Abnormality monitoring method and device, equipment and storage medium

Abstract

The invention relates to an exception monitoring method and device, equipment and a storage medium. The method comprises the following steps: acquiring monitoring data of a plurality of cloud servers in response to an exception monitoring request for the plurality of cloud servers in a target area; processing the monitoring data of each cloud server by adopting an alarm type identification model to obtain an alarm type of each cloud server; the alarm type identification model is obtained by training a two-dimensional image formed by a plurality of historical monitoring data in advance; the two-dimensional image comprises time domain feature information and amplitude information of a plurality of historical monitoring data; the plurality of historical monitoring data are monitoring data of a plurality of candidate cloud servers acquired based on a plurality of different time scales; and outputting an exception monitoring result of each cloud server based on the alarm type of each cloud server. By adopting the method, the accuracy of a monitoring result can be improved when abnormity monitoring is carried out on the cloud computing platform.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an abnormality monitoring method, device, equipment and storage medium. Background Art

[0002] Due to its advantages such as ease of use, rapid deployment, strong stability, high security and low cost, a large number of software are deployed on cloud computing platforms.

[0003] In most cases, cloud computing needs to provide users with uninterrupted cloud services. Cloud computing vendors need to promptly handle problems such as abnormal power outages, hardware equipment failures, human errors, and insufficient resource margins. Therefore, it is necessary to monitor the cloud computing platform for abnormalities, detect problems in a timely manner, and set up reliable abnormal alarm functions.

[0004] However, the abnormal monitoring method in the related art has a technical problem of low accuracy of monitoring results. Summary of the invention

[0005] Based on this, it is necessary to provide an abnormality monitoring method, device, equipment and storage medium to address the above technical problems, which can improve the accuracy of monitoring results when performing abnormality monitoring on a cloud computing platform.

[0006] In a first aspect, an embodiment of the present application provides an abnormality monitoring method, comprising:

[0007] In response to an abnormality monitoring request for multiple cloud servers in a target area, obtaining monitoring data of the multiple cloud servers;

[0008] The monitoring data of each cloud server is processed by an alarm type recognition model to obtain the alarm type of each cloud server; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales;

[0009] Based on the alarm type of each cloud server, output the abnormal monitoring results of each cloud server.

[0010] In one embodiment, the method further comprises:

[0011] Determine, according to the plurality of historical monitoring data, a Gram matrix corresponding to each of the historical monitoring data;

[0012] A two-dimensional image is generated according to each Gram matrix and the amplitude information of the plurality of historical monitoring data.

[0013] In one embodiment, a two-dimensional image is generated according to each Gram matrix and amplitude information of a plurality of historical monitoring data, including:

[0014] Map each amplitude information into a preset interval to obtain the amplitude information after interval mapping;

[0015] Get the sub-diagonal data of each Gram matrix;

[0016] A two-dimensional image is generated based on the amplitude information after interval mapping and the diagonal data.

[0017] In one embodiment, the method further comprises:

[0018] Based on a plurality of preset time intervals, the status of a plurality of candidate cloud servers is monitored to obtain status monitoring data of each candidate cloud server at each time interval;

[0019] The status monitoring data of each candidate cloud server at each time interval is determined as a plurality of historical monitoring data.

[0020] In one embodiment, the plurality of historical monitoring data includes monitoring data of a plurality of monitoring types; the two-dimensional images include a plurality of two-dimensional images corresponding to each monitoring type; and the training process of the alarm type recognition model includes:

[0021] Obtaining warning mode information of each two-dimensional image;

[0022] According to each two-dimensional image and the alarm mode information of each two-dimensional image, a preset initial model is trained to obtain an alarm type recognition model.

[0023] In one embodiment, a preset initial model is trained according to each two-dimensional image and the alarm mode information of each two-dimensional image to obtain an alarm type recognition model, including:

[0024] Input each two-dimensional image into the initial model to obtain the alarm aggregation prediction information and alarm mode prediction information output by the initial model;

[0025] Determine the predicted loss value of the initial model based on the alarm aggregation prediction information, the alarm mode prediction information and the information of each alarm mode;

[0026] Based on the predicted loss value, the model parameters of the initial model are adjusted until the training is completed to obtain an alarm type recognition model.

[0027] In one embodiment, based on the alarm type of each cloud server, the abnormal monitoring result of each cloud server is output, including:

[0028] Obtain alarm exception data and alarm generation time of each cloud server;

[0029] The alarm type of each cloud server, the alarm abnormal data of each cloud server and the alarm generation time are determined as the abnormal monitoring result;

[0030] The abnormal monitoring results are displayed through the preset alarm display method.

[0031] In a second aspect, the embodiment of the present application further provides an abnormality monitoring device, including:

[0032] A data acquisition module, configured to acquire monitoring data of a plurality of cloud servers in a target area in response to an abnormality monitoring request for the plurality of cloud servers;

[0033] The data processing module is used to process the monitoring data of each cloud server using an alarm type recognition model to obtain the alarm type of each cloud server; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales;

[0034] The result output module is used to output the abnormal monitoring results of each cloud server based on the alarm type of each cloud server.

[0035] In a third aspect, an embodiment of the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method in any one of the embodiments of the first aspect above are implemented.

[0036] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in any one of the embodiments of the first aspect above.

[0037] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the method in any one of the embodiments of the first aspect above.

