Virtual machine anomaly detection method and device, equipment, storage medium and program product

Abstract

The invention relates to a virtual machine anomaly detection method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: calculating according to a historical occurrence probability value of each user operation in user operation time sequence data corresponding to a virtual machine, and determining a data abnormal value corresponding to the user operation time sequence data; performing data information fusion on the operation statistical data corresponding to the virtual machine and the user operation time sequence data to obtain an information fusion feature, and detecting a fusion abnormal value corresponding to the virtual machine according to the information fusion feature; and determining an operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value. By adopting the method, the accuracy of detecting the abnormal operation of the virtual machine can be improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a virtual machine method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of virtual machines in cloud technology, the security of virtual machines is becoming more and more important. Currently, the security of virtual machines is usually guaranteed by cloud providers. For example, the cloud provider's security software is used to detect whether the virtual machine has security issues. Usually, security anomalies occur during the operation of virtual machines due to external attacks or internal abnormal operations.

[0003] Currently, when detecting abnormal operations inside a virtual machine, detection is performed through the time series data of user operations. However, detection only through the time series data of user operations has the problem of insufficient data information, which easily leads to reduced accuracy of abnormal operation detection. Summary of the invention

[0004] Based on this, it is necessary to provide a virtual machine anomaly detection method, apparatus, computer equipment, computer-readable storage medium and computer program product that can improve the accuracy of operation anomaly detection in response to the above technical problems.

[0005] In a first aspect, the present application provides a virtual machine anomaly detection method, comprising:

[0006] Determine the data anomaly corresponding to the user operation time series data by calculating the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine;

[0007] The operation statistics data corresponding to the virtual machine and the user operation time series data are fused to obtain information fusion features, and the fusion anomaly values ​​corresponding to the virtual machine are detected according to the information fusion features;

[0008] The operation anomaly detection result corresponding to the virtual machine is determined according to the data anomaly value and the fusion anomaly value.

[0009] In one embodiment, calculating the data anomaly value corresponding to the user operation time series data according to the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine includes:

[0010] Obtain the number of historical operations corresponding to each user operation in the user operation time series data, and obtain the total number of historical operations;

[0011] Calculate the ratio of the number of historical operations corresponding to each user operation to the total number of historical operations to obtain the historical occurrence probability value corresponding to each user operation;

[0012] The historical occurrence probability values ​​corresponding to each user operation are multiplied to obtain the data anomaly values ​​corresponding to the user operation time series data.

[0013] In one embodiment, data information is fused between the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and fusion abnormal values ​​corresponding to the virtual machine are detected according to the information fusion features, including:

[0014] Extract the features of operation statistical data and user operation time series data respectively to obtain user operation features and operation statistical features;

[0015] The user operation features are enhanced through the self-attention mechanism to obtain enhanced operation features;

[0016] The enhanced operation feature and the operation statistical feature are fused to obtain the information fusion feature;

[0017] A full connection operation is performed according to the information fusion features to obtain the fused outlier value corresponding to the virtual machine.

[0018] In one embodiment, determining an operation anomaly detection result corresponding to a virtual machine according to a data anomaly value and a fusion anomaly value includes:

[0019] The data outliers and fusion outliers are fitted according to the fitting weights to obtain the operation outliers corresponding to the virtual machine;

[0020] Based on the comparison result between the operation abnormality value and the preset operation abnormality condition, an operation abnormality detection result corresponding to the virtual machine is determined.

[0021] In one embodiment, calculating the data anomaly value corresponding to the user operation time series data according to the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine includes:

[0022] Inputting user operation time series data and user operation statistical data into a virtual machine anomaly detection model;

[0023] The data anomaly value corresponding to the user operation time series data is calculated by using the historical occurrence probability value of each user operation in the user operation time series data through the computing network in the virtual machine anomaly detection model;

[0024] The operation statistics data corresponding to the virtual machine and the user operation time series data are fused to obtain information fusion features, and the fusion anomaly values ​​corresponding to the virtual machine are detected according to the information fusion features, including:

[0025] The detection network in the virtual machine anomaly detection model fuses the corresponding operation statistics of the virtual machine and the user operation time series data to obtain information fusion features, and detects the fusion anomaly values ​​corresponding to the virtual machine according to the information fusion features;

[0026] The operation anomaly detection result corresponding to the virtual machine is determined based on the data anomaly value and the fusion anomaly value, including:

[0027] The decision network in the virtual machine anomaly detection model uses data anomalies and detection anomalies to determine the operation anomaly detection results corresponding to the virtual machine.

[0028] In one embodiment, after determining the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the detection anomaly value, the method further includes:

[0029] The operation anomaly detection result corresponding to the virtual machine is sent to the host machine, so that the host machine can perform visual display according to the operation anomaly detection result.

[0030] In a second aspect, the present application also provides a virtual machine anomaly detection device, comprising:

[0031] An anomaly calculation module, used to calculate the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine, and determine the data anomaly value corresponding to the user operation time series data;

[0032] The anomaly detection module is used to fuse the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and detect the fusion anomaly value corresponding to the virtual machine according to the information fusion features;

[0033] The result determination module is used to determine the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value.

