrying traffic to change before and after the change, there is no one-to-one mapping relationship between the devices before and after the instance change. In order to calculate the accurate interval of the device traffic after the change, the dynamic traffic timing prediction model created by the present application based on the Transformer model scales the upper and lower envelopes of the timing prediction of the device traffic before the change according to the change coefficient of the number of devices before and after the change. For example, in one example, first obtain the number of devices corresponding to the remaining devices (the first remaining device set) before the instance change, recorded as N1, obtain the number of devices corresponding to the remaining devices (the second remaining device set) after the instance change, recorded as N2, and change the change coefficient C=N1 / N2. The reference traffic range corresponding to the first remaining device set is the weighted sum of the predicted traffic ranges corresponding to each device in the first remaining device set. Assuming that the reference traffic range corresponding to the first remaining device set is [L, U], where L is the lower limit and U is the upper limit, then the reference traffic range corresponding to each device in the second remaining device set can be [L*C, U*C]. Based on the fact that there is data in the traffic characteristics corresponding to the changed device that is not between the corresponding reference traffic ranges, it is determined that the current device is abnormal.

[0066] First, the time series with a length of 7 days before the change is input into the dynamic traffic time series prediction model, and normalized at the model input layer to adjust the time series data of different scales to the same order of magnitude. Specifically, the Max-min scaling method can be used; then a unique traffic embedding vector is assigned to each point in the time series based on the cosine function, thereby effectively retaining the sequential characteristics of the time series, so that long time series can be well processed; The encoder part of the model is composed of multiple identical stacked layers. Each layer contains a multi-head self-attention mechanism and a feedforward neural network. The multi-head self-attention mechanism allows the model to focus on different parts of the input sequence from different angles, enhancing the model's ability to capture complex patterns. The feedforward neural network is responsible for performing nonlinear transformations on the information at each position to further extract features. The combination of the two enables the encoder to mine the intrinsic connections of the data while maintaining the structure of the input sequence, thereby obtaining the encoding results of the time series. The decoder is also composed of multiple layers, similar to the encoder, but the decoder has additional functions to meet the needs of timing prediction. Each layer of the decoder processes the target sequence through a masked multi-head self-attention mechanism to prevent the leakage of future information during the training process and ensure the accuracy of the prediction. The encoding result is input and the timing prediction result is output. Finally, based on the timing prediction result, the abnormal device change is identified and the traffic balance detection result after the change is judged, which can help the operation and maintenance personnel improve their work efficiency.

[0067] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0068] According to another aspect of the embodiment of the present application, an abnormality detection device is also provided. Fig.10 As shown, the device comprises: The first acquisition unit 1002 is used to acquire the first traffic feature corresponding to each first device in the first device set to obtain a first traffic feature set, and the second traffic feature corresponding to the second device set to obtain a second traffic feature set; the first device set is a device set corresponding to the target instance before the change, and the second device set is a device set corresponding to the target instance after the change; The second acquisition unit 1004 is used to acquire a change relationship between each first device in the first device set and each second device in the second device set; the change relationship represents a flow correspondence relationship between each first device and each second device; A first determining unit 1006, configured to determine a reference flow range of each second device in the second device set based on the first flow feature set and the change relationship; The second determination unit 1008 is configured to determine whether an abnormality occurs in any second device in the second device set according to a reference flow range of the second device and a second flow characteristic of the second device.

[0069] In an embodiment of the present application, a method is adopted in which a first flow feature corresponding to each first device in a first device set is obtained to obtain a first flow feature set, and a second flow feature corresponding to a second device set is obtained to obtain a second flow feature set; the first device set is a device set corresponding to a target instance before the change, and the second device set is a device set corresponding to the target instance after the change; a change relationship between each first device in the first device set and each second device in the second device set is obtained; the change relationship represents the flow correspondence relationship between each first device and each second device; based on the first flow feature set and the change relationship, a reference flow range of each second device in the second device set is determined; a method is used to determine whether an abnormality occurs in the second device according to the reference flow range of any second device in the second device set and the second flow feature of the second device; the present application can accurately obtain the reference flow range of the corresponding device after the change according to the flow features corresponding to the device set corresponding to the target instance before and after the change, and the flow correspondence relationship between the corresponding device sets before and after the change, and judge whether an abnormality occurs in the target instance after the change according to the reference flow range, Compared with the manual sampling detection method, the present application can not only accurately and quickly detect the device that has abnormalities after the instance change, but also improve the efficiency of instance change anomaly detection.