[0038] The abnormal monitoring method, apparatus, device and storage medium provided in the embodiments of the present application respond to abnormal monitoring requests for multiple cloud servers in a target area, obtain monitoring data of multiple cloud servers, and then use an alarm type recognition model to process the monitoring data of each cloud server to obtain the alarm type of each cloud server, and then output the abnormal monitoring results of each cloud server based on the alarm type of each cloud server, wherein the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data, the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data, and the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales. In this method, a two-dimensional image composed of multiple historical monitoring data is used for model training to obtain an alarm type recognition model. The two-dimensional image includes not only the time domain feature information of the monitoring data, but also the amplitude information of the monitoring data, so that the two-dimensional image corresponding to the monitoring data has richer feature information, so that the alarm type recognition model trained based on the two-dimensional image has stronger aggregation and recognition capabilities. In this way, the alarm types of multiple cloud servers output by the alarm type recognition model will also be more accurate, thereby improving the abnormal monitoring results of the cloud service. At the same time, the multiple historical monitoring data when training the model are multi-time scales, which effectively avoids the problem of insufficient feature information and low accuracy caused by a single time scale, further improves the recognition accuracy of the alarm type recognition model, and thus improves the accuracy of the abnormal monitoring results. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A diagram of an application environment of an abnormality monitoring method in an embodiment;

[0041] Figure 2 A schematic diagram of a flow chart of an abnormality monitoring method in one embodiment;

[0042] Figure 3 A schematic diagram of a process for obtaining multiple historical monitoring data in one embodiment;

[0043] Figure 4 A schematic diagram of a process for generating a two-dimensional image in one embodiment;

[0044] Figure 5 A schematic diagram of a process for generating a two-dimensional image in another embodiment;

[0045] Figure 6 A schematic diagram of a process for training an alarm type recognition model in one embodiment;

[0046] Figure 7 A schematic diagram of a process for determining an alarm type identification model in an embodiment;

[0047] Figure 8 A schematic diagram of a process for outputting abnormal monitoring results in one embodiment;

[0048] Fig. 9 A flowchart of an abnormality monitoring method in another embodiment;

[0049] Fig.10 A schematic diagram of a framework for monitoring alarm aggregation and pattern recognition in one embodiment;

[0050] Fig.11 is a schematic diagram of the structure of an abnormality monitoring device in one embodiment;

[0051] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] The technical background of the embodiments of the present application is first described below.

[0054] Cloud computing has become a popular business model worldwide due to its advantages such as ease of use, rapid deployment, strong stability, high security and low cost. Cloud computing users purchase the required resources from cloud computing vendors according to their own needs. In most cases, cloud computing needs to provide users with cloud services uninterruptedly, and cloud computing vendors need to promptly deal with problems such as abnormal power outages, hardware equipment failures, human error operations and insufficient resource margins. Therefore, it is necessary to set up reliable abnormal alarm functions for all facilities that may fail, and classify alarm levels according to different problems. In the field of cloud computing, monitoring data is usually the usage data and usage of CPU, memory, hard disk and network bandwidth, which are all one-dimensional time series data. The monitored one-dimensional time series data is plotted into a curve through a drawing method and displayed on a web page for monitoring personnel to view. Due to the increasing number of various clouds, and the large amount of data, complexity and invalid repeated alarms of various services and facilities, a lot of energy of cloud computing operation and maintenance personnel is involved, and it may also cause the alarm problems that need to be solved to be submerged in a large number of invalid alarms. Therefore, cloud computing vendors have been actively researching the issue of alarm information processing to effectively reduce the burden on operation and maintenance personnel and reduce their own operating costs.

[0055] For a large amount of alarm information, effective methods are needed to aggregate the alarm information. In the related art, most of the alarm information aggregation methods are directly aggregated for one-dimensional time series alarm data, such as the time window aggregation method, which merges similar or repeated alarms by setting a fixed time interval. There are also machine learning methods that obtain a rule feature by training the existing time series data, and aggregate alarms according to the rule feature. There are also some studies that convert one-dimensional alarm data into two-dimensional images for aggregation. However, the existing data alarm aggregation algorithms generally have the following problems: (1) The algorithm is complex, occupies too many computing resources, and has a slow calculation speed. The alarm aggregation algorithm for one-dimensional data is usually based on complex mathematical models and machine learning methods. In order to make the alarm aggregation algorithm more accurate, more computing resources need to be reserved for the monitoring components, and the resources used for business virtual machines are reduced, resulting in a low overall resource utilization rate of the project. In addition, the alarm situation needs to be transmitted to the operation and maintenance personnel in a timely manner. The slow calculation speed caused by the complexity of the model will delay the judgment and processing of the fault. (2) The visualization level is low, the operation and maintenance personnel have poor perception of the situation, and the processing efficiency is low. Many monitoring systems only display single one-dimensional data to operation and maintenance personnel through drawing tools. The monitoring display interface draws in real time, consumes too many computing resources, has a limited display time, and is prone to freezes. It is difficult for operation and maintenance personnel to intuitively see the monitoring situation of more time situations, and cannot timely, effectively and intuitively obtain the monitoring situation before and after the alarm occurs. (3) The feature extraction capability of data is insufficient, and the processed data loses some feature information of the original data. At present, many algorithm models use the method of calculating deviation after reconstruction to judge whether the monitoring data is abnormal. The time domain information of the original data will be lost during reconstruction, resulting in a decrease in the accuracy of the output results, misjudgment and missed alarms, and it is impossible to accurately judge whether the monitoring data is abnormal. (4) The alarm aggregation capability is insufficient. Existing alarm aggregation methods include alarm aggregation through command lines, arranging multiple monitoring units to calculate the similarity aggregation of alarm events, etc. These methods have problems such as low aggregation efficiency, complex system, and large resource consumption. At present, cloud platforms need to monitor more and more data in real time, and these methods are not suitable for monitoring alarm aggregation scenarios with large amounts of data.