[0034] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0035] Determine the data anomaly corresponding to the user operation time series data by calculating the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine;

[0036] The operation statistics data corresponding to the virtual machine and the user operation time series data are fused to obtain information fusion features, and the fusion anomaly values ​​corresponding to the virtual machine are detected according to the information fusion features;

[0037] The operation anomaly detection result corresponding to the virtual machine is determined according to the data anomaly value and the fusion anomaly value.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0039] Determine the data anomaly corresponding to the user operation time series data by calculating the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine;

[0040] The operation statistics data corresponding to the virtual machine and the user operation time series data are fused to obtain information fusion features, and the fusion anomaly values ​​corresponding to the virtual machine are detected according to the information fusion features;

[0041] The operation anomaly detection result corresponding to the virtual machine is determined according to the data anomaly value and the fusion anomaly value.

[0042] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0043] Determine the data anomaly corresponding to the user operation time series data by calculating the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine;

[0044] The operation statistics data corresponding to the virtual machine and the user operation time series data are fused to obtain information fusion features, and the fusion anomaly values ​​corresponding to the virtual machine are detected according to the information fusion features;

[0045] The operation anomaly detection result corresponding to the virtual machine is determined according to the data anomaly value and the fusion anomaly value.

[0046] The above-mentioned virtual machine anomaly detection method, device, computer equipment, computer-readable storage medium and computer program product determine the data anomaly value corresponding to the user operation time series data by calculating the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine. The operation statistical data corresponding to the virtual machine and the user operation time series data are subjected to data information fusion to obtain information fusion features, and the fusion anomaly value corresponding to the virtual machine is detected according to the information fusion features. The operation anomaly detection result corresponding to the virtual machine is determined according to the data anomaly value and the fusion anomaly value. That is, when detecting the operation anomaly of the virtual machine, the time series information in the user operation time series data can be used, and the characteristics of the non-time series data of the operation statistical data can be used, thereby improving the accuracy of the operation anomaly detection of the virtual machine, and further determining the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value, so that the detection result integrates the anomaly calculation result and the anomaly detection result, further improving the accuracy of the operation anomaly detection of the virtual machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A diagram of an application environment of a virtual machine anomaly detection method in an embodiment;

[0049] Figure 2 A flowchart of a method for detecting anomalies in a virtual machine according to an embodiment of the present invention is shown;

[0050] Figure 3 A schematic diagram of a process flow of data outliers in one embodiment;

[0051] Figure 4 A schematic diagram of a process of detecting a virtual machine anomaly detection model in one embodiment;

[0052] Figure 5 A schematic diagram of the structure of a decision network in a specific embodiment;

[0053] Figure 6 A schematic diagram of the architecture of a virtual machine anomaly detection model in a specific embodiment;

[0054] Figure 7 A schematic diagram of the overall architecture of anomaly detection in a specific embodiment;

[0055] Figure 8 is a schematic diagram of a process of abnormality detection in a specific embodiment;

[0056] Fig. 9 is a structural block diagram of a virtual machine anomaly detection device in an embodiment;

[0057] Fig.10 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0059] The virtual machine anomaly detection method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, a virtual machine 102 is deployed in the host machine 104. The host machine 104 can communicate with the virtual machine 102 through the network. Then the virtual machine 102 obtains the user operation time series data and operation statistics corresponding to the virtual machine, and then calculates the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine, and determines the data anomaly value corresponding to the user operation time series data. And the virtual machine 102 fuses the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain the information fusion feature, and detects the fusion anomaly value corresponding to the virtual machine according to the information fusion feature. At this time, the virtual machine 102 determines the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value. Finally, the virtual machine 102 can send the operation anomaly detection result corresponding to the virtual machine to the host machine 104 for display. Among them, the host machine 104 can be a computer device, and the computer device can be a terminal or a server. The terminal can be, but not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0060] In an exemplary embodiment, Figure 2 As shown, a virtual machine anomaly detection method is provided, and the method is applied to Figure 1 Taking a virtual machine deployed on a host machine as an example, the following steps 202 to 206 are included. Among them:

[0061] S202, determining a data anomaly value corresponding to the user operation time series data according to calculation of a historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine.

[0062] Among them, user operation refers to the operation action performed by the user on the virtual machine, for example, the user operation may include turning on the machine, starting the application in the virtual machine, logging in, checking the mailbox, browsing the web, etc. User operation time series data refers to the time series data formed by the user operation records within the target time period, and the target time period may be pre-set, such as 1 hour, one day, two days, etc. All records of user operations are arranged in chronological order to obtain user operation time series data, which is a sequence. The user operation time series data may be extracted from the log of the virtual machine.

[0063] The historical occurrence probability value refers to the probability value of the historical occurrence of the corresponding user operation, which is used to characterize the possibility of the corresponding user operation occurring in history. The higher the historical occurrence probability value, the more times the corresponding user operation occurs in the virtual machine, and the higher the historical occurrence probability value, the fewer times the corresponding user operation occurs in the virtual machine. Different user operations usually have different historical occurrence probability values.

