Software operation anomaly detection method, system, medium, product and equipment

Abstract

The invention discloses a software operation anomaly detection method and system, a medium, a product and equipment. The method comprises the steps that multi-modal data generated by software to be detected in the operation period is acquired; performing feature extraction on data of each mode in the multi-mode data to obtain feature information corresponding to each mode; fusing the feature information corresponding to each mode through a self-attention mechanism to obtain a fused feature vector; using a supervised learning module and an unsupervised learning module contained in an anomaly detection model to perform anomaly detection based on the fused feature vector to obtain an anomaly detection result, thereby comprehensively considering the performance of the software in different modes during operation, comprehensively, quickly and accurately identifying the fault existing during the operation of the software, and improving the fault detection accuracy. And the accuracy and reliability of software operation anomaly detection are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, system, medium, product and device for detecting software operation anomalies. Background Art

[0002] In traditional software operation anomaly detection technology, single modal data generated during the software operation is usually collected, and the collected single modal data is analyzed to determine whether the software has any abnormalities during operation. For example, the matching rules corresponding to the modal data are directly used to automatically detect whether there are problems recorded in the matching rules during the software operation.

[0003] However, single-dimensional anomaly detection is difficult to fully reflect the problems existing in the software during operation, and its accuracy and reliability are low. Summary of the invention

[0004] In order to solve the above technical problems, the embodiments of the present application propose a software operation anomaly detection method, system, medium, product and equipment, which can quickly and accurately identify faults existing in software operation and improve the accuracy and reliability of software operation anomaly detection.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting software operation anomalies, comprising: Acquire multimodal data generated by the software to be tested during operation; Extracting features of each modality in the multimodal data to obtain feature information corresponding to each modality; Through the self-attention mechanism, the feature information corresponding to each modality is fused to obtain a fused feature vector; Using the supervised learning module and the unsupervised learning module included in the anomaly detection model, anomaly detection is performed based on the fused feature vector to obtain anomaly detection results.

[0006] Optionally, the data of each modality includes software log data, the feature information corresponding to each modality includes log data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Converting the time format in the software log data into a standard time format, performing structured processing on the converted software log data, performing word segmentation on the structured software log data to generate word segmentation text, and converting the word segmentation text into a word vector; The word vector is input into a long short-term memory network for context dependency analysis to obtain semantic information for characterizing the log data features.

[0007] Optionally, the data of each modality includes software performance indicator data, the feature information corresponding to each modality includes performance indicator data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Standardizing the software performance indicator data, and performing time series segmentation on the standardized software performance indicator data; The software performance indicator data segmented by time series is input into a convolutional neural network for feature extraction to obtain the performance indicator data features.

[0008] Optionally, the step of fusing the feature information corresponding to each modality through a self-attention mechanism to obtain a fused feature vector includes: Through the self-attention mechanism, joint modeling is performed according to the feature information corresponding to each modality to generate a feature weight corresponding to each feature information; Using a multimodal neural network, based on the feature weights, the feature information corresponding to the various modalities is fused to obtain the fused feature vector.

[0009] Optionally, using the supervised learning module and the unsupervised learning module included in the anomaly detection model to perform anomaly detection based on the fused feature vector to obtain anomaly detection results includes: Using a classifier constructed based on a supervised learning algorithm contained in the supervised learning module, performing anomaly detection according to the fused feature vector to obtain a first anomaly detection result; Using the unsupervised learning module, performing anomaly detection based on the fused feature vector to obtain a second anomaly detection result; The abnormality detection result is determined based on the first abnormality detection result and the second abnormality detection result.

[0010] Optionally, the using the unsupervised learning module to perform anomaly detection based on the fused feature vector to obtain a second anomaly detection result includes: The fused feature vector is input into the unsupervised learning module, so that the unsupervised learning module calculates the abnormality score according to the fused feature vector by the following formula: , for characterizing the second abnormality detection result; in, is the value of the i-th data point in the fused feature vector, is the feature representation of the i-th data point expected by the unsupervised learning module, and N is the number of feature dimensions of the fused feature vector.

