Server anomaly detection method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a server anomaly detection method and device, equipment and a storage medium. The method comprises the steps of obtaining monitoring data of a server and extracting time sequence features, processing the time sequence features through a trained auto-encoder model to obtain reconstruction features, then calculating a difference value between the time sequence features and the reconstruction features, and determining an abnormal state of the server according to the difference value. The method is used for achieving the effect of improving the accuracy of server anomaly detection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a server anomaly detection method, device, equipment and storage medium. Background Art

[0002] Data centers play an important role in the information age, and the health of servers affects the normal operation of the entire data center. With the rapid advancement of computer technology and the continuous expansion of data center scale, the operation and maintenance monitoring of servers is becoming more and more important.

[0003] Currently, server monitoring methods mainly evaluate server status based on various key performance indicators (KPIs), such as CPU utilization, memory utilization, network bandwidth utilization, etc., and try to predict and identify potential anomalies or failures by collecting and analyzing these indicators.

[0004] However, with the increase in server architecture and operational complexity, these methods have many limitations, especially when dealing with high-dimensional and large-scale real-time data, the data processing capabilities are poor and it is difficult to accurately detect server anomalies. Summary of the invention

[0005] The embodiments of the present application provide a server anomaly detection method, apparatus, device and storage medium to achieve the effect of improving the accuracy of server detection.

[0006] In a first aspect, an embodiment of the present application provides a server anomaly detection method, comprising:

[0007] Get monitoring data of the server;

[0008] Extracting time series features of the monitoring data;

[0009] Processing the time series features through an autoencoder model to obtain reconstruction features;

[0010] A difference value between the time series feature and the reconstruction feature is calculated, and an abnormal state of the server is determined according to the difference value.

[0011] In a second aspect, an embodiment of the present application provides a server anomaly detection device, comprising:

[0012] An acquisition module is used to obtain monitoring data of the server;

[0013] An extraction module, used to extract the time series characteristics of the monitoring data;

[0014] A reconstruction module, used for processing the time series features through an autoencoder model to obtain a reconstructed feature;

[0015] The abnormality determination module is used to calculate the difference value between the timing feature and the reconstruction feature, and determine the abnormal state of the server according to the difference value.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0017] The memory stores computer-executable instructions;

[0018] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0019] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0020] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0022] Figure 1 A schematic diagram of a server anomaly detection method provided in this application Figure 1 ;

[0023] Figure 2 A schematic diagram of a server anomaly detection method provided in this application Figure 2 ;

[0024] Figure 3 A schematic diagram of the structure of an autoencoder model provided in this application;

[0025] Figure 4 A schematic diagram of a server anomaly detection method provided in this application Figure 3 ;

[0026] Figure 5 A schematic diagram for converting features into tensors provided for this application;

[0027] Figure 6 A schematic diagram of a convolutional long short-term memory network structure provided for this application;

[0028] Figure 7A schematic diagram of a server anomaly detection method provided in this application Figure 4 ;

[0029] Figure 8 A schematic diagram of the structure of a server anomaly detection device provided in this application;

[0030] Fig. 9 A schematic diagram of the structure of an electronic device provided in this application.

[0031] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0032] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0033] In the operation and maintenance management of modern data centers, continuous monitoring of the health status of servers is a critical task. Traditional server monitoring systems mainly evaluate server status based on various key performance indicators (KPIs), such as CPU utilization, memory utilization, network bandwidth utilization, etc. These systems try to predict and identify potential anomalies or failures by collecting and analyzing these indicators.

[0034] However, as data centers expand in size and services become more complex, how traditional monitoring technologies can effectively process and analyze massive amounts of monitoring data has become a new challenge. These systems often require professional manual settings and maintenance of a large number of thresholds and rules, which not only increases the complexity and cost of operation and maintenance, but may also lead to missed reports or false alarms due to improper settings.