[0070] In one or more embodiments, when the number of devices in the first device set and the number of devices in the second device set are the same, the second obtaining unit 1004 includes: A first acquisition module, used to acquire device identifications of each of the first devices and each of the second devices; The first determining module is used to determine the first device and the second device with the same device identifier as associated devices having the change relationship.

[0071] In one or more embodiments, when the number of devices in the first device set and the number of devices in the second device set are different, the second obtaining unit 1004 includes: a calculation module, configured to calculate, for any first flow feature in the first flow feature set, a similarity between the first flow feature and each second flow feature in the second flow feature set; A second determination module, configured to determine a second flow feature whose similarity to the first flow feature is greater than or equal to a preset threshold as a target flow feature; A third determining module, configured to determine the first device corresponding to the first traffic feature and the second device corresponding to the target traffic feature as associated devices having the change relationship; The fourth determination module is used to determine the first remaining device set and the second remaining device set as associated device sets, wherein the first remaining device set refers to the set of first devices in the first device set that do not constitute associated devices, and the second remaining device set refers to the set of second devices in the second device set that do not constitute associated devices.

[0072] In one or more embodiments, the computing module comprises: A first acquisition subunit is used to acquire statistical indicator data, wherein the statistical indicator data includes at least one of the following: a statistical indicator corresponding to the first flow feature and a statistical indicator corresponding to each second flow feature, and a statistical indicator of the correlation between the first flow feature and each second flow feature; The prediction subunit is used to call a preset similarity prediction model to predict the statistical indicator data, and obtain the similarity between the first flow feature and each second flow feature in the second flow feature set.

[0073] In one or more embodiments, the statistical indicator data includes at least one of the following: The Euclidean distance between the first flow feature and each of the second flow features; A correlation coefficient between the first flow characteristic and each of the second flow characteristics; The peak values ​​of the first flow characteristic and the second flow characteristics; The first flow feature and the variances of each of the second flow features.

[0074] In one or more embodiments, the first determining unit 1006 includes: A second acquisition module, used to acquire each associated device that meets the change relationship; A third acquisition module, configured to acquire, for any associated device among the associated devices, a first traffic feature corresponding to a first device among the associated devices; The fifth determination module is used to call a preset timing prediction algorithm to determine a first flow value that meets a first preset ratio and a second flow value that meets a second preset ratio in the first flow characteristic, wherein the first preset ratio is greater than the second preset ratio; the upper limit flow parameter of the reference flow range is the first flow value, and the lower limit flow parameter of the reference flow range is the second flow value.

[0075] In one or more embodiments, the first determining unit 1006 includes: An encoding module, used for encoding a first traffic feature corresponding to each device in the first remaining device set to obtain a traffic encoding vector; A sixth acquisition module, used for calling a time series prediction pre-training model to process each traffic encoding vector, and obtaining a predicted traffic range corresponding to each device in the first remaining device set; The seventh acquisition module is used to obtain the reference flow range corresponding to each device in the second remaining device set based on each predicted flow range and the change coefficient; the change coefficient is obtained according to the number of devices in the first remaining device set and the number of devices in the second remaining device set.

[0076] In one or more embodiments, the seventh acquisition module includes: A second acquisition subunit, configured to acquire a first number of devices included in the first remaining device set and a second number of devices included in the second remaining device set; A first determining subunit is configured to use a ratio of the first quantity to the second quantity as the change coefficient; A second determination subunit is used to use the weighted value of the upper limit flow parameter corresponding to each of the predicted flow ranges as the flow peak value, and use the weighted value of the lower limit flow parameter corresponding to each of the predicted flow ranges as the flow valley value; The third determination subunit is used to determine the product of the flow peak value and the change coefficient as the upper limit flow parameter of the reference flow range corresponding to each device in the second remaining device set; and to determine the product of the flow valley value and the change coefficient as the lower limit flow parameter of the reference flow range corresponding to each device in the second remaining device set.