[0011] In a second aspect, an embodiment of the present application provides a software operation anomaly detection system, comprising: A multimodal data acquisition unit, used to acquire multimodal data generated by the software to be tested during operation; A feature extraction unit, used to extract features from the data of each mode in the multimodal data respectively to obtain feature information corresponding to each mode; A feature fusion unit, used to fuse the feature information corresponding to each modality through a self-attention mechanism to obtain a fused feature vector; The anomaly detection unit is used to use the supervised learning module and the unsupervised learning module included in the anomaly detection model to perform anomaly detection based on the fused feature vector to obtain anomaly detection results.

[0012] Optionally, the data of each modality includes software log data, the feature information corresponding to each modality includes log data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Converting the time format in the software log data into a standard time format, performing structured processing on the converted software log data, performing word segmentation on the structured software log data to generate word segmentation text, and converting the word segmentation text into a word vector; The word vector is input into a long short-term memory network for context dependency analysis to obtain semantic information for characterizing the log data features.

[0013] Optionally, the data of each modality includes software performance indicator data, the feature information corresponding to each modality includes performance indicator data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Standardizing the software performance indicator data, and performing time series segmentation on the standardized software performance indicator data; The software performance indicator data segmented by time series is input into a convolutional neural network for feature extraction to obtain the performance indicator data features.

[0014] Optionally, the step of fusing the feature information corresponding to each modality through a self-attention mechanism to obtain a fused feature vector includes: Through the self-attention mechanism, joint modeling is performed according to the feature information corresponding to each modality to generate a feature weight corresponding to each feature information; Using a multimodal neural network, based on the feature weights, the feature information corresponding to the various modalities is fused to obtain the fused feature vector.

[0015] Optionally, using the supervised learning module and the unsupervised learning module included in the anomaly detection model to perform anomaly detection based on the fused feature vector to obtain anomaly detection results includes: Using a classifier constructed based on a supervised learning algorithm contained in the supervised learning module, performing anomaly detection according to the fused feature vector to obtain a first anomaly detection result; Using the unsupervised learning module, performing anomaly detection based on the fused feature vector to obtain a second anomaly detection result; The abnormality detection result is determined based on the first abnormality detection result and the second abnormality detection result.

[0016] Optionally, the using the unsupervised learning module to perform anomaly detection based on the fused feature vector to obtain a second anomaly detection result includes: The fused feature vector is input into the unsupervised learning module, so that the unsupervised learning module calculates the abnormality score according to the fused feature vector by the following formula: , for characterizing the second abnormality detection result; in, is the value of the i-th data point in the fused feature vector, is the feature representation of the i-th data point expected by the unsupervised learning module, and N is the number of feature dimensions of the fused feature vector.

[0017] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above-mentioned methods for detecting software operation anomalies are implemented.

[0018] In a fourth aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of any of the above-mentioned software operation anomaly detection methods.

[0019] In a fifth aspect, an embodiment of the present application provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the steps of any of the above-mentioned software operation abnormality detection methods when executing the computer program.

[0020] In summary, the embodiments of the present application have at least the following beneficial effects: By adopting the embodiment of the present application, multimodal data generated by the software to be detected during operation is obtained; feature extraction is performed on the data of each mode in the multimodal data respectively to obtain feature information corresponding to the each mode; the feature information corresponding to the each mode is fused through the self-attention mechanism to obtain a fused feature vector; the supervised learning module and the unsupervised learning module included in the anomaly detection model are used to perform anomaly detection based on the fused feature vector to obtain anomaly detection results, so that the performance of the software in different modes during operation can be comprehensively considered to comprehensively, quickly and accurately identify the faults existing in the software during operation, thereby improving the accuracy and reliability of software operation anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flowchart of a method for detecting software operation anomalies provided in an embodiment of the present application; Figure 2 is a schematic diagram of software operation anomaly detection provided by an embodiment of the present application; Figure 3 is a schematic diagram of software operation anomaly detection provided by an embodiment of the present application; Figure 4 It is a structural diagram of a software operation anomaly detection system provided in an embodiment of the present application; Figure 5 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0023] In the description of the present application, the terms "first", "second", "third", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, features defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the features. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more. In the description of the present application, the term "including" and its variations are open inclusions, i.e., "including but not limited to". The term "based on" means "at least partially based on". The term "according to" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments".

[0024] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0025] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meaning as those commonly understood by those skilled in the art. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0026] First, see Figure 1 , shows a flow chart of a method for detecting software operation anomalies provided in an embodiment of the present application, the method comprising steps S101-S104, which are specifically as follows: S101, obtaining multimodal data generated by the software to be tested during operation.