[0064] Data outliers are used to characterize the possibility of abnormal operations in each user operation of the user operation time series data. Data outliers can be represented by data anomaly probability or data anomaly score. The higher the data outlier value, the greater the possibility that the user operations in the user operation time series data include abnormal operations. The lower the data outlier value, the smaller the possibility that the user operations in the user operation time series data include abnormal operations.

[0065] The virtual machine can obtain the corresponding user operation time series data through the log. Then calculate the historical occurrence probability value of each user operation in the user operation time series data, where the historical occurrence probability value of each user operation in a preset historical time period can be used, for example, the historical occurrence probability value in the past year. Then use the historical occurrence probability value of each user operation to calculate the data anomaly corresponding to the user operation time series data.

[0066] In some embodiments, the virtual machine can filter logs related to user operations from the logs, and form time series operation record data according to the log recording time. Among them, the time series log is a window every 2 hours, and the operation record in each window is a time series sequence, so as to obtain the time series data of each user operation. Then, the data outlier value can be calculated for each user operation time series data.

[0067] S204, fusing the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and detecting fusion anomalies corresponding to the virtual machine according to the information fusion features.

[0068] The operation statistics data refers to the statistics data obtained by counting the user's operations on the virtual machine. For example, the operation statistics data may include the number of user operations, the average time interval of user operations, the type of user operations, etc. The information fusion feature refers to the feature obtained by fusing the time series information of user operations and the statistical information of user operations.

[0069] The fused outlier value refers to the possibility of abnormal operations in each user operation in the user operation time series data obtained by using the characteristics of time series information and statistical data. The fused outlier value can be expressed by the fused anomaly probability or the fused anomaly score. The higher the fused outlier value, the greater the possibility that each user operation in the user operation time series data includes abnormal operations. The lower the fused outlier value, the lower the possibility that the user operations in the user operation time series data include abnormal operations.

[0070] The virtual machine can count the user operation records in the log and obtain operation statistics. Then the virtual machine can extract the corresponding operation statistics and user operation time series data respectively to obtain the corresponding statistical feature vectors and time series feature vectors, and then splice the statistical feature vectors and time series feature vectors to obtain information fusion features. Finally, the virtual machine uses the information fusion feature detection to obtain the fusion anomaly value corresponding to the virtual machine.

[0071] In some embodiments, the virtual machine may also extract semantic features of the user operation time series data, and then concatenate the semantic features with the statistical feature vector to obtain information fusion features.

[0072] S206: Determine an operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value.

[0073] Among them, the abnormal operation detection result is used to characterize the detection result of whether there is an abnormal operation in each user operation in the user operation time series data, which can include abnormal operation and normal operation. Abnormal operation is used to characterize that abnormal operation occurs in each user operation in the user operation time series data. Normal operation is used to characterize that each user operation in the user operation time series data is a normal operation.

[0074] In this embodiment, the virtual machine can determine the final outlier value based on the data outlier value and the fused outlier value. The data outlier value and the fused outlier value can be linearly fitted to obtain the final outlier value, or the data outlier value and the fused outlier value can be averaged to obtain the final outlier value. The final outlier value is then compared with the probability threshold. When the final outlier value is greater than or equal to the outlier threshold, the detection result is an abnormal operation. When the final outlier value is less than the outlier threshold, the detection result is a normal operation. The probability threshold can be pre-set, for example, it can be obtained through testing or set by human experience.

[0075] In some embodiments, the operation anomaly detection result may include operation anomaly, suspected anomaly and normal operation. Among them, the suspected anomaly is used to characterize that there may be abnormal operations in each user operation of the user operation time series data. Each user operation in the user operation time series data suspected of abnormality can be further detected, for example, manual detection, etc. Specifically: the virtual machine can determine the abnormal probability score based on the data abnormal value and the fused abnormal value, and then compare the abnormal probability score with the pre-set suspected abnormality score range. When the abnormal probability score is within the suspected abnormality score range, it can be determined that the operation anomaly detection result corresponding to the virtual machine is a suspected abnormality. For example, the suspected abnormality score range is [0.6,0.8), and the abnormal probability score is 0.7. At this time, the abnormal probability score is within the suspected abnormality score range, and it is determined that the operation anomaly detection result is a suspected abnormality. Then, when the abnormal probability score is not within the suspected abnormal score range, the abnormal probability score can be compared with the pre-set normal score range. When the abnormal probability score is within the normal score range, it can be determined that the operation abnormality detection result corresponding to the virtual machine is normal. For example, the normal score range is [0,0.6), and the abnormal probability score is 0.4. At this time, the abnormal probability score is within the normal score range, and the operation abnormality detection result is determined to be normal. Then, when the abnormal probability score is not within the normal score range, the abnormal probability score can be compared with the pre-set abnormal score range. When the abnormal probability score is within the abnormal score range, it can be determined that the operation abnormality detection result corresponding to the virtual machine is an operation abnormality. For example, the abnormal score range is [0.8,1], and the abnormal probability score is 0.9. At this time, the abnormal probability score is within the abnormal score range, and the operation abnormality detection result is determined to be an operation abnormality.