[0056] Based on this, the embodiment of the present application provides an abnormal monitoring method, which uses a two-dimensional image composed of multiple historical monitoring data to perform model training to obtain an alarm type recognition model. The two-dimensional image includes not only the time domain feature information of the monitoring data, but also the amplitude information of the monitoring data, so that the two-dimensional image corresponding to the monitoring data has richer feature information, so that the alarm type recognition model trained based on the two-dimensional image has stronger aggregation and recognition capabilities. In this way, the alarm types of multiple cloud servers output by the alarm type recognition model will also be more accurate, thereby improving the abnormal monitoring results of the cloud service. At the same time, the multiple historical monitoring data when training the model are multi-time scales, which effectively avoids the problem of insufficient feature information and low accuracy caused by a single time scale, further improves the recognition accuracy of the alarm type recognition model, and thus improves the accuracy of the abnormal monitoring results.

[0057] It should be noted that the beneficial effects brought about by the embodiments of the present application or the technical problems solved are not limited to this one, but may also include other implicit or related problems. For details, please refer to the description of the following embodiments.

[0058] The following describes the application environment of the abnormality monitoring method provided in the embodiment of the present application. The abnormality monitoring method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Optionally, when the server 104 receives a request for abnormal monitoring of multiple cloud servers, it uses an alarm type recognition model to process the monitoring data of multiple cloud servers, obtains the alarm type of each cloud server, and outputs the abnormal monitoring of the cloud server according to the alarm type. The terminal 102 can display the abnormal monitoring results of each cloud server. Among them, the terminal 102 can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0059] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0060] In an exemplary embodiment, Figure 2 As shown, an abnormal monitoring method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate, including the following steps 201 to 203. Among them:

[0061] S201, in response to an abnormality monitoring request for multiple cloud servers in a target area, obtaining monitoring data of the multiple cloud servers.

[0062] Among them, the abnormal monitoring request for multiple cloud servers refers to the request triggered when the multiple cloud servers in the target area need to be monitored for abnormalities in the server's abnormal monitoring application. Naturally, after receiving the abnormal monitoring request, the server needs to perform abnormal monitoring on multiple cloud servers in the target area and obtain the abnormal monitoring results of each cloud server. Exemplarily, the request is triggered by the user through the interface in the abnormal monitoring application; wherein, the method includes but is not limited to external input device clicks, voice control, touch screen triggering, etc., and the embodiment of the present application does not limit the triggering method.

[0063] The monitoring data of multiple cloud servers includes the usage data and usage of the central processing unit (CPU), memory, hard disk, and network bandwidth.

[0064] In one possible implementation, the monitoring data of multiple cloud servers can be obtained from an abnormal monitoring request. For example, when a user triggers an abnormal monitoring request for multiple cloud servers in a target area, the data of the multiple cloud servers currently being monitored are also sent to the server at the same time, and the server can directly obtain the monitoring data of the multiple cloud servers from the abnormal monitoring request of the multiple servers.

[0065] In another possible implementation, the monitoring data of multiple cloud servers can be obtained by respectively monitoring the multiple cloud servers through a monitoring device, obtaining the monitoring data of the multiple cloud servers, and determining the monitoring data as the monitoring data of the multiple cloud servers. For example, the monitoring device monitors the status of the CPU, memory, hard disk, network bandwidth, etc. of each cloud server to obtain the monitoring data of the multiple cloud servers.

[0066] S202, use an alarm type recognition model to process the monitoring data of each cloud server to obtain the alarm type of each cloud server; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales.

[0067] Among them, the alarm type recognition model refers to a neural network model that aggregates alarms from the monitoring data of the cloud server and identifies the alarm type. In an embodiment of the present application, the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data. Among them, the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales.

[0068] In practical applications, multiple historical monitoring data can be obtained by processing the historical monitoring data of multiple candidate cloud servers based on multiple different time intervals to obtain multiple historical monitoring data of each candidate cloud server at each time interval. For example, the historical monitoring data of multiple candidate cloud servers can be obtained from the database. The historical monitoring data can be data within a continuous period of time, such as data for 12 consecutive hours on a certain day. Of course, in order to increase the diversity of data, data within multiple continuous time periods can also be selected, such as historical monitoring data of multiple days arbitrarily selected.

[0069] Furthermore, the historical monitoring data of the selected multiple candidate cloud servers are intercepted according to multiple different time intervals, for example, the multiple time intervals are 10s, 20s, 30s, 60s, etc. For example, the historical monitoring data of the selected multiple candidate cloud servers is continuous for 1 hour, and 10s is used as a time interval to intercept the historical monitoring data of the 1 hour to obtain multiple historical monitoring data of each candidate cloud server at 10s intervals. Similarly, the same method is used for other time intervals to obtain multiple historical monitoring data of each candidate cloud server at 20s intervals, multiple historical monitoring data of each candidate cloud server at 30s intervals, and multiple historical monitoring data of each candidate cloud server at 60s intervals.

[0070] After acquiring multiple historical monitoring data, a two-dimensional image is generated based on the multiple historical monitoring data. Exemplarily, a Gram angular field algorithm can be used to calculate the Gram matrix, and a two-dimensional image can be obtained based on the Gram matrix and amplitude information encoding, wherein the main diagonal of the two-dimensional image reflects the change area of ​​the time series data, including rich time domain feature information, and the two-dimensional image also includes amplitude information. The multiple two-dimensional images acquired are used as model input data, and the preset neural network model is trained to obtain an alarm type recognition model, which can aggregate the input monitoring data and output the corresponding alarm type.

