Cloud platform early warning method and device based on improved VAE, equipment and medium

Abstract

The invention discloses a cloud platform early warning method and device based on improved VAE, equipment and a medium. The method comprises the following steps: acquiring first system time sequence data of a target cloud platform; the first system time sequence data is data obtained after standardization processing is conducted on data output by the target cloud platform in the current time period; processing the first system time sequence data based on an improved VAE model to obtain a target reconstruction error; the improved VAE model is used for describing an incidence relation between system time sequence data and a reconstruction error; and based on a comparison result of the target reconstruction error and a target threshold, determining a data detection result corresponding to the first system time sequence data, and performing early warning based on the data detection result, the target threshold value is obtained by processing second system time sequence data of the target cloud platform based on the improved VAE model, and the second system time sequence data is data obtained after standardization processing is conducted on data output by the target cloud platform in the historical time period. According to the invention, the problem of false detection possibly caused by dependence on a preset empirical value is solved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a cloud platform early warning method, device, equipment and medium based on improved VAE. Background Art

[0002] The rapid development of the Internet has promoted the transformation of computing models. Most of the systems currently used cannot run completely automatically and reliably. They may have many types of unpredictable failures, which often cause the system to fail and reduce its performance level. The anomaly detection and early warning module can provide services such as anomaly discovery, anomaly cause analysis, and anomaly handling, becoming an important guarantee for system operation.

[0003] Whether the platform system is abnormal at present can be determined by checking whether the collected platform system data is abnormal. The current detection method still has the following problems: whether the data is abnormal is usually based on a preset experience value. When the data exceeds this value, it is considered abnormal. However, the system's operating parameters and transaction values ​​will change in different operating environments. Therefore, relying on the preset experience value may result in false detection. Summary of the invention

[0004] The present invention provides a cloud platform early warning method, device, equipment and medium based on improved VAE to solve the problem that false detection may occur when relying on preset experience values.

[0005] According to one aspect of the present invention, a cloud platform early warning method based on improved VAE is provided, the method comprising:

[0006] Acquire first system time series data of the target cloud platform; the first system time series data is data after the data output by the target cloud platform in the current period is standardized;

[0007] Processing the first system time series data based on an improved VAE model to obtain a target reconstruction error; the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error;

[0008] Based on the comparison result of the target reconstruction error and the target threshold, the data detection result corresponding to the first system time series data is determined, so as to issue an early warning based on the data detection result; the target threshold is obtained by processing the second system time series data of the target cloud platform based on the improved VAE model, and the second system time series data is the data after standardized processing of the data output by the target cloud platform in the historical period.

[0009] According to another aspect of the present invention, a cloud platform early warning device based on improved VAE is provided, the device comprising:

[0010] A data acquisition module, used to acquire first system time series data of a target cloud platform; the first system time series data is data after standardized processing of data output by the target cloud platform in a current period;

[0011] An error determination module, used to process the first system time series data based on an improved VAE model to obtain a target reconstruction error; the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error;

[0012] A detection module is used to determine the data detection result corresponding to the first system time series data based on the comparison result of the target reconstruction error and the target threshold, so as to issue an early warning based on the data detection result; the target threshold is obtained by processing the second system time series data of the target cloud platform based on the improved VAE model, and the second system time series data is the data output by the target cloud platform in the historical period after standardized processing

[0013] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the cloud platform early warning method based on the improved VAE described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the cloud platform early warning method based on the improved VAE described in any embodiment of the present invention when executed.

[0018] The technical solution of the embodiment of the present invention obtains the first system time series data of the target cloud platform; the first system time series data is the data after the data output by the target cloud platform in the current time period is standardized; the first system time series data is processed based on the improved VAE model to obtain the target reconstruction error; the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error, thereby realizing the accurate determination of the target reconstruction error, and further based on the comparison result of the target reconstruction error and the target threshold, the data detection result corresponding to the first system time series data is determined, so as to issue an early warning based on the data detection result; the second system time series data is the data after the data output by the target cloud platform in the historical time period is standardized, and the target threshold is obtained by processing the second system time series data of the target cloud platform based on the improved VAE model, thereby realizing the accurate acquisition and real-time update of the target threshold, avoiding the error of cloud platform early warning affected by the inaccurate threshold, and solving the problem of false detection that may occur when relying on preset experience values.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a cloud platform early warning method based on improved VAE provided according to an embodiment of the present invention;

