Host load anomaly detection method and system, electronic equipment and storage medium

Abstract

The invention provides a host load anomaly detection method and system, electronic equipment and a storage medium, and relates to the technical field of network engineering. The method comprises the following steps: acquiring monitoring index data of a target host; performing type classification on the monitoring index data according to a fixed index, a non-black and non-white index and a dynamic change index, and constructing a data set under the corresponding classification; and inputting the monitoring index data classified into the dynamic change indexes into an anomaly detection model for detection so as to understand position information in a corresponding data sequence through position coding, learning representation of an input sequence by using a multi-head self-attention mechanism of a Transform encoder and a full-connection feedforward network, and outputting an anomaly judgment result through a linear layer and a softmax layer. According to the technical scheme, the host load abnormity can be quickly and accurately detected.

Description

Technical Field

[0001] The present application relates to the field of network engineering technology, and in particular to a host load anomaly detection method, system, electronic device and storage medium. Background Art

[0002] Host load anomaly detection refers to the real-time or periodic analysis of various monitoring indicators during the operation of the host to identify status changes that exceed the normal range or indicate potential failures, so as to take timely measures to avoid system crashes or performance degradation.

[0003] At present, the existing host load anomaly detection mainly determines the host load anomaly by setting fixed threshold indicators for automatic triggering or manual checking. This not only requires high technical and experience requirements for operators, but also with the rapid growth of the number of hosts and applications in enterprise network systems and the complexity of network environments, security issues are becoming increasingly prominent. Fixed thresholds and manual judgment methods can no longer meet the needs of host load anomaly detection in the current complex and changeable network environment. Summary of the invention

[0004] The purpose of the present application is to provide a host load anomaly detection method, system, electronic device and storage medium, which can quickly and accurately detect host load anomalies.

[0005] This application is implemented as follows:

[0006] In the first aspect, the present application provides a host load anomaly detection method, comprising the following steps: obtaining monitoring indicator data of the target host; classifying the monitoring indicator data according to fixed indicators, black-and-white indicators, and dynamically changing indicators, and constructing data sets under the corresponding classifications; inputting the monitoring indicator data classified into the dynamically changing indicators into the anomaly detection model for detection, so as to understand the position information in the corresponding data sequence through position encoding, using the multi-head self-attention mechanism of the Transformer encoder and the fully connected feedforward network to learn the representation of the input sequence, and outputting the anomaly judgment result through the linear layer and the softmax layer. This technical solution can quickly and accurately detect host load anomalies.

[0007] In some implementations, the monitoring indicator data is classified into types such as fixed indicators, black-and-white indicators, and dynamically changing indicators, and a data set under the corresponding classification is constructed, including: sorting the same indicator data in the monitoring indicator data classified as dynamically changing indicators according to timestamps, supplementing historical values ​​for the same period as feature dimensions, performing normalization processing at the same time, and constructing a corresponding data set through a sliding window method.

[0008] In some implementations, when some values ​​are missing in the sliding window, data of the most recent timestamp before the timestamp of the missing data is copied for filling.

[0009] In some implementations, the anomaly detection model includes: a model input part, which uses position encoding to generate a position vector for each position of the input monitoring indicator data; a model main body part, which uses a Transformer encoder, each encoder layer includes two sub-layers, namely a multi-head self-attention mechanism and a fully connected feedforward network, and the sub-layers are connected to each other through residual connections and layer normalization layers; a model output part, which processes the output of the encoder through a linear layer and a softmax layer to output anomaly judgment results.

[0010] In some implementations, monitoring indicator data classified into fixed indicators are used for display in response to display instructions, and indicators classified into black-and-white categories are used for sequential detection through the Prometheus database.

[0011] In some implementations, the fixed indicators include the total memory size of the server, the number of CPU cores, and the system activation time; the black-and-white indicators include detection of activity, downtime, and network connectivity; and the dynamically changing indicators include CPU usage, real-time I / O rate, and real-time upstream and downstream traffic transmission rates.

[0012] In the second aspect, the present application provides a host load anomaly detection system, which includes: a probe module for obtaining monitoring indicator data of a target host; an indicator alarm configuration module for configuring indicators to be monitored and rules for triggering alarms; an anomaly identification module for receiving the monitoring indicator data obtained by the probe module, and classifying the monitoring indicator data according to fixed indicators, black-and-white indicators, and dynamically changing indicators, and constructing data sets under corresponding categories; and inputting the monitoring indicator data classified into dynamically changing indicators into an anomaly detection model for detection, so as to understand the position information in the corresponding data sequence through position encoding, use the multi-head self-attention mechanism of the Transformer encoder and the fully connected feedforward network to learn the representation of the input sequence, and output the anomaly judgment result through the linear layer and the softmax layer.

[0013] In some implementations, the system further includes: a message notification module, configured to send notification information to a predetermined person when the abnormality identification module triggers an alarm.

[0014] In a third aspect, the present application provides an electronic device, comprising a memory for storing one or more programs; a processor; when the one or more programs are executed by the processor, a method as described in any one of the first aspects is implemented.