[0027] It should be noted that the software to be detected in this embodiment may be in the running stage, in which case the multimodal data is real-time multimodal data, but on the other hand, the software to be detected may not be in the running stage at the current time, in which case the multimodal data is historical multimodal data.

[0028] In an example, the data of each modality in the multimodal data may include at least one of the following: operating system log data, application log data, error log data, CPU (Central Processing Unit) indicator data, memory indicator data, disk I / O indicator data, and network traffic indicator data.

[0029] S102, performing feature extraction on the data of each modality in the multimodal data respectively to obtain feature information corresponding to each modality.

[0030] In one example, a general data feature extraction method may be used to extract features from data of each modality to obtain corresponding feature information.

[0031] S103, through the self-attention mechanism, the feature information corresponding to each modality is fused to obtain a fused feature vector.

[0032] S104, using the supervised learning module and the unsupervised learning module included in the anomaly detection model, performing anomaly detection based on the fused feature vector to obtain anomaly detection results.

[0033] In an optional implementation, the data of each modality includes software log data, the feature information corresponding to each modality includes log data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: The time format in the software log data is converted into a standard time format, the converted software log data is structured, the structured software log data is segmented to generate segmented text, and the segmented text is converted into a word vector.

[0034] The word vector is input into a long short-term memory network for context dependency analysis to obtain semantic information for characterizing the log data features.

[0035] In one example, the software log data may include at least one of the following: operating system log data, application log data, error log data, and database log data. In this embodiment, log data is an indispensable information record in system operation, which can reveal many abnormal phenomena, such as system errors, service unavailability, resource overload, etc. By collecting these log data, the detailed operation status inside the system can be captured, providing a key basis for subsequent abnormality detection.

[0036] In one example, for software log data, the ELK (Elasticsearch, Logstash, and Kibana) technology stack can be used to centrally collect, filter, format, and index log information from different sources (such as operating system logs, application logs, and error logs) into a database to form corresponding operating system log data, application log data, and error log data for subsequent analysis.

[0037] It is understandable that general log data is usually unstructured log data and usually contains redundant information, and the time scale and data structure are usually inconsistent, so the data needs to be preprocessed to ensure the accuracy and consistency of subsequent analysis. This embodiment can unify the software log data into a standard time format, ensure the structuring of the log information, and then perform word segmentation for further text analysis by processing the software log data.

[0038] In one example, see Figure 2 , the time format in the software log data can be converted to the standard time format by parsing the timestamp in the software log data.

[0039] In one example, the structuring process may be completed by extracting key information fields, event types, and / or message contents from the converted software log data to ensure the structuring of the log information.

[0040] In one example, the segmented text generated through the segmentation may include words or phrases.

[0041] In one example, see Figure 3 , Word2Vec technology can be used to convert the segmented text to map semantically similar words in each segmented text into a similar vector space, thereby converting the segmented text into a word vector to provide numerical input data for subsequent anomaly detection and analysis.

[0042] It is understandable that this embodiment uses LSTM (Long Short-Term Memory) to perform context dependency analysis on word vectors to capture the context dependency of text. Among them, LSTM can better process the sequence information of text data, convert the abnormal pattern indicated in the software log data into time features and semantic information, and then determine the log data features based on the time features and the semantic information. In this embodiment, the semantic structure and abnormal features of the software log data can be fully expressed, laying the foundation for subsequent feature fusion.

[0043] In one example, see Figure 3 LSTM can also be used to extract features from software performance indicator data segmented by time series to obtain time series features, and then the performance indicator data features extracted by convolutional neural network are corrected based on the time series features to serve as new performance indicator data features.

[0044] In an optional implementation, the data of each modality includes software performance indicator data, the feature information corresponding to each modality includes performance indicator data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Standardizing the software performance indicator data, and performing time series segmentation on the standardized software performance indicator data; The software performance indicator data segmented by time series is input into a convolutional neural network for feature extraction to obtain the performance indicator data features.