[0022] Figure 2 It is a structural schematic diagram of a cloud platform early warning device based on improved VAE provided according to an embodiment of the present invention;

[0023] Figure 3 It is a structural diagram of an electronic device for implementing the cloud platform early warning method based on improved VAE according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] Embodiment 1

[0027] Figure 1 The present invention provides a flowchart of a cloud platform early warning method based on improved VAE. This embodiment is applicable to the case of cloud platform early warning based on improved VAE. The method can be executed by a cloud platform early warning device based on improved VAE. The cloud platform early warning device based on improved VAE can be implemented in the form of hardware and / or software. The cloud platform early warning device based on improved VAE can be configured in any electronic device with network communication function. Figure 1 As shown, the method includes:

[0028] S110, obtaining first system time series data of the target cloud platform; the first system time series data is data obtained by subjecting the data output by the target cloud platform in the current period to standardized processing.

[0029] The cloud platform early warning method based on improved VAE of the present invention can be applied to different cloud platforms, the cloud platform early warning method based on improved VAE can be executed based on the cloud platform early warning device based on improved VAE, and the cloud platform early warning device based on improved VAE can include a data acquisition module, and the data acquisition module can find all target cloud platform nodes, and deploy the acquisition component to the node of each target cloud platform, so as to obtain the first system time series data of each target cloud platform. Further, different target cloud platforms can be connected by yaml file configuration, and corresponding folders can be set for the target cloud platform. All log files under the specified folder can be scanned regularly, and a monitoring thread can be created for each file. When the log file changes, the monitoring thread will read the new content in real time, so as to make real-time early warning judgments on the target cloud platform.

[0030] The first system time series data includes at least one of system logs, monitoring data, events, system operation status, transaction volume, disk read rate, network receiving rate, network sending rate, and system operation response time. The system operation status may include information such as CPU and memory.

[0031] Specifically, complete the collection of candidate data such as system logs, monitoring, events, system operation status, transaction volume, disk read rate, network receiving rate, network sending rate, system operation response time, etc.; conduct preliminary integration of the candidate data, complete data standardization processing to obtain the first system time series data of the target cloud platform.

[0032] S120. Process the first system time series data based on the improved VAE model to obtain a target reconstruction error; the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error.

[0033] The first system timing data and the second system timing data in this embodiment are both system timing data.

[0034] Specifically, the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error. The first system time series data is input into the improved VAE model, and the improved VAE model processes the first system time series data to obtain the target reconstruction error.

[0035] Optionally, the improved VAE model consists of a reconstruction sub-model and a threshold evaluation sub-model composed of a VAE network; the output layer of the reconstruction sub-model is connected to the input layer of the threshold evaluation sub-model, and the input layer of the improved VAE model is respectively connected to the input layer of the reconstruction sub-model and the input layer of the threshold evaluation sub-model.

[0036] In this implementation, the construction of the VAE model is improved, including steps A1-A5:

[0037] Step A1: Acquire the second system time series data of the target cloud platform; the second system time series data includes normal time series data and abnormal time series data.

[0038] Step A2, divide the second system time series data into a first training set and a second training set; the first training set includes a first preset number of normal time series data in the second system time series data, and the second training set includes a second preset number of normal time series data and abnormal time series data in the second system time series data.

[0039] Step A3: training the pre-trained reconstruction sub-model based on the first training set to obtain a reconstruction sub-model; the reconstruction sub-model is used to output data whose similarity value with the input original data reaches a preset similarity value.

[0040] Step A4: input the normal time series data in the second training set into the reconstruction sub-model to obtain a normal reconstructed data set.

[0041] Step A5: Based on the second training set and the normal reconstructed data set, the pre-trained threshold evaluation sub-model is trained to obtain a threshold evaluation sub-model; the threshold evaluation sub-model is used to describe the reconstruction error between the second training set and the normal reconstructed data set.