[0077] In one or more embodiments, the first acquiring unit 1002 includes: An eighth acquisition module is used to acquire a first traffic characteristic of the first device set corresponding to a first duration, and a second traffic characteristic of the second device set corresponding to a second duration, wherein the first duration is greater than the second duration.

[0078] In one or more embodiments, the second determining unit 1008 includes: The sixth determination module is used to determine that an abnormality occurs in the second device based on the presence of data in the second flow characteristic corresponding to the second device that is not within the reference flow range corresponding to the second device.

[0079] According to another aspect of the embodiment of the present application, there is also provided an anomaly detection system for implementing the above anomaly detection method, the anomaly detection system comprising: a first cloud gateway set corresponding to the target instance before the change, a second cloud gateway set corresponding to the target instance after the change, and a detection server; The detection server is used to obtain the first traffic characteristics corresponding to each first cloud gateway in the first cloud gateway set to obtain a first traffic characteristic set, and the second traffic characteristics corresponding to the second cloud gateway set to obtain a second traffic characteristic set; Obtaining a change relationship between each first cloud gateway in the first cloud gateway set and each second cloud gateway in the second cloud gateway set; the change relationship represents a traffic correspondence relationship between each first cloud gateway and each second cloud gateway; Determine a reference flow range of each second cloud gateway in the second cloud gateway set based on the first flow feature set and the change relationship; Whether an abnormality occurs in the second cloud gateway is determined according to a reference traffic range of any second cloud gateway in the second cloud gateway set and a second traffic feature of the second cloud gateway.

[0080] Specifically, in the embodiment of the present application, the cloud gateway can be a server or a group of server clusters, which serve as the entry point of network traffic, process requests from clients and route them to backend services. In other embodiments, the cloud gateway can also be a virtual network switch, elastic network card, etc. or a load balancer, firewall, etc.

[0081] According to another aspect of the embodiment of the present application, an electronic device for implementing the above-mentioned abnormality detection method is also provided, and the electronic device may be a terminal or a server. This embodiment is described by taking the electronic device as a server as an example. Fig.11 As shown, the electronic device includes a memory 1102 and a processor 1104. The memory 1102 stores a computer program, and the processor 1104 is configured to execute the steps in any of the above method embodiments through the computer program.

[0082] Optionally, in this embodiment, the electronic device may be at least one network device among a plurality of network devices of a computer network.

[0083] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program: S1, obtaining a first traffic feature corresponding to each first device in a first device set to obtain a first traffic feature set, and a second traffic feature corresponding to a second device set to obtain a second traffic feature set; the first device set is a device set corresponding to a target instance before the change, and the second device set is a device set corresponding to the target instance after the change; S2, obtaining a change relationship between each first device in the first device set and each second device in the second device set; the change relationship represents a flow correspondence relationship between each first device and each second device; S3, determining a reference flow range of each second device in the second device set based on the first flow feature set and the change relationship; S4: Determine whether an abnormality occurs in any second device in the second device set according to a reference flow range of the second device and a second flow characteristic of the second device.

[0084] Alternatively, a person skilled in the art may understand that: Fig.11 The structure shown is for illustration only, and the electronic device may also be a cloud server or a physical server, or a cloud server cluster or a physical server cluster, etc. Fig.11 The structure of the electronic device is not limited. Fig.11 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig.11 Different configurations are shown.

[0085] Among them, the memory 1102 can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal detection method and device in the embodiment of the present application, and the processor 1104 executes various functional applications and data processing by running the software programs and modules stored in the memory 1102, that is, realizing the above-mentioned abnormal detection method. The memory 1102 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1102 may further include a memory remotely arranged relative to the processor 1104, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. Among them, the memory 1102 can be specifically used, but not limited to, for storing the flow characteristics of the device before and after the change, and the flow correspondence between the devices before and after the instance change.

[0086] As an example, Fig.11 As shown, the memory 1102 may include, but is not limited to, the first acquisition unit 1002, the second acquisition unit 1004, the first determination unit 1006, and the second determination unit 1008 in the data processing device. In addition, other module units in the data processing device may also be included but are not limited to, which will not be repeated in this example.

[0087] Optionally, the transmission device 1106 is used to receive or send data via a network. Specific examples of the network may include a wired network and a wireless network. In one example, the transmission device 1106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 1106 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0088] In addition, the electronic device further includes: a display 1108 for displaying the operating status of the device; and a connection bus 1110 for connecting various module components in the electronic device.