[0045] It should be noted that the software performance indicator data can be used to characterize the resource usage of the system / software to be tested during operation, thereby effectively reflecting the current load of the system and helping to detect potential performance bottlenecks and abnormal loads. For example, a long period of high CPU load may mean that a process has entered an infinite loop, while a memory leak may cause the memory usage rate to continue to rise. Figure 2 For software performance indicator data (such as CPU usage, memory consumption, disk I / O, etc.), standardization processing and time series segmentation can be used to ensure that each performance indicator has the same dimension, and then a convolutional neural network is used to extract the time series features of the performance data. The convolutional neural network can capture the local change pattern of the software performance indicator data and identify possible abnormal fluctuations, thereby extracting representative time series features for characterizing the performance indicator data characteristics.

[0046] In an example, the software performance indicator data may include at least one of the following: CPU (Central Processing Unit) indicator data, memory indicator data, disk I / O indicator data, and network traffic indicator data.

[0047] In one example, the software performance indicator data is standardized, which may include: performing a minimum-maximum scaling process on the data of each indicator type in the software performance indicator data (e.g., CPU indicator data, memory indicator data, disk I / O indicator data, and / or network traffic indicator data), thereby converting the data of each indicator type to [0, 1] accordingly. The minimum-maximum scaling process may be determined by the following formula: ,in, is the data to be converted under an indicator type, is the converted data under an indicator type, , They are respectively the maximum data value and the minimum data value under an indicator type. In this embodiment, since different types of performance data may have different dimensions and ranges, for example, CPU usage is usually a percentage, while memory usage may be in MB or GB, in order to process these data uniformly, it is necessary to standardize the performance indicators, so that different types of performance data such as CPU usage or memory usage can be converted to between [0,1], so that the dimension of the performance data no longer affects the subsequent analysis process, further improving data consistency, reducing the potential impact of different dimensions and ranges on model performance, and also ensuring the fairness and stability of the algorithm when processing data.

[0048] In one example, since different types of data (such as software log data and software performance indicator data) may have time deviations when they are collected, the data can be aligned on the time axis. For example, by unifying the timestamps of different types of data, data from different data sources can be synchronized on the same time dimension to ensure that the various types of data can accurately correspond to each other during subsequent analysis, thereby achieving the effect of data synchronization.

[0049] In an optional implementation, the self-attention mechanism is used to fuse the feature information corresponding to each modality to obtain a fused feature vector, including: Through the self-attention mechanism, joint modeling is performed according to the feature information corresponding to each modality to generate a feature weight corresponding to each feature information; Using a multimodal neural network, based on the feature weights, the feature information corresponding to the various modalities is fused to obtain the fused feature vector.

[0050] In some cases, after obtaining the feature information corresponding to each modality (for example, log data features and performance indicator data features, for ease of description, this example will be used as an example for subsequent explanations), the fusion stage is entered. Here, this embodiment adopts a self-attention mechanism to jointly model the feature information corresponding to each modality.

[0051] In one example, multimodal fused feature data (i.e., fused feature vectors) can be used for training and detection. The pre-collected data includes log data features and performance indicator data features, where the log data features are converted into 100-dimensional embedding vectors after text processing, and the performance indicator data includes four key indicators, namely, CPU, memory, disk I / O, and network traffic. The data format of the final fused feature vector is a matrix of n*104, where n is the number of samples in the time window, the first 100 columns are log data features, and the last 4 columns are performance indicator data features corresponding to the four key indicators of CPU, memory, disk I / O, and network traffic. In this way, the fused feature vector combines time series and semantic information, providing the model with rich input dimensions to enhance the accuracy of anomaly detection. In addition, the self-attention mechanism can assign dynamic weights to each feature to identify potential correlations in multimodal data. For example, when a certain type of performance indicator anomaly occurs in the system, related error information may also appear in the log text. The self-attention mechanism can automatically focus on such associated feature pairs consisting of performance indicator data features and corresponding log data features through weight learning. Specifically, by incorporating the performance indicator data features and the corresponding log data features into a unified vector space and calculating the similarity and correlation between the two, the self-attention mechanism can amplify the temporal and semantic correlation between the two and improve the accuracy of anomaly detection.

[0052] In one example, the fused feature vector can also be input into the fully connected layer of the multimodal neural network for classification to identify whether there is abnormal behavior, thereby generating a third abnormal detection result, and further based on the first abnormal detection result and its corresponding first weight, the second abnormal detection result and its corresponding second weight, and the third abnormal detection result and its corresponding third weight, a weighted calculation is performed to determine the final abnormal detection result. This multimodal fusion method can effectively combine the advantages of log text and performance indicators to achieve a comprehensive analysis of potential abnormalities in the system, thereby significantly improving the accuracy and real-time performance of detection, and is particularly suitable for complex software operating environments.