[0035] After research, the inventor proposed a solution to the above technical problems. The model used to detect abnormal status of the server is trained using machine learning technology. The relationship between various data of the server is discovered through the model, so that the server-related monitoring data can be quickly processed to determine the abnormal status of the server. In this process, the inventor further discovered that this model for detecting the status of the server relies on a large amount of manually labeled data for supervised learning, but it is difficult to obtain sufficient labeled data (especially abnormal status data), and manual labeling is time-consuming and laborious, resulting in fewer samples for training and insufficient accuracy. The inventor therefore thought that an autoencoder model could be used in combination with unlabeled data for self-supervised learning. In this way, the model can be trained for detecting server anomalies, which can not only reduce dependence on manual intervention, but also automatically learn and extract deep features from larger-scale server data, thereby improving the accuracy of anomaly detection.

[0036] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0037] Figure 1 The following is a flow chart of a server anomaly detection method provided in this application. Figure 1 As shown, the method includes:

[0038] Step S101, obtaining monitoring data of the server.

[0039] The monitoring data may include data of multiple indicator dimensions such as the server's CPU (Central Processing Unit) utilization, memory utilization, and network bandwidth utilization.

[0040] Step S102: extracting time series features of monitoring data.

[0041] Specifically, for each indicator dimension of the monitoring data, data of a preset time length under the dimension can be extracted, and then the data extracted from each dimension can be combined to obtain the time series characteristics of the monitoring data.

[0042] For example, for the dimension of CPU usage, the CPU usage of the server at time point t can be used as a benchmark, and data with a time length of p can be extracted from time point t forward to obtain the CPU usage from time (tp) to time t.

[0043] In some possible implementations, for monitoring data in multiple dimensions, the inner products of data extraction results with a time length of p extracted from different dimensions can be calculated pairwise, and a feature matrix can be obtained by integrating all dimensions. The feature matrix can represent the correlation between data of different dimensions from time (tp) to time t.

[0044] Step S103, processing the time series features through the autoencoder model to obtain reconstructed features.

[0045] The autoencoder is a neural network architecture that can characterize input data based on unsupervised learning. The autoencoder model in this embodiment can be a model trained based on the autoencoder architecture, and the model can include an encoder and a decoder.

[0046] Specifically, the historical monitoring data of the server can be used as training samples, and the autoencoder model can be pre-trained using the autoencoder architecture, and the model can include an encoder and a decoder. For the trained autoencoder model, the encoder of the model can convert the input time series features into low-dimensional features, and then the decoder can restore and reconstruct the low-dimensional features to obtain reconstructed features.

[0047] Exemplarily, after obtaining a feature matrix characterizing the association between data of different dimensions as the time series features of the monitoring data, the feature matrix can be processed according to the format requirements of the autoencoder model and then input into the model. The encoder of the model performs convolution and other operations on the input data to obtain intermediate features, and then the decoder of the model processes the intermediate features to obtain a reconstructed matrix corresponding to the input feature matrix.

[0048] Step S104, calculating the difference between the time series feature and the reconstruction feature, and determining the abnormal state of the server according to the difference.

[0049] Specifically, the difference between the time series features of the monitoring data and the reconstructed features output by the model can be calculated by algorithms such as MSE (Mean Squared Error), and whether the server is in an abnormal state can be determined based on the preset abnormality identification rules. For example, the calculated difference value can be compared with the preset threshold value. If the difference value is greater than or equal to the preset threshold value, it is determined that the server is abnormal. For another example, the difference value can be mapped to a probability value within the target range according to the preset mapping rules, and the probability of the server being abnormal is represented by the probability value.

[0050] The server anomaly detection method provided in the embodiment of the present application can extract time series features based on the monitoring data of the server, and the time series features can be processed by a trained autoencoder model to obtain reconstruction features, and then the difference between the time series features and the reconstruction features is calculated, and the abnormal state of the server can be determined according to the difference value. By using a model, higher-dimensional and larger-scale monitoring data can be processed. The model can not only learn the association between data of different dimensions, but also learn the association between data of different time series, so that the output results of the model can be used to assist in determining the abnormal state of the server, thereby improving the accuracy of anomaly detection. In addition, the use of a model based on an autoencoder architecture can perform model training through self-supervised learning, reduce dependence on manually labeled data, and reduce time and labor costs.