[0089] In other embodiments, the electronic device may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. The nodes may form a peer-to-peer (P2P) network, and any form of computing device, such as a server, terminal, or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0090] In one or more embodiments, the present application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above-mentioned anomaly detection method. Wherein, the computer program is configured to execute the steps of any of the above-mentioned method embodiments when running.

[0091] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps: S1, obtaining a first traffic feature corresponding to each first device in a first device set to obtain a first traffic feature set, and a second traffic feature corresponding to a second device set to obtain a second traffic feature set; the first device set is a device set corresponding to a target instance before the change, and the second device set is a device set corresponding to the target instance after the change; S2, obtaining a change relationship between each first device in the first device set and each second device in the second device set; the change relationship represents a flow correspondence relationship between each first device and each second device; S3, determining a reference flow range of each second device in the second device set based on the first flow feature set and the change relationship; S4: Determine whether an abnormality occurs in any second device in the second device set according to a reference flow range of the second device and a second flow characteristic of the second device.

[0092] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0093] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0094] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which can be personal computers, servers or network devices, etc.) to execute all or part of the steps of the methods of various embodiments of the present invention.

[0095] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0096] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0097] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0098] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0099] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

[0100] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Obtain the first traffic feature corresponding to each first device in the first device set to obtain a first traffic feature set, and the second traffic feature corresponding to the second device set to obtain a second traffic feature set; the first device set is the device set corresponding to the target instance before the change, and the second device set is the device set corresponding to the target instance after the change; Acquire a change relationship between each first device in the first device set and each second device in the second device set; the change relationship represents a flow correspondence relationship between each first device and each second device; Determining a reference flow range of each second device in the second device set based on the first flow feature set and the change relationship; It is determined whether an abnormality occurs in any second device in the second device set according to a reference flow range of the second device and a second flow characteristic of the second device.

2. The method according to claim 1, characterized in that In a case where the number of devices in the first device set and the number of devices in the second device set are the same, obtaining a change relationship between each first device in the first device set and each second device in the second device set includes: Obtaining device identifications of each of the first devices and each of the second devices; The first device and the second device having the same device identification are determined as associated devices having the changed relationship.

3. The method according to claim 1, characterized in that In a case where the number of devices in the first device set and the number of devices in the second device set are different, the acquiring a change relationship between each first device in the first device set and each second device in the second device set includes: For any first flow feature in the first flow feature set, respectively calculating the similarity between the first flow feature and each second flow feature in the second flow feature set; Determine a second flow feature whose similarity to the first flow feature is greater than or equal to a preset threshold as a target flow feature; Determine the first device corresponding to the first flow characteristic and the second device corresponding to the target flow characteristic as associated devices having the change relationship; The first remaining device set and the second remaining device set are determined as associated device sets, wherein the first remaining device set refers to a set of first devices in the first device set that do not constitute associated devices, and the second remaining device set refers to a set of second devices in the second device set that do not constitute associated devices.

4. The method according to claim 3, characterized in that The respectively calculating the similarity between the first traffic feature and each second traffic feature in the second traffic feature set includes: Obtain statistical indicator data, the statistical indicator data including at least one of the following: a statistical indicator corresponding to the first flow feature, a statistical indicator corresponding to each second flow feature, and a statistical indicator of the correlation between the first flow feature and each second flow feature; A preset similarity prediction model is called to predict the statistical indicator data to obtain the similarity between the first flow feature and each second flow feature in the second flow feature set.

5. The method according to claim 4, characterized in that The statistical indicator data includes at least one of the following: The Euclidean distance between the first flow feature and each of the second flow features; A correlation coefficient between the first flow characteristic and each of the second flow characteristics; The peak values ​​of the first flow characteristic and the second flow characteristics; The first flow feature and the variances of each of the second flow features.

6. The method according to claim 2 or 3, characterized in that: The determining, based on the first flow characteristic set and the change relationship, a reference flow range of each second device in the second device set includes: Acquire each associated device that meets the change relationship; For any associated device among the associated devices, obtaining a first traffic feature corresponding to a first device among the associated devices; Calling a preset time series prediction algorithm to determine a first flow value that meets a first preset ratio and a second flow value that meets a second preset ratio in the first flow feature, wherein the first preset ratio is greater than the second preset ratio; The upper limit flow parameter of the reference flow range is the first flow value, and the lower limit flow parameter of the reference flow range is the second flow value.