[0053] In one example, a multimodal neural network is used to fuse the feature information corresponding to each modality based on the feature weight to obtain the fused feature vector, which can be expressed by the following formula: in, , They represent the log data features (the feature information corresponding to the data of the first type of modality) and the performance indicator data features (the feature information corresponding to the data of the second type of modality) respectively. , They are the weights corresponding to the log data features (the feature information corresponding to the data of the first type of modality) and the performance indicator data features (the feature information corresponding to the data of the second type of modality).

[0054] It is understandable that traditional anomaly detection methods have the problem of high rates of missed reports or false alarms. This embodiment comprehensively analyzes system state changes from multiple data sources by fusing multimodal data, such as system logs, performance indicators, network traffic, etc. Multimodal fusion enables the system to capture clues of abnormal behavior from different dimensions, significantly improving the accuracy and reliability of detection, and reducing false alarms and missed reports. And by real-time collection and analysis of multimodal data, this embodiment can monitor and detect anomalies in real time during system operation. Once an anomaly is identified, the system immediately triggers an alarm message, prompting the operation and maintenance personnel to take action. This real-time detection and rapid response mechanism can effectively shorten the time from fault detection to processing, help users quickly locate and solve problems, and avoid the system being in an abnormal state for a long time.

[0055] In an optional implementation, the use of the supervised learning module and the unsupervised learning module included in the anomaly detection model to perform anomaly detection based on the fused feature vector to obtain anomaly detection results includes: Using a classifier constructed based on a supervised learning algorithm contained in the supervised learning module, performing anomaly detection according to the fused feature vector to obtain a first anomaly detection result; Using the unsupervised learning module, performing anomaly detection based on the fused feature vector to obtain a second anomaly detection result; The abnormality detection result is determined based on the first abnormality detection result and the second abnormality detection result.

[0056] In one example, the fused feature vector can also be input into the fully connected layer of the multimodal neural network for classification to identify whether abnormal behavior exists, thereby generating a third abnormality detection result, and further based on the first abnormality detection result and its corresponding first weight, the second abnormality detection result and its corresponding second weight, and / or the third abnormality detection result and its corresponding third weight, a weighted calculation is performed to determine the final abnormality detection result.

[0057] In one example, when there is labeled data, a classifier can be built through supervised learning algorithms (such as random forests, SVM (Support Vector Machine), etc.) to identify common abnormal patterns. For example, the model can be trained using historical abnormal data to identify certain known performance bottlenecks or system failures. The trained classifier can detect and alarm in real time while the system is running.

[0058] In one example, when there is no labeled data or less abnormal data, unsupervised learning algorithms (such as isolation forests, autoencoders, etc.) are used for anomaly detection. Unsupervised learning mainly relies on the distribution of normal data to detect data points that deviate greatly from normal behavior. For example, isolation forests can identify data that is easily isolated (i.e., abnormal data) by randomly dividing data points.

[0059] In an optional implementation, the using the unsupervised learning module to perform anomaly detection based on the fused feature vector to obtain a second anomaly detection result includes: The fused feature vector is input into the unsupervised learning module, so that the unsupervised learning module calculates the abnormality score according to the fused feature vector by the following formula: , for characterizing the second abnormality detection result; in, is the value of the i-th data point in the fused feature vector, is the feature representation of the i-th data point expected by the unsupervised learning module, and N is the number of feature dimensions of the fused feature vector.

[0060] In some cases, the anomaly score may be compared with a set threshold to obtain a second anomaly detection result.

[0061] In combination with any one or more of the above embodiments, the present application has the following advantages.

[0062] 1. Strong adaptability and wide application range.

[0063] (1) It is applicable to a variety of complex IT environments, especially showing excellent adaptability in cloud computing, distributed systems and virtualized environments.

[0064] (2) Modern systems are complex and multi-dimensional, and monitoring methods using a single data source are difficult to cope with. This application uses multimodal data fusion to apply to operation and maintenance management in complex system architectures.

[0065] 2. Good scalability.