[0076] The above-mentioned virtual machine anomaly detection method, device, computer equipment, computer-readable storage medium and computer program product determine the data anomaly value corresponding to the user operation time series data by calculating the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine. The operation statistical data corresponding to the virtual machine and the user operation time series data are subjected to data information fusion to obtain information fusion features, and the fusion anomaly value corresponding to the virtual machine is detected according to the information fusion features. The operation anomaly detection result corresponding to the virtual machine is determined according to the data anomaly value and the fusion anomaly value. That is, when detecting the operation anomaly of the virtual machine, the time series information in the user operation time series data can be used, and the characteristics of the non-time series data of the operation statistical data can be used, thereby improving the accuracy of the operation anomaly detection of the virtual machine, and further determining the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value, so that the detection result integrates the anomaly calculation result and the anomaly detection result, further improving the accuracy of the operation anomaly detection of the virtual machine.

[0077] In order to ensure the accuracy of the test results, it is also necessary to preserve the accuracy of the calculated data outliers, so the calculation process of the data outliers is explained.

[0078] In an exemplary embodiment, Figure 3 As shown, S202, calculating the data anomaly value corresponding to the user operation time series data according to the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine, including the steps of:

[0079] S302, obtaining the number of historical operations corresponding to each user operation in the user operation time series data, and obtaining the total number of historical operations;

[0080] S304, calculating the ratio of the number of historical operations corresponding to each user operation to the total number of historical operations, and obtaining the historical occurrence probability value corresponding to each user operation;

[0081] S306, performing a product operation on the historical occurrence probability values ​​corresponding to each user operation to obtain a data anomaly value corresponding to the user operation time series data.

[0082] Among them, the virtual machine can obtain the number of occurrences of each user operation in the user operation time series data within the target time period by collecting logs, and use the number of occurrences as the number of historical operations corresponding to the user operation. Then obtain the number of occurrences corresponding to all user operations within the target time period, and then calculate the sum of the number of occurrences corresponding to all user operations to obtain the total number of historical operations. At this time, calculate the ratio of the number of historical operations of each user operation to the total number of historical operations, and obtain the historical occurrence probability value corresponding to each user operation. Finally, calculate the product of all historical occurrence probability values, and the product result is used to characterize the numerical normal value corresponding to the user operation time series data. At this time, the data normal value is calculated in reverse to obtain the data abnormal value corresponding to the user operation time series data.

[0083] For example, the Markov model can be used to calculate the data anomaly corresponding to the user operation time series data. That is, the virtual machine can input a time series consisting of a series of operation records into the Markov model. Because the user operations in the time series do not necessarily have a sequence relationship, for example, there is no definite sequence relationship between logging into the portal website first and checking emails first, but there is mutual influence in the entire time series. For example, although there is no necessary sequence relationship between logging into the portal website and checking emails, there is a high probability that they will exist in the same time series. Therefore, the Markov model will calculate the probability of occurrence of each user operation in the time series, and then calculate the probability value of the time series based on the zero-order Markov calculation, that is, the data anomaly corresponding to the user operation time series data can be calculated using the formula (1) shown below.

[0084] Formula (1)

[0085] in, is the probability of occurrence of the kth user operation in the past year. N is the number of user operations in the user operation time series data. is the normal probability corresponding to the current time series. The smaller the normal probability value, the greater the abnormal probability. The output is processed by 1-score as the data abnormal value corresponding to the final current time series. The greater the probability, the greater the abnormal probability.

[0086] In the above embodiment, by calculating the historical occurrence probability value corresponding to each user operation, and then using the historical occurrence probability value corresponding to each user operation to calculate the data anomaly value corresponding to the user operation time series data, that is, it can be calculated whether the current user operation is abnormal according to the user operation habits, thereby improving the accuracy of the obtained data anomaly value.

[0087] In an exemplary embodiment, S204, data information is fused on the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and fusion abnormal values ​​corresponding to the virtual machine are detected according to the information fusion features, including:

[0088] The features of operation statistical data and user operation time series data are extracted respectively to obtain user operation features and operation statistical features; the user operation features are enhanced through the self-attention mechanism to obtain enhanced operation features; the enhanced operation features and operation statistical features are fused to obtain information fusion features; a full connection operation is performed based on the information fusion features to obtain the fusion anomaly value corresponding to the virtual machine.

[0089] Among them, user operation features refer to feature vectors obtained by vectorizing user operation time series data, which can be embedding feature vectors. Operation statistical features refer to feature vectors obtained by vectorizing operation statistical data. Self-attention mechanism refers to Self-Attention, which is an attention mechanism that associates different positions of a single sequence to calculate the representation of the same sequence. Enhanced operation features refer to features obtained by enhancing semantic information through the self-attention mechanism.