[0071] After the alarm type recognition model is trained, the monitoring data of multiple cloud servers are input into the trained alarm type recognition model to obtain multiple alarm types output by the alarm type recognition model, which are the alarm types of the multiple cloud servers.

[0072] S203: Outputting abnormal monitoring results of each cloud server based on the alarm type of each cloud server.

[0073] After the alarm type of each cloud server is obtained, the abnormal monitoring result of each cloud server can be output through the interface. The abnormal monitoring result may include the alarm type of each cloud server and the data corresponding to each alarm type.

[0074] In the abnormal monitoring method provided by the embodiment of the present application, in response to an abnormal monitoring request for multiple cloud servers in a target area, the monitoring data of the multiple cloud servers are obtained, and then the monitoring data of each cloud server is processed by an alarm type recognition model to obtain the alarm type of each cloud server, and then the abnormal monitoring results of each cloud server are output based on the alarm type of each cloud server, wherein the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data, and the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data, and the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales. In this method, the alarm type recognition model is obtained by model training using a two-dimensional image composed of multiple historical monitoring data, and the two-dimensional image includes not only the time domain feature information of the monitoring data, but also the amplitude information of the monitoring data, so that the two-dimensional image corresponding to the monitoring data has richer feature information, so that the alarm type recognition model trained based on the two-dimensional image has stronger aggregation and recognition capabilities, so that the alarm types of multiple cloud servers output by the alarm type recognition model will also be more accurate, thereby improving the abnormal monitoring results of cloud services. At the same time, the multiple historical monitoring data used in model training are of multiple time scales, which effectively avoids the problems of insufficient feature information and low accuracy caused by a single time scale, further improves the recognition accuracy of the alarm type recognition model, and thus improves the accuracy of abnormal monitoring results.

[0075] Based on the above embodiment, an embodiment is provided to illustrate the process of obtaining the above multiple historical monitoring data.

[0076] In an exemplary embodiment, Figure 3 As shown, the method also includes:

[0077] S301, based on a plurality of preset time intervals, monitor the status of a plurality of candidate cloud servers, and obtain status monitoring data of each candidate cloud server at each time interval.

[0078] When multiple candidate cloud servers need to be monitored, the status of multiple candidate cloud servers can be monitored by one or more monitoring devices at multiple preset time intervals. For example, if there is only one monitoring device, it is necessary to instruct the monitoring device to monitor multiple candidate cloud servers at different time intervals. For example, if data is collected for one hour at time intervals of 10s, 30s, and 60s, then data is collected for each candidate cloud server for one hour at time intervals of 10s, 30s, and 60s.

[0079] Among them, the status monitoring data may include one-dimensional monitoring data such as CPU, memory, hard disk, network bandwidth rate, and total number of TCP connections.

[0080] by As a time interval, the status monitoring data of a candidate server is obtained as shown in the matrix below :

[0081]

[0082] in, Respectively indicate monitoring time intervals A set of collected user request numbers and CPU, memory, storage, and network resource usage data; and R are as follows:

[0083]

[0084]

[0085] S302: Determine the status monitoring data of each candidate cloud server at each time interval as a plurality of historical monitoring data.

[0086] Based on the above method, the status monitoring data of each candidate cloud server at different time intervals is obtained, and the status monitoring data of each candidate cloud server at each time interval is determined as a plurality of historical monitoring data.

[0087] In the abnormal monitoring method provided in the embodiment of the present application, the status of multiple candidate cloud servers is monitored based on multiple preset time intervals, and the status monitoring data of each candidate cloud server at each time interval is obtained, and then the status monitoring data of each candidate cloud server at each time interval is determined as multiple historical monitoring data. In this method, by presetting multiple time intervals, the status of each candidate cloud server is monitored according to the multiple time intervals to obtain the status monitoring data collected by each candidate cloud server at the multiple time intervals. The status monitoring data is the historical monitoring data at multiple time scales, which effectively reduces the problems of insufficient feature information and low accuracy caused by a single time scale, and avoids the situation where the fault information is lost if the fault event happens to occur at the interception position of the time window, and provides the data quality of the training data of the alarm type recognition model, thereby improving the recognition accuracy of the alarm type recognition model.

[0088] Based on the above embodiment, an embodiment is provided to illustrate the generation process of the above two-dimensional image.

[0089] In an exemplary embodiment, Figure 4 As shown, the method also includes:

[0090] S401, determining a Gram matrix corresponding to each historical monitoring data according to a plurality of historical monitoring data.

[0091] In an embodiment of the present application, a plurality of historical monitoring data are processed by using a Gram angular field algorithm to obtain a Gram matrix corresponding to each historical monitoring data.

[0092] The multiple historical monitoring data are normalized to obtain the normalized multiple historical monitoring data.

[0093] With the aforementioned For example, the following formula (1) can be used to normalize the historical monitoring data.

[0094] (1)

[0095] The coordinate transformation formula is used to convert the data from the Cartesian coordinate system to the polar coordinate system, and then through the core encoding process, that is, the trigonometric cosine sum (or difference) between each point is used to form the Gram matrix , as follows formula (2):

[0096] (2)

[0097] Where I represents the unit row vector; is the cosine angle value of the time series, .

[0098] Based on the above method, the historical monitoring data of each candidate cloud server at each time interval is normalized and mathematically transformed to obtain multiple Gram matrices, wherein one candidate cloud server corresponds to n Gram matrices.