[0051] Figure 2 A schematic diagram of a server anomaly detection method provided in this application Figure 2 In this embodiment, the monitoring data may include performance indicator data and audio monitoring data, such as Figure 2 As shown in Figure 2, the time series features of the extracted monitoring data include:

[0052] Step S201 , preprocessing the performance indicator data and the audio monitoring data respectively to obtain a multi-dimensional performance feature vector and a multi-dimensional audio feature vector.

[0053] Among them, the performance indicator data may include data of multiple indicator dimensions such as the server's CPU (Central Processing Unit) usage, memory usage, network bandwidth utilization, etc. Audio monitoring data may be collected from the sound signals emitted by the server during operation. The sound signals emitted by the server may include the operating sounds of mechanical parts such as the server's fan and hard disk.

[0054] For performance indicator data, feature vectors can be established based on indicator data of different dimensions, and the obtained KPI (performance indicator data) data can be combined into an n-dimensional performance feature vector. n is the number of dimensions of the performance indicator data. The performance feature vector at time t can be expressed as

[0055] For audio monitoring data, feature extraction can be performed on the audio monitoring data according to time domain features, frequency domain features, and cepstrum features. Time domain features may include amplitude statistical features, energy features, zero crossing rate (ZCR, which can indicate the rate at which a signal crosses zero), etc. Frequency domain features may include spectrum centroid, spectrum roll-off point, and spectrum flattening, etc. Cepstrum features may be Mel-frequency cepstrum coefficients (MFCC) of audio monitoring data. The spectrum roll-off point may indicate the frequency in the spectrum that accumulates to a certain percentage of energy, and the spectrum flattening may reflect the flatness or sharpness of the spectrum morphology.

[0056] For example, the amplitude statistical features can select statistics such as mean, standard deviation, maximum value, minimum value, etc. Each statistic represents a dimension of the audio feature vector. Energy, zero crossing rate, spectrum centroid, spectrum roll-off point and spectrum flatness are each used as a dimension, and 13 coefficients are selected according to the Mel frequency cepstrum coefficients of the audio monitoring data (each coefficient represents a dimension). After merging these features, a multi-dimensional audio feature vector can be obtained, which can be expressed as The vector contains 22 dimensions, and the specific dimensions are: 13 (MFCC) + 4 (4 statistics of time domain features) + 1 (energy) + 1 (ZCR) + 3 (frequency domain features) = 22.

[0057] Step S202: concatenate and combine the performance feature vector and the audio feature vector to obtain a multimodal fusion feature vector.

[0058] Specifically, for each dimension of the performance feature vector, the eigenvalue of the preset time step is extracted, and the eigenvalue is concatenated with the multi-dimensional audio feature vector to obtain a multimodal fusion feature vector in this dimension.

[0059] Exemplarily, at any time t, for each dimension of the n-dimensional performance feature vector, a feature value of time length p can be extracted to obtain a performance time series feature of time length p, and the 22-dimensional audio feature vector can be concatenated with the performance time series feature to obtain a w-dimensional multimodal fusion feature vector. Wherein, w = 22 + p. It can be understood that for each indicator dimension of the performance feature vector, a w-dimensional multimodal fusion feature vector can be obtained. The performance feature vector has n indicator dimensions, so n w-dimensional multimodal fusion feature vectors can be obtained.

[0060] Step S203: Based on the data dimension of the performance feature vector, a feature matrix is ​​established according to the multimodal fusion feature vector.

[0061] Among them, the feature matrix represents the time series characteristics of the monitoring data.

[0062] For example, at time t, the inner product between n w-dimensional multimodal fusion feature vectors can be calculated to obtain a feature matrix M of size n×n: t , the feature matrix M t It can reflect the correlation status between the time series characteristics of each indicator dimension corresponding to the data from time (tp) to time t. The elements in this matrix are It is the inner product of the time series features of the i-th indicator dimension and the j-th indicator dimension within this period, indicating the correlation between the i-th indicator dimension (such as CPU usage) and the j-th indicator dimension (such as memory usage).