[0090] In this embodiment, when the operation statistics data is a numerical type of data, the operation statistics data can be directly used as the operation statistics feature. Then the user operation time series data can be firstly one-hot encoded, and then encoded by vectorization parameters to obtain the output user operation feature.

[0091] For example, the input operation sequence is an n-dimensional row vector, which becomes an n*n matrix after hot encoding. The embedding parameter can be an n*k-dimensional weight matrix, and the output after embedding is an n*k-dimensional matrix. n is the length of the operation sequence, which can be the number of user operations. k is the encoding length of each user operation.

[0092] At this time, the user operation features are enhanced through the self-attention mechanism to obtain enhanced operation features. Then the enhanced operation features and the operation statistical features are spliced ​​to obtain information fusion features. For example, the enhanced operation features are n-dimensional and the operation statistical features are m-dimensional, and the obtained information fusion features are n+m-dimensional.

[0093] Finally, the information fusion feature is fully connected to obtain the fusion outlier value corresponding to the virtual machine. For example, the information fusion feature vector and the full connection parameter can be fully connected to obtain the fusion outlier value. The full connection parameter can be pre-set, obtained from a third party, trained, or pre-trained.

[0094] In the above embodiment, the user operation feature is enhanced by the self-attention mechanism to obtain the enhanced operation feature. Then, the enhanced operation feature is used to detect the fused outlier value corresponding to the virtual machine. Since richer semantic information can be extracted by the self-attention mechanism, the accuracy of the obtained fused outlier value can be improved.

[0095] In an exemplary embodiment, S206, determining the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value includes:

[0096] The data outliers and fusion outliers are fitted according to the fitting weights to obtain the operation outliers corresponding to the virtual machine; based on the comparison result between the operation outliers and the preset operation outlier conditions, the operation outlier detection result corresponding to the virtual machine is determined.

[0097] In this embodiment, the fitting weight is a pre-set weight for fitting the data outlier and the fusion outlier, including the weight corresponding to the data outlier and the weight corresponding to the fusion outlier. That is, the virtual machine can use the fitting weight to calculate the weighted sum of the data outlier and the fusion outlier to obtain the operation outlier. Then the operation outlier is compared with the preset operation outlier condition, which is a pre-set judgment condition for the abnormality of the user operation. For example, it can be a pre-set threshold of the operation outlier, or it can be a pre-set range of outlier values ​​when the operation is abnormal. Among them, when the preset operation outlier condition is met, it means that there is an abnormal user operation in the detected user operation, and the detection result of the operation outlier is obtained. When the preset operation outlier condition is not met, it means that there is no abnormal user operation in the detected user operation, and the detection result of normal operation is obtained.

[0098] In some embodiments, the data outliers and fused outliers may be normalized to obtain normalized data outliers and fused outliers. Then, the normalized data outliers and fused outliers are fitted to obtain operation outliers. For example, the Softmax function may be used to normalize the data outliers and fused outliers, and then a linear fitting function may be used to calculate the final operation anomaly probability score. The purpose of the Softmax function processing is to make the sum of the data outliers and fused outliers equal to 1. The linear fitting function may be shown as the following formula (2):

[0099] Formula (2)

[0100] in, . Score is the final operation abnormality value. is the data outlier, To fuse outliers. and is a hyperparameter that can be set according to the accuracy of the detection, for example, The value can be set to 0.35, The value can be set to 0.65. Finally, the operation anomaly detection result corresponding to the virtual machine can be determined according to the operation anomaly value.

[0101] In the above embodiment, after fitting by fitting weights, the operation anomaly detection result corresponding to the virtual machine is determined, which can solve the problem of insufficient accuracy of a single result, thereby improving the accuracy of the obtained detection result.

[0102] In order to ensure the accuracy of detection and improve the efficiency of detection, a pre-trained virtual machine anomaly detection model can be used for detection. In an exemplary embodiment, Figure 4As shown, S202, calculating the data anomaly value corresponding to the user operation time series data according to the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine, including:

[0103] S402, inputting the user operation time series data and the user operation statistical data into a virtual machine anomaly detection model;

[0104] S404, using the computing network in the virtual machine anomaly detection model to calculate the data anomaly value corresponding to the user operation time series data using the historical occurrence probability value of each user operation in the user operation time series data.

[0105] The virtual machine anomaly detection model refers to a pre-trained artificial intelligence algorithm model for anomaly detection of user operation data of a virtual machine. The virtual machine anomaly detection model can detect whether there is abnormal user operation data in the user operation time series data.

[0106] In some embodiments, the virtual machine can directly obtain the trained virtual machine anomaly detection model and use it after deployment.

[0107] In some embodiments, the virtual machine can also obtain training data, such as obtaining large training operation time series data and corresponding operation detection result labels to train the virtual machine anomaly detection model, and when the training completion condition is met, the virtual machine anomaly detection model is obtained. Then, the trained virtual machine anomaly detection model is deployed and used.