[0099] S402, generating a two-dimensional image according to each Gram matrix and amplitude information of a plurality of historical monitoring data.

[0100] In the embodiment of the present application, amplitude information is added on the basis of generating a two-dimensional image based on the Gram matrix to generate a two-dimensional image including both time domain feature information and amplitude information.

[0101] In one embodiment, if Figure 5 As shown, the process of generating a two-dimensional image may include:

[0102] S501, mapping each amplitude information into a preset interval to obtain the amplitude information after interval mapping.

[0103] In the embodiment of the present application, a linear transformation calculation is performed on each amplitude information, and each amplitude information is mapped to the interval [0, 1] to obtain the amplitude information after interval mapping.

[0104] S502, obtaining the sub-diagonal data of each Gram matrix.

[0105] S503, generating a two-dimensional image according to the amplitude information after interval mapping and the diagonal data.

[0106] From the Gram matrix, we can see that the main diagonal of the two-dimensional image encoded by the Gram angular field algorithm reflects the changing trend of the time series data and contains rich time domain feature information. The amplitude information after interval mapping is multiplied by the value of the diagonal of the Gram matrix to obtain a two-dimensional image. As mentioned earlier, if there are multiple Gram matrices, there will be multiple two-dimensional images generated. The diagonal data of each Gram matrix is ​​multiplied by the amplitude information after the corresponding interval mapping to obtain the corresponding two-dimensional image.

[0107] In this embodiment, the amplitude information of the historical monitoring data is added to the diagonal of the original Gram matrix to generate a two-dimensional image that contains both time domain feature information and amplitude information, so that the training data of the alarm type recognition model has richer and more obvious feature information, so that the model can better learn these features and process real-time data, thereby improving the aggregation and recognition accuracy of the model.

[0108] In the abnormal monitoring method provided in the embodiment of the present application, first, based on multiple historical monitoring data, the Gram matrix corresponding to each historical monitoring data is determined, and then a two-dimensional image is generated based on each Gram matrix and the amplitude information of the multiple historical monitoring data. In this method, multiple historical monitoring data are processed by the Gram angular field algorithm to obtain the Gram matrix corresponding to each historical monitoring data, which is convenient for analyzing the characteristics of time series data, so as to combine the amplitude information of the historical monitoring data to construct a more accurate two-dimensional image, and lay a solid foundation for training a higher performance alarm type recognition model.

[0109] Based on the above embodiment, an embodiment is provided to illustrate the training process of the above alarm type recognition model.

[0110] In an exemplary embodiment, Figure 6 As shown, the multiple historical monitoring data include monitoring data of multiple monitoring types; the two-dimensional images include multiple two-dimensional images corresponding to each monitoring type; and the training process of the alarm type recognition model includes:

[0111] S601: Acquire warning mode information of each two-dimensional image.

[0112] The monitoring type refers to the type of resources to be monitored, including the number of user requests, CPU, memory, hard disk, network bandwidth, total number of TCP connections, etc. The monitoring data of each monitoring type corresponds to multiple different time intervals and multiple candidate cloud servers. The monitoring data of a candidate cloud server of a monitoring type at a time interval generates a two-dimensional image. For example, corresponds to a two-dimensional image.

[0113] After the two-dimensional images are generated, professionals will annotate each two-dimensional image to mark the alarm mode information corresponding to each two-dimensional image. The alarm mode information refers to the alarm type corresponding to the two-dimensional image determined based on the analysis of the two-dimensional image, such as insufficient memory margin alarm, insufficient system network bandwidth, high CPU load, etc.

[0114] The alarm mode information is information marked by the user and is stored in a database. The alarm mode information of each two-dimensional image can be obtained from the database when needed.

[0115] S602: training a preset initial model according to each two-dimensional image and the alarm mode information of each two-dimensional image to obtain an alarm type recognition model.

[0116] After the alarm mode information of each two-dimensional image is obtained, it can be used as a gold standard, and each two-dimensional image and the alarm mode information of each two-dimensional image are used to train a preset initial model to obtain an alarm type recognition model.

[0117] The preset initial model can be a ResNet network, whose unique residual structure can effectively prevent the gradient from disappearing and improve the recognition accuracy of the model. The skip connection structure in the residual structure directly connects the input to the output, so that information can jump between different layers of the network, thereby maintaining the integrity of the information, allowing the network to perform deep training more effectively, and enabling the network to obtain higher accuracy in deeper situations.

[0118] In the abnormal monitoring method provided by the embodiment of the present application, the multiple historical monitoring data include monitoring data of multiple monitoring types, and the two-dimensional images include multiple two-dimensional images corresponding to each monitoring type. First, the alarm mode information of each two-dimensional image is obtained, and then the preset initial model is trained according to each two-dimensional image and the alarm mode information of each two-dimensional image to obtain an alarm type recognition model. In this method, an optional method for quickly training the alarm type recognition model is provided, by obtaining the alarm mode information of each two-dimensional image, using the alarm mode information as the real alarm type of each two-dimensional image, using the real alarm type and each two-dimensional image to train the initial model, and obtaining a trained alarm type recognition model, which is used for alarm recognition of new monitoring data, so as to timely discover abnormal situations of the cloud platform and deal with them in a timely manner.

[0119] Based on the above embodiment, an embodiment is provided to illustrate the process of training the initial model using each two-dimensional image and the warning mode information of each two-dimensional image.