[0063] Features with two different indicator dimensions and For example, concatenating the corresponding audio feature vectors back, The correlation can be calculated by the following formula (1):

[0064]

[0065] where κ is a rescaling factor (eg, κ=w).

[0066] Feature matrix M t It can not only capture the shape similarity and numerical proportional correlation of the time series features of data in two different dimensions, but also reduce the impact of fluctuations in a single time series feature on the feature matrix, thereby enhancing the robustness to input noise.

[0067] In some possible implementations, the audio monitoring data is obtained by: setting an audio sensor around the server; collecting sound signals generated by the server during operation through the audio sensor to obtain the audio monitoring data.

[0068] For the collection of monitoring data, audio sensors can be deployed on physical servers to collect key performance indicator (KPI) monitoring data of the servers, and these data can be synchronized and preprocessed to form a unified input format. Secondly, the KPI data and audio data are preprocessed by basic feature extraction and multimodal data fusion to obtain standardized input data for use in the training and prediction of the autoencoder model.

[0069] After research, the inventors also found that relying solely on digital performance indicator data cannot fully reflect the potential status of the server. For example, in some cases, changes in performance indicators may not immediately indicate a physical hardware failure, such as a server cooling system failure or hard disk damage. Such failures may not cause significant performance degradation in the early stages, but if not handled in a timely manner, they may cause serious operational interruptions to the server and even the data center.

[0070] The inventor therefore thought that in addition to collecting monitoring data such as the server's performance indicators, it is also possible to capture real-time audio monitoring data of the server's physical status by deploying audio sensors around the server, and combine this new data dimension with the performance indicator data. Through this multimodal data fusion method, the system can not only use traditional indicators for performance monitoring, but also capture hardware fault signals that may not be immediately reflected in the performance indicators by analyzing audio data.

[0071] The inventor applied this idea to the above-mentioned embodiment. By combining performance indicators and multimodal audio data, the complementary advantages of audio and traditional monitoring data can be utilized to improve the model's ability to recognize abnormal conditions, thereby improving the accuracy of anomaly detection and timely discovering server anomalies, thereby improving the efficiency and response speed of data center operation and maintenance.

[0072] In one embodiment, the autoencoder model may include an encoder and a decoder, the encoder including multiple convolutional layers based on a long short-term memory network.

[0073] Among them, the Long Short-Term Memory (LSTM) is a recurrent neural network (RNN) that can be used to process and predict sequence data.

[0074] Exemplarily, when training an autoencoder model, an attention-based convolutional long short-term memory network (ConvLSTM) can be selected to construct an encoder, and a scaled exponential linear unit (SELU) can be selected as an activation function.

[0075] Figure 3 This is a schematic diagram of the structure of an autoencoder model provided in this application. Figure 3 As shown, the ConvLSTM encoder can use 4 convolutional layers (Conv1, Conv2, Conv3 and Conv4), which can have 32 3×3×3 convolution kernels, 64 3×3×32 convolution kernels, 128 3×3×64 convolution kernels, 256 3×3×128 convolution kernels, and strides of 1×1, 2×2, 2×2 and 2×2 respectively.

[0076] Figure 4 A schematic diagram of a server anomaly detection method provided in this application Figure 3 .like Figure 4 As shown, the processing of time series features through the autoencoder model includes:

[0077] Step S401, combining feature matrices corresponding to multiple different time steps into a three-dimensional tensor.

[0078] Specifically, for a time point t, the feature vector can be constructed and the corresponding feature matrix M can be established when the time step takes different values ​​(such as p = 10, p = 30, p = 60). t , then M t The connections corresponding to different step lengths are a tensor This tensor is then fed into multiple convolutional layers of the encoder.