[0015] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method as described in any one of the above-mentioned first aspects.

[0016] Compared with the prior art, the present invention has at least the following advantages or beneficial effects:

[0017] This application proposes a host load anomaly detection method, which first obtains comprehensive monitoring indicator data of the target host, which is the basis for subsequent analysis and detection. Then, according to the characteristics and importance of the monitoring indicator data, it is divided into fixed indicators, black-and-white indicators, and dynamically changing indicators, and the corresponding data sets are constructed. Then, for the dynamically changing indicators, anomaly detection is performed based on the anomaly detection model. This model uses position encoding to understand the position information in the data sequence, and learns the deep representation of the input sequence through a multi-head self-attention mechanism and a fully connected feedforward network, so as to capture the correlation and trend between the data. Finally, the abnormal judgment results are output through the linear layer and the softmax layer to achieve fast and accurate recognition of anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 This is a flow chart of an embodiment of a host load abnormality detection method of the present application;

[0020] Figure 2 This is a schematic diagram of an anomaly detection model in one embodiment of the present application;

[0021] Figure 3 This is an operation flow chart of a host load anomaly detection system in one embodiment of the present application;

[0022] Figure 4 A structural block diagram of an electronic device provided in an embodiment of the present application.

[0023] Icon: 201, processor; 202, memory; 203, communication interface. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0025] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0026] Example 1

[0027] Currently, host load anomaly detection mainly relies on the following methods:

[0028] Threshold determination method: Set a fixed threshold for each monitoring indicator, and trigger an alarm when the indicator value exceeds or falls below the threshold. This method is simple and intuitive, but it is difficult to adapt to dynamically changing load conditions, and the setting of thresholds often relies on manual experience and lacks flexibility.

[0029] Statistical method: Use historical data to calculate the mean, standard deviation and other statistics of the indicator, and judge the anomaly by comparing the difference between the current value and the statistics. Although the volatility of the data is taken into account, the contextual information and long-term trend of the time series data are ignored.

[0030] In general, existing technologies mainly rely on setting fixed threshold indicators for automatic triggering or manual checking for judgment. However, with the rapid growth of the number of hosts and applications in enterprise network systems and the increasing complexity of network environments, this traditional detection method has gradually exposed its limitations. Fixed thresholds are difficult to adapt to the dynamic changes in host loads, while manual judgment requires high skills and experience from operators, and it is difficult to cope with large-scale, high-frequency anomaly detection needs.

[0031] In this regard, an embodiment of the present application provides a host load anomaly detection method, which can quickly and accurately detect host load anomalies.

[0032] See also Figure 1 The host load anomaly detection method comprises the following steps:

[0033] Step S101: Obtain monitoring index data of the target host;

[0034] It should be noted that various monitoring indicator data, such as CPU usage, memory occupancy, disk I / O, etc., can be obtained from the target host through monitoring tools or API interfaces by periodic polling or real-time monitoring.

[0035] Step S102: classify the monitoring indicator data into fixed indicators, black-and-white indicators, and dynamically changing indicators, and construct data sets under corresponding categories;

[0036] It should be noted that the above steps will classify the acquired monitoring indicator data according to their characteristics and importance, which will facilitate the subsequent processing of different monitoring indicator data. The classification standards include fixed indicators, black-and-white indicators, and dynamically changing indicators. Fixed indicators usually refer to those indicators that do not change significantly over time, such as the hardware configuration of the host; black-and-white indicators have clear thresholds, and once they exceed or fall below the threshold, they are considered abnormal; and dynamically changing indicators are those indicators that change over time and have no fixed pattern, such as CPU usage.

[0037] That is, the above steps can divide the acquired monitoring indicator data of the target host into three categories: the first category is fixed indicators, such as the total memory size of the server, the number of CPU cores, the system activation time and other fixed query information. This type of information does not need to be configured with alarm information and is only used for display purposes; the second category is black-and-white indicators, such as live detection, downtime, network connectivity, etc. This type of information is configured with alarm indicators through the Prometheus database to detect anomalies; the third category is dynamically changing indicators, such as CPU usage, real-time I / O rate, real-time upstream and downstream traffic transmission rate, etc. This type of information can be configured with alarm indicators through the Prometheus database to detect anomalies, while segmenting and processing the data, and passing it into the anomaly detection model for detection, so as to make anomaly judgments faster and more accurately;

[0038] Please continue reading Figure 1 , Step S103: Input the monitoring indicator data classified into the dynamic change indicator into the anomaly detection model for detection, so as to understand the position information in the corresponding data sequence through position encoding, use the multi-head self-attention mechanism of the Transformer encoder and the fully connected feedforward network to learn the representation of the input sequence, and output the anomaly judgment result through the linear layer and the softmax layer. This technical solution can quickly and accurately detect host load anomalies.

[0039] It should be noted that for dynamic change indicators, this application uses an anomaly detection model for detection. The anomaly detection model uses a Transformer encoder structure, uses position encoding to capture the position information in the data sequence, and combines a multi-head self-attention mechanism and a fully connected feedforward network to learn the deep representation of the input sequence. In this way, the model can more accurately understand the correlation and trend between data, thereby more effectively detecting anomalies.