[0120] In an exemplary embodiment, Figure 7 As shown, according to each two-dimensional image and the alarm mode information of each two-dimensional image, the preset initial model is trained to obtain an alarm type recognition model, including:

[0121] S701, input each two-dimensional image into the initial model to obtain the alarm aggregation prediction information and alarm mode prediction information output by the initial model.

[0122] In an embodiment of the present application, when training an alarm type recognition model, each two-dimensional image of the training data is input into the initial model, and the initial model performs alarm aggregation and alarm mode prediction on each two-dimensional image, and outputs the predicted alarm aggregation results and alarm mode, i.e., alarm aggregation prediction information and alarm mode prediction information.

[0123] S702, determining the predicted loss value of the initial model according to the alarm aggregation prediction information, the alarm mode prediction information and the individual alarm mode information.

[0124] After the initial model outputs the alarm aggregation prediction information and the alarm mode prediction information, the loss calculation is performed based on the prediction results and the actual results (the alarm mode information of each two-dimensional image).

[0125] Exemplarily, the alarm aggregation prediction information, the alarm mode prediction information and each alarm mode information can be input into a preset loss function to calculate the prediction loss value of the initial model. The loss function can be a cross entropy loss function.

[0126] S703: Based on the predicted loss value, adjust the model parameters of the initial model until the training is completed to obtain an alarm type recognition model.

[0127] After calculating the predicted loss value, the model parameters of the initial model are adjusted based on the predicted loss value. After the adjustment, the adjusted initial model is continued to be trained, and the predicted loss value is calculated again. The model parameters of the initial model are continuously adjusted based on the predicted loss value of each training process until the calculated predicted loss value is less than the preset loss value threshold. The training is stopped to obtain the alarm type recognition model.

[0128] In the abnormal monitoring method provided in the embodiment of the present application, each two-dimensional image is input into the initial model to obtain the alarm aggregation prediction information and alarm mode prediction information output by the initial model, and then the prediction loss value of the initial model is determined based on the alarm aggregation prediction information, the alarm mode prediction information and each alarm mode information, and then the model parameters of the initial model are adjusted based on the prediction loss value until the training is completed to obtain the alarm type recognition model. In this method, the input multiple two-dimensional images are processed by the initial model, and the predicted alarm aggregation results and alarm modes are output. The prediction result is calculated by the loss value between the actual alarm mode information, and the model parameters of the initial model are continuously adjusted based on the loss value, so that the prediction result of the initial model is continuously close to the actual value, thereby improving the prediction ability of the model, thereby improving the aggregation ability and recognition ability of the alarm type recognition model.

[0129] Based on the above embodiment, an embodiment is provided to illustrate the process of outputting the abnormal monitoring results of each cloud server.

[0130] In an exemplary embodiment, Figure 8 As shown, based on the alarm type of each cloud server, the abnormal monitoring results of each cloud server are output, including:

[0131] S801, obtain the alarm abnormality data and alarm generation time of each cloud server.

[0132] Among them, the alarm abnormal data refers to the abnormal monitoring data corresponding to the alarm. For example, if the alarm type is high CPU load, it means that the abnormal monitoring data that generates the alarm is abnormal CPU monitoring data, and the abnormal CPU monitoring data will be filtered out from the CPU monitoring data. The alarm generation time refers to the time corresponding to the alarm abnormal data. Taking the CPU as an example, if the alarm abnormal data is abnormal CPU monitoring data, the time corresponding to the abnormal CPU monitoring data can be obtained from the monitoring device as the alarm generation time.

[0133] S802: Determine the alarm type of each cloud server, the alarm abnormal data of each cloud server, and the alarm generation time as the abnormal monitoring result.

[0134] The alarm abnormal data and alarm generation time of each cloud server obtained above, as well as the alarm type of each cloud server are taken as the abnormal monitoring result of each cloud server.

[0135] S803, displaying the abnormal monitoring results through a preset alarm display method.

[0136] Among them, the alarm display method can include web page display method, software display method, etc.

[0137] After determining the abnormal monitoring results of each cloud server, the abnormal monitoring data is displayed on the monitoring alarm platform according to the preset alarm display method. At the same time, in order for the operation and maintenance personnel to handle the alarm in time, prompts can also be set for the abnormal monitoring results. For example, prompts can be given by sound.

[0138] In the abnormal monitoring method provided in the embodiment of the present application, by obtaining the alarm abnormal data and alarm generation time of each cloud server, and determining the alarm type of each cloud server, the alarm abnormal data and alarm generation time of each cloud server as the abnormal monitoring result, and then displaying the abnormal monitoring result through a preset alarm display method. In this method, not only the alarm type is used as the abnormal monitoring result, but also the alarm abnormal data and alarm generation time are output as the abnormal monitoring result, which is convenient for operation and maintenance personnel to analyze and process the alarm, and the abnormal monitoring results are displayed on the monitoring alarm platform, which can enable the operation and maintenance personnel to more intuitively observe the monitoring situation on a longer time axis, timely discover the location of the fault alarm, and improve the efficiency of alarm processing.

[0139] In addition, in an exemplary embodiment, the present application also provides an abnormality monitoring method, such as Fig. 9 As shown, the following steps may be included:

[0140] S901, based on a plurality of preset time intervals, monitor the status of a plurality of candidate cloud servers, and obtain status monitoring data of each candidate cloud server at each of the preset time intervals.

[0141] S902: Determine the status monitoring data of each candidate cloud server at each time interval as a plurality of historical monitoring data.

[0142] S903: Determine, according to the plurality of historical monitoring data, a Gram matrix corresponding to each historical monitoring data.

[0143] S904, mapping each amplitude information into a preset interval to obtain the amplitude information after interval mapping.