[0079] In an example, the process of converting a 2D feature into a 3D tensor can be seen in Figure 5, any eigenvalue in the two-dimensional matrix can be mapped to the three-dimensional tensor according to the preset mapping relationship.

[0080] Step S402, performing a convolution operation on the three-dimensional tensor through multiple convolutional layers of the encoder to obtain output features of the encoder and determine the hidden state of the convolutional layer.

[0081] For example, based on Figure 3 The multiple convolutional layers (Conv1-Conv4) of the encoder shown can perform convolution operations on the input tensor. If the feature map at the l-1 layer is Then the output of layer l can be expressed as:

[0082]

[0083] Among them, * can represent the convolution operation, f(·) is the activation function, Indicates d l The size is k l ×k l ×d l-1 The convolution kernel, is a bias term, is the output feature map of the lth layer.

[0084] For the above convolution operation, the spatial feature map generated by the encoder depends on the previous time step in time step. Given the output feature map of the lth convolutional layer and the hidden state at the previous time step The hidden state at the current time step The updating process can be expressed as the following formula (2):

[0085]

[0086] Among them, the ConvLSTM unit can be defined as follows:

[0087]

[0088] In the above formula, * can represent the convolution operation, ° can represent the Hadamard product, and σ can represent the sigmoid function. Is the size of The convolution kernel, is the bias parameter.

[0089] For example, the structure of the ConvLSTM neural network can be found in Figure 6 The network structure diagram shown.

[0090] Step S403: Deconvolution operation is performed on the output features by combining the decoder with the hidden state to obtain a reconstruction matrix.

[0091] Exemplarily, in order to reconstruct the feature map output by the encoder to obtain a reconstruction matrix, the feature map can be processed by a decoder, which can include multiple deconvolution layers (such as Figure 3 DeConv1, DeConv2, DeConv3 and DeConv4 in ). The decoder can be expressed by the following formula (3):

[0092]

[0093] In the above formula (3), * can represent the convolution operation, is the connection operation, f(·) is the activation function (the activation function can be the same as the encoder), and are the convolution kernel and bias parameters of the lth deconvolution layer respectively.

[0094] See also Figure 3 The structure of the autoencoder model shown in the figure can decode the hidden state of the l-th layer ConvLSTM Input the deconvolution layer of the decoder and convert the output feature map of the l-1th layer The output of the previous ConvLSTM layer is connected to make the decoding process superimposed. The connected representation can be further input to the next deconvolution layer and finally output Represents the reconstructed feature matrix.

[0095] The decoder can use 4 deconvolution layers (from DeConv4 to DeConv1) in the decoding order. These 4 convolution layers can have 128 2×2×256 convolution kernels, 64 2×2×128 convolution kernels, 32 3×3×64 convolution kernels, and 3 3×3×64 convolution kernels, with strides of 2×2, 2×2, 2×2 and 1×1 respectively.

[0096] In the above embodiment, by taking different time steps, feature matrices representing different time scales can be obtained, the multi-scale feature matrices are connected into tensors and the spatial patterns of the feature matrices are encoded through an encoder, and then a decoder is used to combine the feature maps of different deconvolution and ConvLSTM layers. The deep features in high-dimensional, large-scale monitoring data can be used to identify server anomalies, effectively improving the anomaly detection performance.

[0097] In one embodiment, the historical monitoring data of the server can be used as training samples. These historical monitoring data may include the performance indicator data and audio monitoring data of the server in the past period of time. Before training, the data preprocessing method of the performance indicator data and audio monitoring data in the above embodiment can be referred to, so that the data format used for training is consistent with the data format of the model actually used to detect server anomalies. During training, an autoencoder structure can be used to process and learn features extracted from multimodal data sources. This learning method does not require a large amount of labeled data, and can automatically learn and extract features from unlabeled data, effectively reducing the reliance on manual labeling.

[0098] The training optimization objective function of the autoencoder model can be the reconstruction error of the model, which can be specifically expressed as:

[0099]

[0100] in, Exemplarily, a small batch stochastic gradient descent method and an Adam optimizer can be used to minimize the above training loss. After the training is terminated, the learned neural network parameters can be used to infer the reconstruction matrix of the validation and test data.