7. The method according to any one of claims 3 to 5, characterized in that: The determining, based on the first flow characteristic set and the change relationship, a reference flow range of each second device in the second device set includes: Encode the first traffic feature corresponding to each device in the first remaining device set to obtain a traffic encoding vector; Calling the time series prediction pre-training model to process each traffic encoding vector, and obtaining the predicted traffic range corresponding to each device in the first remaining device set; Based on each of the predicted flow ranges and the change coefficient, a reference flow range corresponding to each device in the second remaining device set is obtained; the change coefficient is obtained according to the number of devices in the first remaining device set and the number of devices in the second remaining device set.

8. The method according to claim 7, characterized in that The obtaining, based on each of the predicted flow ranges and the change coefficient, a reference flow range corresponding to each device in the second remaining device set includes: Acquire a first number of devices included in the first remaining device set and a second number of devices included in the second remaining device set; Using the ratio of the first quantity to the second quantity as the change coefficient; The weighted value of the upper limit flow parameter corresponding to each predicted flow range is used as the flow peak value, and the weighted value of the lower limit flow parameter corresponding to each predicted flow range is used as the flow valley value; The product of the flow peak value and the change coefficient is determined as the upper limit flow parameter of the reference flow range corresponding to each device in the second remaining device set; and the product of the flow valley value and the change coefficient is determined as the lower limit flow parameter of the reference flow range corresponding to each device in the second remaining device set.

9. The method according to any one of claims 1 to 5, characterized in that: The obtaining of the first traffic feature corresponding to each first device in the first device set and the second traffic feature corresponding to the second device set includes: A first traffic characteristic of the first device set corresponding to a first duration and a second traffic characteristic of the second device set corresponding to a second duration are obtained, wherein the first duration is greater than the second duration.

10. The method according to any one of claims 1 to 5, characterized in that: The determining whether the second device is abnormal according to the reference flow range of any second device in the second device set and the second flow characteristic of the second device includes: Based on the presence of data in the second flow characteristic corresponding to the second device that is not within the reference flow range corresponding to the second device, it is determined that the second device is abnormal.

11. An abnormality detection device, characterized in that: The device comprises: A first acquisition unit is used to acquire a first traffic feature corresponding to each first device in a first device set to obtain a first traffic feature set, and a second traffic feature corresponding to a second device set to obtain a second traffic feature set; the first device set is a device set corresponding to a target instance before the change, and the second device set is a device set corresponding to the target instance after the change; A second acquisition unit, configured to acquire a change relationship between each first device in the first device set and each second device in the second device set; the change relationship represents a flow correspondence relationship between each first device and each second device; A first determining unit, configured to determine a reference flow range of each second device in the second device set based on the first flow feature set and the change relationship; The second determining unit is configured to determine whether an abnormality occurs in any second device in the second device set according to a reference flow range of the second device and a second flow characteristic of the second device.

12. An anomaly detection system, characterized in that: The anomaly detection system includes: a first cloud gateway set corresponding to the target instance before the change, a second cloud gateway set corresponding to the target instance after the change, and a detection server; The detection server is used to obtain the first traffic characteristics corresponding to each first cloud gateway in the first cloud gateway set to obtain a first traffic characteristic set, and the second traffic characteristics corresponding to the second cloud gateway set to obtain a second traffic characteristic set; Obtaining a change relationship between each first cloud gateway in the first cloud gateway set and each second cloud gateway in the second cloud gateway set; the change relationship represents a traffic correspondence relationship between each first cloud gateway and each second cloud gateway; Determining a reference flow range of each second cloud gateway in the second cloud gateway set based on the first flow feature set and the change relationship; Whether an abnormality occurs in the second cloud gateway is determined according to a reference traffic range of any second cloud gateway in the second cloud gateway set and a second traffic feature of the second cloud gateway.

13. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method according to any one of claims 1 to 10.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: The program is executed by a processor to implement the method according to any one of claims 1 to 10.

15. A computer program product comprising a computer program, characterized in that The computer program is executed by a processor to implement the method according to any one of claims 1 to 10.

Images