[0108] In this embodiment, when using the virtual machine anomaly detection model, the user operation time series data and the operation statistics data can be used as the input of the virtual machine anomaly detection model. The virtual machine anomaly detection model can be a two-branch model. Among them, one branch is a computing network, and the computing network can be established using a Markov model. At this time, the user operation time series data is input into the computing network, and the data anomaly value corresponding to the user operation time series data is calculated by the historical occurrence probability value of each user operation.

[0109] S204, fusing the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and detecting fusion anomalies corresponding to the virtual machine according to the information fusion features, including:

[0110] S406, performing data information fusion on the operation statistics data corresponding to the virtual machine and the user operation time series data through the detection network in the virtual machine anomaly detection model to obtain information fusion features, and detecting fusion anomaly values ​​corresponding to the virtual machine according to the information fusion features.

[0111] Among them, the detection network is another branch network in the virtual machine anomaly detection model. The detection network can be established using a deep learning algorithm, for example, it can be established using a deep learning model based on the Self-Attention mechanism. The virtual machine anomaly detection model can input operation statistics data and user operation time series data into the detection network for detection to obtain an output fused anomaly value. The detection network can first enhance the features of the user operation time series data, and then fuse it with the operation statistics data, for example, it can be spliced, or it can be weighted summed, or it can be averaged, etc., to obtain information fusion features, and finally perform full connection operations through the information fusion features to obtain fused anomalies.

[0112] S206, determining an operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value, including:

[0113] S408, determining an operation anomaly detection result corresponding to the virtual machine by using the data anomaly value and the detection anomaly value through a decision network in the virtual machine anomaly detection model.

[0114] In this embodiment, the decision network is a network for making decisions, and the test results can be obtained through the decision network. The input of the decision network is the output of the detection network and the calculation network. The decision network can use the data anomaly value and the detection anomaly value to calculate the final test result value, and the test result is determined by the test result value. For example, Figure 5 As shown, it is a schematic diagram of the structure of the decision network, where the decision network can be normalized using the formula (3) shown below, and then fitted using the linear fitting function shown in formula (2) to obtain the output probability score.

[0115] Formula (3)

[0116] Among them, e is a natural constant, zi represents the i-th value to be normalized, It means calculating the sum of all the values ​​to be normalized, and there are a total of k values ​​to be normalized.

[0117] In a specific embodiment, Figure 6As shown in the figure, a schematic diagram of the architecture of a virtual machine anomaly detection model is provided, wherein the virtual machine anomaly detection model is composed of a Markov model on the left, a deep learning model based on the Self-Attention mechanism on the right, and a decision maker at the upper layer. Then the Markov model on the left can use the user operation sequence features to calculate the output score. The deep learning model on the right takes both the time series features and the non-time series statistical features as model inputs, first vectorizes the worry sequence features through the Embeding layer, and obtains an n*k-dimensional feature matrix. Then the feature matrix is ​​input into the Attention (attention mechanism) network layer, which is based on the Self-Attention mechanism. The n k-dimensional row vectors processed by the Attention network layer are added, and finally a k-dimensional row vector is output. At this time, the feature vector after the Attention network layer and the feature vector of the statistical class can be spliced. When the time series feature vector is k-dimensional and the statistical feature vector is m-dimensional, the spliced ​​feature vector is k+m-dimensional. The concatenated feature vectors are then classified and scored through two fully connected network layers to obtain the output score of the deep learning model, where the dropout (probability of neurons being discarded) value in the two fully connected network layers is set to 0.5. At this point, the output scores of the Markov model and the deep learning model are input into the decision maker for calculation to obtain the final detection score of the output, and the abnormality level is determined based on the final detection score, for example, it can be normal, abnormal, or suspected abnormal.

[0118] In the above embodiment, the final detection result is obtained by jointly deciding the outputs of the detection network and the computing network in the virtual machine anomaly detection model, so that the detection result integrates the detection results of the two networks, thereby improving the accuracy of the detection result.

[0119] In an exemplary embodiment, after determining the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the detection anomaly value, the method further includes:

[0120] The operation anomaly detection result corresponding to the virtual machine is sent to the host machine, so that the host machine can perform visual display according to the operation anomaly detection result.

[0121] In this embodiment, the virtual machine can send the corresponding operation anomaly detection result to the host machine. The host machine receives the sent operation anomaly detection result and can visualize the operation anomaly detection result. Among them, all operation anomaly detection results can be visualized, or abnormal detection results can be displayed as alarms. For example, the virtual machine can report the abnormal virtual machine reporting service to the central management platform through the host machine for visual alarm display. The central management platform can visualize the reported alarm. That is, by visually displaying the operation anomaly detection results in the host machine, it is convenient for users to promptly discover abnormal attacks on virtual machines, thereby improving user experience.

[0122] In a specific embodiment, Figure 7 As shown, a schematic diagram of the overall architecture of anomaly detection is provided, wherein the anomaly detection mainly includes four parts: data service, detection service, reporting service and alarm display, among which:

[0123] 1. Data service: The data service is used to collect virtual machine log data, filter and process the data, and obtain user operation time series data and user operation statistics.