[0042] Specifically, based on the second training set and the normal reconstruction data set, the pre-trained threshold evaluation sub-model is trained to obtain the threshold evaluation sub-model, including: determining the first reconstruction error and the second reconstruction error based on the pre-trained threshold evaluation sub-model; the first reconstruction error is the difference between the normal time series data and the normal reconstruction data set in the second training set, and the second reconstruction error is the difference between the abnormal time series data and the normal reconstruction data set in the second training set; if the first reconstruction error and the second reconstruction error meet the preset conditions, the pre-trained threshold evaluation sub-model corresponding to the first reconstruction error and the second reconstruction error that meet the preset conditions is used as the threshold evaluation sub-model. The preset condition may be that the first reconstruction error belongs to a first preset range and the second reconstruction error belongs to a second preset range.

[0043] This embodiment, through the construction of an improved VAE model, realizes the real-time determination and modification of data thresholds for different cloud platform data by adopting the improved VAE model, thereby avoiding the accuracy of data warnings affected by threshold errors.

[0044] S130. Based on the comparison result of the target reconstruction error and the target threshold, determine the data detection result corresponding to the first system time series data, so as to issue an early warning based on the data detection result; the target threshold is obtained by processing the second system time series data of the target cloud platform based on the improved VAE model, and the second system time series data is the data after standardized processing of the data output by the target cloud platform in the historical period.

[0045] Specifically, when the target reconstruction error is greater than the target threshold, the first system time series data corresponding to the target reconstruction error is marked as abnormal data; when the target reconstruction error is less than or equal to the target threshold, the first system time series data corresponding to the target reconstruction error is marked as normal data.

[0046] Furthermore, issuing an early warning based on the data detection result includes: matching an early warning rule according to the data detection result and the first system time series data corresponding to the data detection result, so as to issue an early warning according to the early warning rule. Among them, the early warning rule can be to merge similar content alarms into one notification or to take sound suppression measures in specific scenarios. The early warning notification forms include email, phone, text message and other methods, so that when an abnormality occurs on the target cloud platform, the corresponding operation and maintenance personnel and developers can be notified to handle the early warning event.

[0047] Optionally, the determination of the target threshold includes: dividing a third training set based on the second system time series data; the third training set includes a third preset number of normal time series data and abnormal time series data in the second system time series data; inputting the third training set into the improved VAE model to obtain a reference reconstruction error; taking the weighted average of each reference reconstruction error as the target threshold, thereby achieving accurate determination of the target threshold and solving the problem of false detection that may occur when relying on preset experience values. In addition, the target threshold can be checked at a preset time through the system time series data before the current moment every preset time to ensure dynamic update of the target threshold and ensure the validity of the target threshold.

[0048] The technical solution of the embodiment of the present invention obtains the first system time series data of the target cloud platform; the first system time series data is the data after the data output by the target cloud platform in the current time period is standardized; the first system time series data is processed based on the improved VAE model to obtain the target reconstruction error; the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error, thereby realizing the accurate determination of the target reconstruction error, and further based on the comparison result of the target reconstruction error and the target threshold, the data detection result corresponding to the first system time series data is determined, so as to issue an early warning based on the data detection result; the second system time series data is the data after the data output by the target cloud platform in the historical time period is standardized, and the target threshold is obtained by processing the second system time series data of the target cloud platform based on the improved VAE model, thereby realizing the accurate acquisition and real-time update of the target threshold, avoiding the error of cloud platform early warning affected by the inaccurate threshold, and solving the problem of false detection that may occur when relying on preset experience values.

[0049] Embodiment 2

[0050] Figure 2The present invention provides a schematic diagram of the structure of a cloud platform early warning device based on improved VAE. This embodiment is applicable to the situation of cloud platform early warning based on improved VAE. The cloud platform early warning device based on improved VAE can be implemented in the form of hardware and / or software. The cloud platform early warning device based on improved VAE can be configured in any electronic device with network communication function. Figure 2 As shown, the device comprises:

[0051] The data acquisition module 210 is used to acquire the first system time series data of the target cloud platform; the first system time series data is the data after the data output by the target cloud platform in the current period is standardized;

[0052] An error determination module 220 is used to process the first system time series data based on an improved VAE model to obtain a target reconstruction error; the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error;

[0053] The detection module 230 is used to determine the data detection result corresponding to the system time series data based on the comparison result between the target reconstruction error and the target threshold, so as to issue an early warning based on the data detection result; the target threshold is obtained by processing the second system time series data of the target cloud platform based on the improved VAE model, and the second system time series data is the data output by the target cloud platform in the historical period after standardized processing.