[0144] S905, obtaining the sub-diagonal data of each Gram matrix.

[0145] S906, generating a two-dimensional image according to the amplitude information after interval mapping and the diagonal data.

[0146] S907: Obtain warning mode information of each two-dimensional image.

[0147] S908, input each two-dimensional image into the initial model to obtain the alarm aggregation prediction information and alarm mode prediction information output by the initial model.

[0148] S909, determining the predicted loss value of the initial model according to the alarm aggregation prediction information, the alarm mode prediction information and the individual alarm mode information.

[0149] S910, based on the predicted loss value, adjust the model parameters of the initial model until the training is completed to obtain an alarm type recognition model.

[0150] S911, in response to an abnormality monitoring request for multiple cloud servers in a target area, obtaining monitoring data of the multiple cloud servers.

[0151] S912: Use the alarm type recognition model to process the monitoring data of each cloud server to obtain the alarm type of each cloud server.

[0152] S913: Output the abnormal monitoring result of each cloud server based on the alarm type of each cloud server.

[0153] Optionally, obtain the alarm abnormal data and alarm generation time of each cloud server; determine the alarm type of each cloud server, the alarm abnormal data and alarm generation time of each cloud server as the abnormal monitoring result; and display the abnormal monitoring result through a preset alarm display method.

[0154] The above-mentioned process of S901-S913 can refer to the description of the above-mentioned method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0155] In addition, in an exemplary embodiment, the framework of the monitoring alarm aggregation and pattern recognition solution in the embodiment of the present application is described.

[0156] like Fig.10 As shown in the figure, the monitoring information collection module collects one-dimensional monitoring data of multiple time scales and multiple types of resources as the original data encoded by the Gram angular field algorithm. These original one-dimensional monitoring data are encoded by the improved Gram angular field algorithm to obtain a two-dimensional image. In the algorithm, the amplitude information of the monitoring data is mapped to the diagonal of the Gram matrix to obtain a two-dimensional image, which provides a picture set for model training. The model aggregates and recognizes patterns on these two-dimensional image data. At the same time, the model is also updated and iterated according to the input data to ensure that new alarm patterns can be effectively identified. The trained model can output the pattern recognition results after alarm aggregation. The monitoring alarm module displays the alarm pattern output by the model and notifies the operation and maintenance personnel to handle the alarm in time.

[0157] In this embodiment, the improved Gram angular field algorithm and the neural network are combined and applied to the monitoring data alarm aggregation and pattern recognition field of the cloud platform. At the same time, the data set is constructed using multi-scale time, so that the monitoring alarm module of the cloud platform has strong alarm aggregation and pattern recognition capabilities, reducing manual burden and cost and improving efficiency.

[0158] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0159] Based on the same inventive concept, the embodiment of the present application also provides an abnormality monitoring device for implementing the abnormality monitoring method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more abnormality monitoring device embodiments provided below can refer to the limitations of the abnormality monitoring method above, and will not be repeated here.

[0160] In an exemplary embodiment, Fig.11 As shown, an abnormality monitoring device 1 is provided, comprising: a data acquisition module 10, a data processing module 20 and a result output module 30, wherein:

[0161] A data acquisition module 10 is used to obtain monitoring data of multiple cloud servers in response to an abnormal monitoring request for multiple cloud servers in a target area;

[0162] The data processing module 20 is used to process the monitoring data of each cloud server using an alarm type recognition model to obtain the alarm type of each cloud server; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales;

[0163] The result output module 30 is used to output the abnormal monitoring result of each cloud server based on the alarm type of each cloud server.

[0164] In one embodiment, the abnormality monitoring device 1 further includes:

[0165] A matrix determination module, used for determining the Gram matrix corresponding to each historical monitoring data according to a plurality of historical monitoring data;

[0166] The image generation module is used to generate a two-dimensional image according to the amplitude information of each Gram matrix and multiple historical monitoring data.

[0167] In one embodiment, the image generation module is further used for:

[0168] Map each amplitude information into a preset interval to obtain the amplitude information after interval mapping;

[0169] Get the sub-diagonal data of each Gram matrix;

[0170] A two-dimensional image is generated based on the amplitude information after interval mapping and the diagonal data.

[0171] In one embodiment, the abnormality monitoring device 1 further includes:

[0172] A status monitoring module is used to monitor the status of multiple candidate cloud servers based on multiple preset time intervals, and obtain status monitoring data of each candidate cloud server at each time interval;

[0173] The data determination module is used to determine the status monitoring data of each candidate cloud server at each time interval as a plurality of historical monitoring data.

[0174] In one embodiment, the abnormality monitoring device 1 further includes:

[0175] An information acquisition module, used to acquire the warning mode information of each two-dimensional image;

[0176] The model training module is used to train a preset initial model according to each two-dimensional image and the alarm mode information of each two-dimensional image to obtain an alarm type recognition model.

[0177] In one embodiment, the model training module is further used to:

[0178] Input each two-dimensional image into the initial model to obtain the alarm aggregation prediction information and alarm mode prediction information output by the initial model; determine the prediction loss value of the initial model according to the alarm aggregation prediction information, the alarm mode prediction information and each alarm mode information; based on the prediction loss value, adjust the model parameters of the initial model until the training is completed to obtain an alarm type recognition model.

[0179] In one embodiment, the result output module 30 is further used for:

[0180] Obtain the alarm abnormal data and alarm generation time of each cloud server; determine the alarm type of each cloud server, the alarm abnormal data and alarm generation time of each cloud server as the abnormal monitoring result; and display the abnormal monitoring result through the preset alarm display method.