[0124] 2. Testing services. Figure 6 The virtual machine anomaly detection model shown provides detection services and obtains detection results. The following steps may be included:

[0125] (1) Inputting user operation time series data and user operation statistical data into the virtual machine anomaly detection model;

[0126] (2) Obtain the number of historical operations corresponding to each user operation in the user operation time series data through the computing network in the virtual machine anomaly detection model, and obtain the total number of historical operations.

[0127] (3) Calculate the ratio of the number of historical operations corresponding to each user operation to the total number of historical operations through the computing network to obtain the historical occurrence probability value corresponding to each user operation;

[0128] (4) The historical occurrence probability values ​​corresponding to each user operation are multiplied by the computing network to obtain the data anomaly value corresponding to the user operation time series data.

[0129] (5) The detection network in the virtual machine anomaly detection model is used to extract the features of the operation statistics data and the user operation time series data, respectively, to obtain the user operation features and the operation statistics features;

[0130] (6) Enhance the user operation features through the self-attention mechanism in the detection network to obtain enhanced operation features;

[0131] (7) The enhanced operation features and the operation statistical features are fused through the detection network to obtain information fusion features;

[0132] (8) The detection network performs full connection operations based on the information fusion features to obtain the fusion anomaly value corresponding to the virtual machine.

[0133] (9) The decision network in the virtual machine anomaly detection model uses fitting weights to fit the data anomaly value and the fusion anomaly value to obtain the operation anomaly value corresponding to the virtual machine. Based on the comparison result between the operation anomaly value and the preset operation anomaly condition, the operation anomaly detection result corresponding to the virtual machine is determined.

[0134] 3. Reporting service. The virtual machine uses the virtual machine reporting service to report the operation anomaly detection results to the host machine reporting center management platform for visual alarm display.

[0135] 4. Alarm display: The alarm display section can visualize the reported abnormal detection alarms.

[0136] The database can provide corresponding data for the detection service and the data service. For example, the detection service can obtain the detection data from the database, and the data service can obtain the log data from the database, etc. The data can also be stored in the database, for example, the detection results can be stored in the database. In addition, the anomaly detection of the above architecture can be deployed as an Agent (a software program or process that can perform specific tasks) in a virtual machine to perform anomaly detection as an anomaly detection function in the virtual machine, for example, Figure 8 As shown, a flowchart of anomaly detection is provided, in which the virtual machine collects logs from log files, and then processes the data to filter out operation-related time series logs and statistical data. The processed data is input into the virtual machine anomaly detection model for anomaly detection, and an alarm is reported for the detected anomaly. The virtual machine anomaly detection model uses both the zero-order Markov model and the deep learning model based on the Self-Attention mechanism for detection. In the deep learning model, the time series data of user operations and the non-time series data based on statistics are used as feature inputs. Finally, the outputs of the Markov model and the deep learning model are passed through the decision maker for abnormal decision making. The entire virtual machine anomaly detection model not only makes full use of the information of the time series features but also utilizes the characteristics of the non-time series statistical features, and at the same time utilizes the fusion of the two models, thereby improving the accuracy of detection. Compared with the detection model that only uses time series data, the detection accuracy of this application is improved by about 15%, and the accuracy can reach 95%.

[0137] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0138] Based on the same inventive concept, the embodiment of the present application also provides a virtual machine anomaly detection device for implementing the virtual machine anomaly detection method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more virtual machine anomaly detection device embodiments provided below can refer to the limitations of the virtual machine anomaly detection method above, and will not be repeated here.

[0139] In an exemplary embodiment, Fig. 9 As shown, a virtual machine anomaly detection device 900 is provided, comprising: an anomaly calculation module 902, an anomaly detection module 904 and a result determination module 906, wherein:

[0140] Anomaly calculation module 902, used to calculate the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine, and determine the data anomaly value corresponding to the user operation time series data;

[0141] The anomaly detection module 904 is used to fuse the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and detect the fusion anomaly value corresponding to the virtual machine according to the information fusion features;

[0142] The result determination module 906 is used to determine the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value.

[0143] In one embodiment, the anomaly calculation module 902 is also used to obtain the number of historical operations corresponding to each user operation in the user operation time series data, and obtain the total number of historical operations; calculate the ratio of the number of historical operations corresponding to each user operation to the total number of historical operations, and obtain the historical occurrence probability value corresponding to each user operation; perform multiplication operation on the historical occurrence probability value corresponding to each user operation to obtain the data anomaly value corresponding to the user operation time series data.

[0144] In one embodiment, the anomaly detection module 904 is also used to extract features of operation statistical data and user operation time series data respectively to obtain user operation features and operation statistical features; enhance the user operation features through a self-attention mechanism to obtain enhanced operation features; fuse the enhanced operation features and the operation statistical features to obtain information fusion features; perform a full connection operation based on the information fusion features to obtain a fusion anomaly value corresponding to the virtual machine.

[0145] In one embodiment, the result determination module 906 is also used to fit the data outliers and the fusion outliers according to the fitting weights to obtain the operation anomaly values ​​corresponding to the virtual machine; based on the comparison result between the operation anomaly values ​​and the preset operation anomaly conditions, determine the operation anomaly detection result corresponding to the virtual machine.