[0066] (1) The system can easily integrate new data sources or anomaly detection modules and adapt to new business scenarios and needs by adjusting model parameters.

[0067] (2) This application has good scalability and flexibility, and can be continuously optimized and expanded to meet the anomaly detection needs in different scenarios.

[0068] Specifically, the technical key point of this application is to achieve efficient anomaly detection through the fusion of multimodal data and the use of multimodal deep learning models. The system overcomes the limitations of existing single data source analysis by integrating multiple data sources such as log data and performance indicators. The use of deep learning models to extract and fuse features of these different modal data can more comprehensively capture potential anomalies in the system. This fusion and detection technology can also significantly improve the accuracy of detection through a multi-layer neural network combined with supervised learning and unsupervised learning methods. This application uses intelligent data preprocessing and synchronization mechanisms to ensure the consistency of different modal data within the same time range, effectively avoiding errors caused by time asynchrony. The design of the real-time monitoring and alarm system further enhances the system's responsiveness, can provide early warnings when anomalies occur, and reduce the possibility of fault expansion. The system's scalability design enables it to easily integrate new data sources or detection modules to adapt to different application scenarios.

[0069] On the second aspect, accordingly, an embodiment of the present application also provides a software operation anomaly detection system, which can implement all processes of the software operation anomaly detection method provided in the above embodiment.

[0070] See also Figure 4 , shows a schematic diagram of the structure of a software operation anomaly detection system provided in an embodiment of the present application, the software operation anomaly detection system comprising: The multimodal data acquisition unit 401 is used to acquire the multimodal data generated by the software to be tested during operation; A feature extraction unit 402 is used to extract features from data of each modality in the multimodal data to obtain feature information corresponding to each modality; A feature fusion unit 403 is used to fuse the feature information corresponding to each modality through a self-attention mechanism to obtain a fused feature vector; The anomaly detection unit 404 is used to use the supervised learning module and the unsupervised learning module included in the anomaly detection model to perform anomaly detection based on the fused feature vector to obtain anomaly detection results.

[0071] In an optional implementation, the data of each modality includes software log data, the feature information corresponding to each modality includes log data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Converting the time format in the software log data into a standard time format, performing structured processing on the converted software log data, performing word segmentation on the structured software log data to generate word segmentation text, and converting the word segmentation text into a word vector; The word vector is input into a long short-term memory network for context dependency analysis to obtain semantic information for characterizing the log data features.

[0072] In an optional implementation, the data of each modality includes software performance indicator data, the feature information corresponding to each modality includes performance indicator data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Standardizing the software performance indicator data, and performing time series segmentation on the standardized software performance indicator data; The software performance indicator data segmented by time series is input into a convolutional neural network for feature extraction to obtain the performance indicator data features.

[0073] In an optional implementation, the self-attention mechanism is used to fuse the feature information corresponding to each modality to obtain a fused feature vector, including: Through the self-attention mechanism, joint modeling is performed according to the feature information corresponding to each modality to generate a feature weight corresponding to each feature information; Using a multimodal neural network, based on the feature weights, the feature information corresponding to the various modalities is fused to obtain the fused feature vector.

[0074] In an optional implementation, the use of the supervised learning module and the unsupervised learning module included in the anomaly detection model to perform anomaly detection based on the fused feature vector to obtain anomaly detection results includes: Using a classifier constructed based on a supervised learning algorithm contained in the supervised learning module, performing anomaly detection according to the fused feature vector to obtain a first anomaly detection result; Using the unsupervised learning module, performing anomaly detection based on the fused feature vector to obtain a second anomaly detection result; The abnormality detection result is determined based on the first abnormality detection result and the second abnormality detection result.

[0075] In an optional implementation, the using the unsupervised learning module to perform anomaly detection based on the fused feature vector to obtain a second anomaly detection result includes: The fused feature vector is input into the unsupervised learning module, so that the unsupervised learning module calculates the abnormality score according to the fused feature vector by the following formula: , for characterizing the second abnormality detection result; in, is the value of the i-th data point in the fused feature vector, is the feature representation of the i-th data point expected by the unsupervised learning module, and N is the number of feature dimensions of the fused feature vector.

[0076] In a third aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above-mentioned methods for detecting software operation anomalies are implemented.