[0054] Based on the above embodiments, optionally, the improved VAE model is composed of a reconstruction sub-model and a threshold evaluation sub-model composed of a VAE network; the output layer of the reconstruction sub-model is connected to the input layer of the threshold evaluation sub-model, and the input layer of the improved VAE model is respectively connected to the input layer of the reconstruction sub-model and the input layer of the threshold evaluation sub-model.

[0055] On the basis of the above embodiment, optionally, the cloud platform early warning device based on the improved VAE includes a model building module, and the model building module includes:

[0056] A data acquisition unit, used to acquire the second system time series data of the target cloud platform; the second system time series data includes normal time series data and abnormal time series data;

[0057] A first training set division unit is used to divide the second system time series data into a first training set and a second training set; the first training set includes a first preset number of normal time series data in the second system time series data, and the second training set includes a second preset number of normal time series data and abnormal time series data in the second system time series data;

[0058] A first training unit is used to train the pre-trained reconstruction sub-model based on the first training set to obtain the reconstruction sub-model; the reconstruction sub-model is used to output data whose similarity value with the input original data reaches a preset similarity value;

[0059] A data set acquisition unit, used for inputting the normal time series data in the second training set into the reconstruction sub-model to obtain a normal reconstructed data set;

[0060] The second training unit is used to train the pre-trained threshold evaluation sub-model based on the second training set and the normal reconstruction data set to obtain the threshold evaluation sub-model; the threshold evaluation sub-model is used to describe the reconstruction error between the second training set and the normal reconstruction data set.

[0061] On the basis of the above embodiment, optionally, the second training unit is also used to determine a first reconstruction error and a second reconstruction error based on a pre-trained threshold evaluation submodel; the first reconstruction error is the difference between the normal time series data in the second training set and the normal reconstructed data set, and the second reconstruction error is the difference between the abnormal time series data in the second training set and the normal reconstructed data set; if the first reconstruction error and the second reconstruction error meet preset conditions, the pre-trained threshold evaluation submodel corresponding to the first reconstruction error and the second reconstruction error that meet the preset conditions is used as the threshold evaluation submodel.

[0062] On the basis of the above embodiments, optionally, the cloud platform early warning device based on the improved VAE includes a target threshold determination module, which is used to divide a third training set based on the second system time series data; the third training set includes a third preset number of normal time series data and abnormal time series data in the second system time series data; the third training set is input into the improved VAE model to obtain a reference reconstruction error; and the weighted average of each reference reconstruction error is used as the target threshold.

[0063] Based on the above embodiment, optionally, the detection module includes a detection result determination unit, which is used to mark the first system timing data corresponding to the target reconstruction error as abnormal data when the target reconstruction error is greater than the target threshold; when the target reconstruction error is less than or equal to the target threshold, mark the first system timing data corresponding to the target reconstruction error as normal data.

[0064] On the basis of the above embodiment, optionally, the detection module includes an early warning unit, which is used to match early warning rules according to the data detection result and the first system time series data corresponding to the data detection result, so as to issue an early warning according to the early warning rule.

[0065] Based on the above embodiment, optionally, the first system timing data includes: at least one of: system logs, monitoring data, events, system operation status, transaction volume, disk read rate, network receiving rate, network sending rate and system operation response time.

[0066] The cloud platform early warning device based on improved VAE provided in the embodiment of the present invention can execute the cloud platform early warning method based on improved VAE provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0067] Embodiment 3

[0068] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0069] Figure 3 A schematic diagram of the structure of an electronic device that can be used to implement the cloud platform early warning method based on improved VAE in an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0070] like Figure 3 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0071] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0072] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the cloud platform early warning method based on the improved VAE.

[0073] In some embodiments, the cloud platform early warning method based on the improved VAE may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the cloud platform early warning method based on the improved VAE described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the cloud platform early warning method based on the improved VAE in any other appropriate manner (e.g., by means of firmware).