[0146] In one embodiment, the anomaly calculation module 902 is further used to input the user operation time series data and the user operation statistical data into the virtual machine anomaly detection model; calculate the data anomaly value corresponding to the user operation time series data using the historical occurrence probability value of each user operation in the user operation time series data through the computing network in the virtual machine anomaly detection model;

[0147] The anomaly detection module 904 is also used to fuse the operation statistics data corresponding to the virtual machine and the user operation time series data through the detection network in the virtual machine anomaly detection model to obtain information fusion features, and detect the fusion anomaly value corresponding to the virtual machine according to the information fusion features;

[0148] The result determination module 906 is further configured to determine the operation anomaly detection result corresponding to the virtual machine by using the data anomaly value and the detection anomaly value through the decision network in the virtual machine anomaly detection model.

[0149] In one embodiment, the virtual machine anomaly detection device 900 further includes:

[0150] The reporting module is used to send the operation anomaly detection result corresponding to the virtual machine to the host machine, so that the host machine can perform visual display according to the operation anomaly detection result.

[0151] Each module in the above-mentioned virtual machine anomaly detection device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0152] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.10As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device, and a virtual machine is deployed in the computer device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. When the computer program is executed by the processor, a virtual machine anomaly detection method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0153] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0154] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0155] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0156] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0157] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0158] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0159] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0160] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A virtual machine anomaly detection method, characterized in that: The method comprises: Determine, according to the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine, a data anomaly value corresponding to the user operation time series data; Performing data information fusion on the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and detecting fusion anomalies corresponding to the virtual machine according to the information fusion features; An operation anomaly detection result corresponding to the virtual machine is determined according to the data anomaly value and the fusion anomaly value.

2. The method according to claim 1, characterized in that The calculating the data anomaly value corresponding to the user operation time series data according to the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine includes: Obtain the number of historical operations corresponding to each user operation in the user operation time series data, and obtain the total number of historical operations; Calculate the ratio of the number of historical operations corresponding to each user operation to the total number of historical operations to obtain a historical occurrence probability value corresponding to each user operation; A product operation is performed on the historical occurrence probability values ​​corresponding to the user operations to obtain a data anomaly value corresponding to the user operation time series data.

3. The method according to claim 1, characterized in that The step of fusing the operation statistics data corresponding to the virtual machine with the user operation time series data to obtain information fusion features, and detecting fusion abnormal values ​​corresponding to the virtual machine according to the information fusion features includes: Extracting features of the operation statistical data and the user operation time series data respectively to obtain user operation features and operation statistical features; The user operation feature is enhanced by a self-attention mechanism to obtain an enhanced operation feature; Fusing the enhanced operation feature with the operation statistical feature to obtain an information fusion feature; A full connection operation is performed according to the information fusion feature to obtain a fusion outlier value corresponding to the virtual machine.

4. The method according to any one of claims 1 to 3, characterized in that: The determining the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value includes: Fitting the data outlier value and the fusion outlier value according to the fitting weight to obtain the operation outlier value corresponding to the virtual machine; Based on the comparison result between the operation abnormality value and the preset operation abnormality condition, an operation abnormality detection result corresponding to the virtual machine is determined.

5. The method according to claim 1, characterized in that The calculating the data anomaly value corresponding to the user operation time series data according to the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine includes: Inputting the user operation time series data and the user operation statistical data into a virtual machine anomaly detection model; Calculate the data anomaly value corresponding to the user operation time series data by using the historical occurrence probability value of each user operation in the user operation time series data through the computing network in the virtual machine anomaly detection model; The step of fusing the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and detecting fusion abnormal values ​​corresponding to the virtual machine according to the information fusion features includes: The detection network in the virtual machine anomaly detection model performs data information fusion on the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and detects the fusion anomaly value corresponding to the virtual machine according to the information fusion features; The determining the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value includes: The operation anomaly detection result corresponding to the virtual machine is determined by using the data anomaly value and the detection anomaly value through a decision network in the virtual machine anomaly detection model.

6. The method according to claim 1, characterized in that After determining the operation abnormality detection result corresponding to the virtual machine according to the data abnormality value and the detection abnormality value, the method further includes: The operation abnormality detection result corresponding to the virtual machine is sent to the host machine, so that the host machine performs a visual display according to the operation abnormality detection result.

7. A virtual machine anomaly detection device, characterized in that: The device comprises: An anomaly calculation module, used to calculate the historical occurrence probability value of each user operation in the user operation time series data corresponding to the virtual machine, and determine the data anomaly value corresponding to the user operation time series data; an anomaly detection module, used to fuse the operation statistics data corresponding to the virtual machine and the user operation time series data to obtain information fusion features, and detect fusion anomaly values ​​corresponding to the virtual machine according to the information fusion features; A result determination module is used to determine the operation anomaly detection result corresponding to the virtual machine according to the data anomaly value and the fusion anomaly value.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images