[0077] In a fourth aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of any of the above-mentioned software operation anomaly detection methods.

[0078] In a fifth aspect, an embodiment of the present application provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the steps of any of the above-mentioned software operation abnormality detection methods when executing the computer program.

[0079] See also Figure 5The computer device of this embodiment includes: a processor 501, a memory 502, and a computer program stored in the memory 502 and executable on the processor 501, such as a software operation anomaly detection program. When the processor 501 executes the computer program, the steps in the above-mentioned software operation anomaly detection method embodiments are implemented, such as Figure 1 Steps S101-S104 are shown.

[0080] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 502 and executed by the processor 501 to complete the present application. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the computer device.

[0081] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may include, but not limited to, a processor 501 and a memory 502. Those skilled in the art will appreciate that the schematic diagram is merely an example of a computer device and does not constitute a limitation on the computer device. The computer device may include more or fewer components than shown in the diagram, or may combine certain components, or different components. For example, the computer device may also include input and output devices, network access devices, buses, etc.

[0082] The processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor 501 may also be any conventional processor, etc. The processor 501 is the control center of the computer device, and uses various interfaces and lines to connect various parts of the entire computer device.

[0083] The memory 502 can be used to store the computer program and / or module. The processor 501 implements various functions of the computer device by running or executing the computer program and / or module stored in the memory 502 and calling the data stored in the memory 502. The memory 502 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 502 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0084] Wherein, if the module / unit integrated in the computer device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor 501. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0085] In summary, the embodiments of the present application have at least the following beneficial effects: By adopting the embodiment of the present application, multimodal data generated by the software to be detected during operation is obtained; feature extraction is performed on the data of each mode in the multimodal data respectively to obtain feature information corresponding to the each mode; the feature information corresponding to the each mode is fused through the self-attention mechanism to obtain a fused feature vector; the supervised learning module and the unsupervised learning module included in the anomaly detection model are used to perform anomaly detection based on the fused feature vector to obtain anomaly detection results, so that the performance of the software in different modes during operation can be comprehensively considered to comprehensively, quickly and accurately identify the faults existing in the software during operation, thereby improving the accuracy and reliability of software operation anomaly detection.

[0086] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by means of software plus the necessary hardware platform, and of course it can also be implemented entirely by hardware. Based on such an understanding, all or part of the contribution of the technical solution of the present application to the background technology can be embodied in the form of a software product, and the computer software product can be stored in a storage medium, such as ROM (Read-Only Memory) / RAM (Random Access Memory), a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0087] The above is a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications are also considered to be within the scope of protection of the present application.

Claims

1. A method for detecting software operation anomalies, characterized in that: include: Acquire multimodal data generated by the software to be tested during operation; Extracting features of each modality in the multimodal data to obtain feature information corresponding to each modality; Through the self-attention mechanism, the feature information corresponding to each modality is fused to obtain a fused feature vector; Using the supervised learning module and the unsupervised learning module included in the anomaly detection model, anomaly detection is performed based on the fused feature vector to obtain anomaly detection results.

2. The software operation anomaly detection method according to claim 1, characterized in that: The data of each modality includes software log data, the feature information corresponding to each modality includes log data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Converting the time format in the software log data into a standard time format, performing structured processing on the converted software log data, performing word segmentation on the structured software log data to generate word segmentation text, and converting the word segmentation text into a word vector; The word vector is input into a long short-term memory network for context dependency analysis to obtain semantic information for characterizing the log data features.

3. The software operation abnormality detection method according to claim 1, characterized in that: The data of each modality includes software performance indicator data, the feature information corresponding to each modality includes performance indicator data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Standardizing the software performance indicator data, and performing time series segmentation on the standardized software performance indicator data; The software performance indicator data segmented by time series is input into a convolutional neural network for feature extraction to obtain the performance indicator data features.

4. The software operation anomaly detection method according to claim 1, characterized in that: The self-attention mechanism is used to fuse the feature information corresponding to each modality to obtain a fused feature vector, including: Through the self-attention mechanism, joint modeling is performed according to the feature information corresponding to each modality to generate a feature weight corresponding to each feature information; Using a multimodal neural network, based on the feature weights, the feature information corresponding to the various modalities is fused to obtain the fused feature vector.