[0101] Figure 7 A schematic diagram of a server anomaly detection method provided in this application Figure 4 .like Figure 7 As shown, the difference between the time series feature and the reconstruction feature is calculated, and the abnormal state of the server is determined according to the difference, including:

[0102] Step S701, calculating the difference between the feature matrix and the reconstruction matrix to obtain a residual matrix.

[0103] For example, the multi-scale feature matrix M corresponding to time t (where p takes different values) t Inputting the trained autoencoder model can get the reconstruction matrix For the feature matrix M t and the reconstruction matrix The residual matrix R can be obtained by doing the difference t ,

[0104] Step S702, determining the abnormal probability of the server according to the element value of each element in the residual matrix.

[0105] For example, for any time t, the residual matrix R can be calculated t The exception state of each element of . For example, it can be specified that when R tIf an element in is greater than a given threshold, the element value is set to 1, otherwise it is set to 0. The cumulative value of each element value in the residual matrix can be mapped to the preset probability interval to obtain the abnormal probability. t The anomaly score Q t (The cumulative value of each element) can be expressed as:

[0106]

[0107] Among them, the residual matrix R can be expressed as t The value of the element in the i-th row and j-th column.

[0108] In some possible implementations, determining the abnormal probability of the server based on the value of each element in the residual matrix may also include: determining the number of elements in the residual matrix whose element values ​​are greater than a preset threshold, and determining the ratio of the number to the total number of elements in the residual matrix as the abnormal probability of the server.

[0109] The element values ​​of the residual matrix represent the changes in the correlation between two time series features in a specific time period. If the residual value is large, it means that the behavior of the corresponding time series feature is significantly different from the normal state, and there may be anomalies.

[0110] Figure 8 A schematic diagram of the structure of a server anomaly detection device provided in this application, such as Figure 8 As shown, the server anomaly detection device 80 provided in this embodiment includes:

[0111] The acquisition module 801 is used to acquire the monitoring data of the server;

[0112] An extraction module 802 is used to extract the time series characteristics of the monitoring data;

[0113] A reconstruction module 803 is used to process the time series features through an autoencoder model to obtain a reconstructed feature;

[0114] The abnormality determination module 804 is used to calculate the difference value between the time series feature and the reconstruction feature, and determine the abnormal state of the server according to the difference value.

[0115] In a possible implementation, the extraction module 802 is also used to: pre-process the performance indicator data and the audio monitoring data respectively to obtain a multi-dimensional performance feature vector and a multi-dimensional audio feature vector; concatenate and combine the performance feature vector and the audio feature vector to obtain a multimodal fusion feature vector; and establish a feature matrix based on the data dimension of the performance feature vector and the multimodal fusion feature vector, wherein the feature matrix represents the time series characteristics of the monitoring data.

[0116] In a possible implementation, the extraction module 802 is further used to: extract the eigenvalue of a preset time step for each dimension of the performance feature vector, and concatenate the eigenvalue with the multi-dimensional audio feature vector to obtain a multimodal fusion feature vector under this dimension.

[0117] In one possible implementation, the reconstruction module 803 is also used to: combine the feature matrices corresponding to multiple different time steps into a three-dimensional tensor; perform a convolution operation on the three-dimensional tensor through multiple convolution layers of the encoder to obtain output features of the encoder and determine the hidden state of the convolution layer; and perform a deconvolution operation on the output features in combination with the hidden state through the decoder to obtain a reconstructed matrix.

[0118] In a possible implementation, the abnormality determination module 804 is further used to: calculate the difference between the feature matrix and the reconstruction matrix to obtain a residual matrix; and determine the abnormality probability of the server according to the element value of each element in the residual matrix.

[0119] In a possible implementation, the abnormality determination module 804 is further used to: determine the number of elements in the residual matrix whose element values ​​are greater than a preset threshold, and determine the ratio of the number to the total number of elements in the residual matrix as the abnormality probability of the server.