[0181] Each module in the above-mentioned abnormal monitoring device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0182] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Fig.12 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store abnormal monitoring data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an abnormal monitoring method is implemented.

[0183] Those skilled in the art will understand that Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0184] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0185] In response to an abnormality monitoring request for multiple cloud servers in a target area, obtaining monitoring data of the multiple cloud servers;

[0186] The monitoring data of each cloud server is processed by an alarm type recognition model to obtain the alarm type of each cloud server; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales;

[0187] Based on the alarm type of each cloud server, output the abnormal monitoring results of each cloud server.

[0188] The implementation principles and technical effects of each step implemented by the processor in the embodiment of the present application are similar to the principles of the above-mentioned abnormality monitoring method, and will not be repeated here.

[0189] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0190] In response to an abnormality monitoring request for multiple cloud servers in a target area, obtaining monitoring data of the multiple cloud servers;

[0191] The monitoring data of each cloud server is processed by an alarm type recognition model to obtain the alarm type of each cloud server; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales;

[0192] Based on the alarm type of each cloud server, output the abnormal monitoring results of each cloud server.

[0193] The implementation principles and technical effects of the various steps implemented when the computer program in the embodiment of the present application is executed by the processor are similar to the principles of the above-mentioned abnormality monitoring method and will not be repeated here.

[0194] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0195] In response to an abnormality monitoring request for multiple cloud servers in a target area, obtaining monitoring data of the multiple cloud servers;

[0196] The monitoring data of each cloud server is processed by an alarm type recognition model to obtain the alarm type of each cloud server; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales;

[0197] Based on the alarm type of each cloud server, output the abnormal monitoring results of each cloud server.

[0198] The implementation principles and technical effects of the various steps implemented when the computer program in the embodiment of the present application is executed by the processor are similar to the principles of the above-mentioned abnormality monitoring method and will not be repeated here.

[0199] It should be noted that the personnel information (including but not limited to personnel equipment information, personnel personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the personnel or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0200] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0201] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0202] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. An abnormality monitoring method, characterized in that: The method comprises: In response to an abnormality monitoring request for a plurality of cloud servers in a target area, acquiring monitoring data of the plurality of cloud servers; The monitoring data of each of the cloud servers is processed using an alarm type recognition model to obtain the alarm type of each of the cloud servers; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of the multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales; Based on the alarm type of each of the cloud servers, the abnormal monitoring results of each of the cloud servers are output.

2. The method according to claim 1, characterized in that The method further comprises: Determine, according to the plurality of historical monitoring data, a Gram matrix corresponding to each of the historical monitoring data; The two-dimensional image is generated according to each of the Gram matrices and the amplitude information of the plurality of historical monitoring data.

3. The method according to claim 2, characterized in that The step of generating the two-dimensional image according to the Gram matrix and the amplitude information of the plurality of historical monitoring data comprises: Mapping each of the amplitude information into a preset interval to obtain the amplitude information after interval mapping; Obtaining the diagonal data of each of the Gram matrices; The two-dimensional image is generated according to the amplitude information after the interval mapping and the sub-diagonal data.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: Based on a plurality of preset time intervals, the status of a plurality of candidate cloud servers is monitored to obtain status monitoring data of each candidate cloud server at each of the preset time intervals; The status monitoring data of each candidate cloud server at each time interval is determined as the plurality of historical monitoring data.

5. The method according to any one of claims 1 to 3, characterized in that: The plurality of historical monitoring data includes monitoring data of multiple monitoring types; the two-dimensional images include a plurality of two-dimensional images corresponding to each of the monitoring types; and the training process of the alarm type recognition model includes: Acquiring warning mode information of each of the two-dimensional images; According to each of the two-dimensional images and the alarm mode information of each of the two-dimensional images, a preset initial model is trained to obtain the alarm type recognition model.

6. The method according to claim 5, characterized in that The step of training a preset initial model according to each of the two-dimensional images and the alarm mode information of each of the two-dimensional images to obtain the alarm type recognition model includes: Inputting each of the two-dimensional images into the initial model to obtain alarm aggregation prediction information and alarm mode prediction information output by the initial model; Determining a predicted loss value of the initial model according to the alarm aggregation prediction information, the alarm mode prediction information and each of the alarm mode information; Based on the predicted loss value, the model parameters of the initial model are adjusted until the training is completed to obtain the alarm type recognition model.

7. The method according to any one of claims 1 to 3, characterized in that: The outputting the abnormal monitoring result of each cloud server based on the alarm type of each cloud server includes: Obtaining alarm exception data and alarm generation time of each of the cloud servers; Determine the alarm type of each of the cloud servers, the alarm abnormal data of each of the cloud servers, and the alarm generation time as the abnormal monitoring result; The abnormal monitoring results are displayed through a preset alarm display method.

8. An abnormality monitoring device, characterized in that: The device comprises: A data acquisition module, configured to acquire monitoring data of a plurality of cloud servers in a target area in response to an abnormality monitoring request for the plurality of cloud servers; A data processing module, used to process the monitoring data of each of the cloud servers using an alarm type recognition model to obtain the alarm type of each of the cloud servers; the alarm type recognition model is pre-trained based on a two-dimensional image composed of multiple historical monitoring data; the two-dimensional image includes time domain feature information and amplitude information of the multiple historical monitoring data; the multiple historical monitoring data are monitoring data of multiple candidate cloud servers obtained based on multiple different time scales; The result output module is used to output the abnormal monitoring result of each cloud server based on the alarm type of each cloud server.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images