5. The software operation anomaly detection method according to claim 1, characterized in that: The supervised learning module and the unsupervised learning module included in the anomaly detection model are used to perform anomaly detection based on the fused feature vector to obtain anomaly detection results, including: Using a classifier constructed based on a supervised learning algorithm contained in the supervised learning module, performing anomaly detection according to the fused feature vector to obtain a first anomaly detection result; Using the unsupervised learning module, performing anomaly detection based on the fused feature vector to obtain a second anomaly detection result; The abnormality detection result is determined based on the first abnormality detection result and the second abnormality detection result.

6. The software operation abnormality detection method according to claim 5, characterized in that: The using the unsupervised learning module to perform anomaly detection based on the fused feature vector to obtain a second anomaly detection result includes: The fused feature vector is input into the unsupervised learning module, so that the unsupervised learning module calculates the abnormality score according to the fused feature vector by the following formula: , for characterizing the second abnormality detection result; in, is the value of the i-th data point in the fused feature vector, is the feature representation of the i-th data point expected by the unsupervised learning module, and N is the number of feature dimensions of the fused feature vector.

7. A software operation anomaly detection system, characterized in that: include: A multimodal data acquisition unit, used to acquire multimodal data generated by the software to be tested during operation; A feature extraction unit, used to extract features from the data of each mode in the multimodal data respectively to obtain feature information corresponding to each mode; A feature fusion unit, used to fuse the feature information corresponding to each modality through a self-attention mechanism to obtain a fused feature vector; The anomaly detection unit is used to use the supervised learning module and the unsupervised learning module included in the anomaly detection model to perform anomaly detection based on the fused feature vector to obtain anomaly detection results.

8. The software operation anomaly detection system according to claim 7, characterized in that: The data of each modality includes software log data, the feature information corresponding to each modality includes log data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Converting the time format in the software log data into a standard time format, performing structured processing on the converted software log data, performing word segmentation on the structured software log data to generate word segmentation text, and converting the word segmentation text into a word vector; The word vector is input into a long short-term memory network for context dependency analysis to obtain semantic information for characterizing the log data features.

9. The software operation anomaly detection system according to claim 7, characterized in that: The data of each modality includes software performance indicator data, the feature information corresponding to each modality includes performance indicator data features, and the feature extraction of the data of each modality in the multimodal data is performed to obtain the feature information corresponding to each modality, including: Standardizing the software performance indicator data, and performing time series segmentation on the standardized software performance indicator data; The software performance indicator data segmented by time series is input into a convolutional neural network for feature extraction to obtain the performance indicator data features.

10. The software operation anomaly detection system according to claim 7, characterized in that: The self-attention mechanism is used to fuse the feature information corresponding to each modality to obtain a fused feature vector, including: Through the self-attention mechanism, joint modeling is performed according to the feature information corresponding to each modality to generate a feature weight corresponding to each feature information; Using a multimodal neural network, based on the feature weights, the feature information corresponding to the various modalities is fused to obtain the fused feature vector.

11. The software operation anomaly detection system according to claim 7, characterized in that: The supervised learning module and the unsupervised learning module included in the anomaly detection model are used to perform anomaly detection based on the fused feature vector to obtain anomaly detection results, including: Using a classifier constructed based on a supervised learning algorithm contained in the supervised learning module, performing anomaly detection according to the fused feature vector to obtain a first anomaly detection result; Using the unsupervised learning module, performing anomaly detection based on the fused feature vector to obtain a second anomaly detection result; The abnormality detection result is determined based on the first abnormality detection result and the second abnormality detection result.

12. The software operation anomaly detection system according to claim 11, characterized in that: The using the unsupervised learning module to perform anomaly detection based on the fused feature vector to obtain a second anomaly detection result includes: The fused feature vector is input into the unsupervised learning module, so that the unsupervised learning module calculates the abnormality score according to the fused feature vector by the following formula: , for characterizing the second abnormality detection result; in, is the value of the i-th data point in the fused feature vector, is the feature representation of the i-th data point expected by the unsupervised learning module, and N is the number of feature dimensions of the fused feature vector.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for detecting software operation anomalies according to any one of claims 1 to 6 is implemented.

14. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the software operation abnormality detection method according to any one of claims 1 to 6 is implemented.

15. A computer device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the software operation abnormality detection method according to any one of claims 1 to 6 when executing the computer program.

Images