[0120] In a possible implementation, the acquisition module 801 is further used to: set an audio sensor around the server; collect sound signals generated by the server during operation through the audio sensor to obtain audio monitoring data.

[0121] The server anomaly detection device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be described in detail here.

[0122] Fig. 9 This is a schematic diagram of the structure of the electronic device provided in this application. Fig. 9 As shown, the electronic device 90 provided in this embodiment includes: at least one processor 901 and a memory 902. Optionally, the device 90 further includes a communication component 903. The processor 901, the memory 902 and the communication component 903 are connected via a bus 904.

[0123] In a specific implementation process, at least one processor 901 executes the computer execution instructions stored in the memory 902, so that at least one processor 901 executes the above method.

[0124] The specific implementation process of the processor 901 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0125] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0126] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0127] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0128] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0129] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0130] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0131] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0132] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0133] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0134] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0135] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0136] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0137] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A server anomaly detection method, characterized in that: include: Get monitoring data of the server; Extracting time series features of the monitoring data; Processing the time series features through an autoencoder model to obtain reconstruction features; A difference value between the time series feature and the reconstruction feature is calculated, and an abnormal state of the server is determined according to the difference value.

2. The method according to claim 1, characterized in that The monitoring data includes performance indicator data and audio monitoring data, and the extracting of the time series features of the monitoring data includes: Preprocessing the performance indicator data and the audio monitoring data respectively to obtain a multi-dimensional performance feature vector and a multi-dimensional audio feature vector; Concatenating the performance feature vector and the audio feature vector to obtain a multimodal fusion feature vector; Based on the data dimension of the performance feature vector, a feature matrix is ​​established according to the multimodal fusion feature vector, and the feature matrix represents the time series characteristics of the monitoring data.

3. The method according to claim 2, characterized in that The step of concatenating and combining the performance feature vector and the audio feature vector to obtain a multimodal fusion feature vector includes: For each dimension of the performance feature vector, a feature value of a preset time step is extracted, and the feature value is concatenated with the multi-dimensional audio feature vector to obtain a multimodal fusion feature vector in the dimension.

4. The method according to claim 3, characterized in that: The autoencoder model includes an encoder and a decoder, the encoder includes a plurality of convolutional layers based on a long short-term memory network, and the processing of the temporal features by the autoencoder model includes: Combining the feature matrices corresponding to a plurality of different time steps into a three-dimensional tensor; Performing a convolution operation on the three-dimensional tensor through multiple convolutional layers of the encoder to obtain output features of the encoder and determine a hidden state of the convolutional layer; The decoder performs a deconvolution operation on the output feature in combination with the hidden state to obtain a reconstruction matrix.

5. The method according to claim 4, characterized in that The calculating a difference value between the time series feature and the reconstruction feature, and determining an abnormal state of the server according to the difference value, includes: Calculating the difference between the feature matrix and the reconstruction matrix to obtain a residual matrix; The abnormal probability of the server is determined according to the element value of each element in the residual matrix.

6. The method according to claim 5, characterized in that The determining the abnormal probability of the server according to the value of each element in the residual matrix includes: The number of elements in the residual matrix whose element values ​​are greater than a preset threshold is determined, and the ratio of the number to the total number of elements in the residual matrix is ​​determined as the abnormal probability of the server.

7. The method according to any one of claims 2 to 5, characterized in that: The audio monitoring data is obtained in the following way: placing audio sensors around the server; The audio sensor collects sound signals generated when the server is running to obtain audio monitoring data.

8. A server anomaly detection device, characterized in that: include: An acquisition module is used to obtain monitoring data of the server; An extraction module, used for extracting the time series characteristics of the monitoring data; A reconstruction module, used for processing the time series features through an autoencoder model to obtain a reconstructed feature; The abnormality determination module is used to calculate the difference value between the timing feature and the reconstruction feature, and determine the abnormal state of the server according to the difference value.

9. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

Images