[0074] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0075] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0076] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0077] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0078] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0079] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0080] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0081] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A cloud platform early warning method based on improved VAE, characterized in that: The method comprises: Acquire first system time series data of the target cloud platform; the first system time series data is data after the data output by the target cloud platform in the current period is standardized; Processing the first system time series data based on an improved VAE model to obtain a target reconstruction error; the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error; Based on the comparison result of the target reconstruction error and the target threshold, the data detection result corresponding to the first system time series data is determined, so as to issue an early warning based on the data detection result; the target threshold is obtained by processing the second system time series data of the target cloud platform based on the improved VAE model, and the second system time series data is the data after standardized processing of the data output by the target cloud platform in the historical period.

2. The method according to claim 1, characterized in that: The improved VAE model is composed of a reconstruction sub-model and a threshold evaluation sub-model composed of a VAE network; the output layer of the reconstruction sub-model is connected to the input layer of the threshold evaluation sub-model, and the input layer of the improved VAE model is respectively connected to the input layer of the reconstruction sub-model and the input layer of the threshold evaluation sub-model.

3. The method according to claim 2, characterized in that The construction of the improved VAE model includes: Acquire the second system time series data of the target cloud platform; the second system time series data includes normal time series data and abnormal time series data; Dividing the second system time series data into a first training set and a second training set; the first training set includes a first preset number of normal time series data in the second system time series data, and the second training set includes a second preset number of normal time series data and abnormal time series data in the second system time series data; The pre-trained reconstruction sub-model is trained based on the first training set to obtain the reconstruction sub-model; the reconstruction sub-model is used to output data whose similarity value with the input original data reaches a preset similarity value; Inputting the normal time series data in the second training set into the reconstruction sub-model to obtain a normal reconstructed data set; Based on the second training set and the normal reconstructed data set, the pre-trained threshold evaluation sub-model is trained to obtain the threshold evaluation sub-model; the threshold evaluation sub-model is used to describe the reconstruction error between the second training set and the normal reconstructed data set.

4. The method according to claim 3, characterized in that Based on the second training set and the normal reconstruction data set, training the pre-trained threshold evaluation sub-model to obtain the threshold evaluation sub-model includes: Determine a first reconstruction error and a second reconstruction error based on a pre-trained threshold evaluation submodel; the first reconstruction error is the difference between the normal time series data in the second training set and the normal reconstructed data set, and the second reconstruction error is the difference between the abnormal time series data in the second training set and the normal reconstructed data set; If the first reconstruction error and the second reconstruction error meet a preset condition, the pre-trained threshold evaluation sub-model corresponding to the first reconstruction error and the second reconstruction error that meet the preset condition is used as the threshold evaluation sub-model.

5. The method according to claim 2, characterized in that: The determination of the target threshold comprises: Divide a third training set based on the second system time series data; the third training set includes a third preset number of normal time series data and abnormal time series data in the second system time series data; Inputting the third training set into the improved VAE model to obtain a reference reconstruction error; The weighted average of each of the reference reconstruction errors is used as the target threshold.

6. The method according to claim 1, characterized in that Determining a data detection result corresponding to the first system time series data based on a comparison result of the target reconstruction error and a target threshold value includes: When the target reconstruction error is greater than a target threshold, marking the first system time series data corresponding to the target reconstruction error as abnormal data; When the target reconstruction error is less than or equal to the target threshold, the first system time series data corresponding to the target reconstruction error is marked as normal data.

7. The method according to claim 6, characterized in that Providing an early warning based on the data detection result includes: According to the data detection result and the first system time series data corresponding to the data detection result, an early warning rule is matched to issue an early warning according to the early warning rule.

8. A cloud platform early warning device based on improved VAE, characterized in that: The device comprises: A data acquisition module, used to acquire first system time series data of a target cloud platform; the first system time series data is data after the data output by the target cloud platform in the current period is standardized; An error determination module, used to process the first system time series data based on an improved VAE model to obtain a target reconstruction error; the improved VAE model is used to describe the correlation between the system time series data and the reconstruction error; A detection module is used to determine the data detection result corresponding to the first system time series data based on the comparison result of the target reconstruction error and the target threshold, so as to issue an early warning based on the data detection result; the target threshold is obtained by processing the second system time series data of the target cloud platform based on the improved VAE model, and the second system time series data is the data after standardized processing of the data output by the target cloud platform in the historical period.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the cloud platform early warning method based on improved VAE as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the cloud platform early warning method based on improved VAE as described in any one of claims 1 to 7 when executed.

Images