[0040] That is, in order to address the problem that some host load data often changes periodically with date and time due to factors such as people's objective activity patterns, the multi-head self-attention mechanism can deeply explore the correlation between host load indicators, thereby realizing automatic identification and alarm of abnormal activities. For highly concealed network attacks, Trojans and other malicious software, multi-dimensional features can still be used to intelligently identify host load indicators that are different from normal patterns, thereby improving the host load monitoring capabilities and facilitating the use of operators.

[0041] In summary, this application first obtains comprehensive monitoring indicator data of the target host, which is the basis for subsequent analysis and detection. Then, according to the characteristics and importance of the monitoring indicator data, it is divided into fixed indicators, black-and-white indicators, and dynamically changing indicators, and the corresponding data sets are constructed. Then, for the dynamically changing indicators, anomaly detection is performed based on the anomaly detection model. The model uses position encoding to understand the position information in the data sequence, and learns the deep representation of the input sequence through a multi-head self-attention mechanism and a fully connected feedforward network, so as to capture the correlation and trend between the data. Finally, the abnormal judgment results are output through the linear layer and the softmax layer to achieve rapid identification of anomalies.

[0042] Based on the aforementioned scheme, in some implementation methods of the present application, the monitoring indicator data is classified into types according to fixed indicators, black-and-white indicators, and dynamically changing indicators, and a data set under the corresponding classification is constructed, including: sorting the same indicator data in the monitoring indicator data classified into dynamically changing indicators according to timestamps, supplementing historical values ​​of the same period as feature dimensions, performing normalization processing at the same time, and constructing the corresponding data set through a sliding window method.

[0043] In the above implementation, the monitoring indicator data is first classified according to the indicator type. The same indicator data is sorted by timestamp and supplemented with yesterday's value, last week's value, last month's value, and last year's value. Nt ), yesterday's value (x Yt ), last week's value (x LWt ), last month's value (x LMt ), last year's value (x LYt ) are 5-dimensional features, whether the host load is normal is the output result, and the sequence data of the host load indicator is sampled by sliding window to construct the data set x t =

[0044] x Nt , x Yt , x LWt , x LMt , x LYt ). At the same time, the host load time series data is normalized:

[0045]

[0046] Among them, Γ represents a sequence data of a training input host load indicator, and ∈′ represents a small constant vector to prevent the denominator from being zero. For some missing values ​​in the window, the method of copying the data of the most recent timestamp before the missing data timestamp is used to fill them. If the data of the previous timestamp is also missing, it is necessary to continue searching forward until a non-missing value is found.

[0047] like Figure 2 As shown, in some implementations of the present application, the anomaly detection model includes: a model input part, which uses position encoding to generate a position vector for each position of the input monitoring indicator data; a model main body part, which uses a Transformer encoder, and each encoder layer includes two sub-layers, namely a multi-head self-attention mechanism and a fully connected feedforward network, and the sub-layers are connected to each other through residual connections and layer normalization layers; a model output part, which processes the output of the encoder through a linear layer and a softmax layer to output an anomaly judgment result.

[0048] It should be noted that as monitoring indicator data is time series data, the order of the data (i.e., position information) is very important. However, unlike recurrent neural networks (RNNs) or long short-term memory networks (LSTMs), Transformer itself does not have the ability to process sequence data. Therefore, in order to introduce position information, the anomaly detection model uses position encoding. Position encoding is a fixed-size vector that is associated with each position of the input data and provides the anomaly detection model with information about the position of the data in the sequence. These position vectors are added to the embedded representation of the input data and together serve as the input of the Transformer encoder.

[0049] The Transformer encoder is the main part of the anomaly detection model, which is composed of multiple encoder layers stacked together. Each encoder layer contains two main sublayers:

[0050] 1) Multi-head self-attention mechanism: The multi-head self-attention mechanism allows the model to pay attention to other positions in the input sequence while processing each input position. It captures the complex relationship between the input data by splitting the input data into multiple "heads" (i.e., multiple different attention mechanisms) and calculating the attention weights between these heads in parallel. This mechanism enables the model to learn the dependencies between different parts of the input data, even if they are far apart in the sequence.

[0051] 2) Fully connected feed-forward network: The second sub-layer in each encoder layer is a fully connected feed-forward network. This network further processes the representation of each position and outputs a new representation. This new representation will be passed to the next encoder layer (if it exists) or as the output of the final encoder.

[0052] To improve the model training process, the output of each sub-layer is added to the input through a residual connection (also known as a skip connection) and then normalized through a layer normalization layer. This structure helps prevent the gradient vanishing or exploding problem of the anomaly detection model during training and accelerates the convergence of the anomaly detection model.

[0053] The final output of the encoder is passed to a linear layer, which maps the output of the encoder to the desired output dimension (usually the number of categories for anomaly detection). The softmax layer then converts the output of the linear layer into a probability distribution, representing the probability of each category (i.e., normal or abnormal). Finally, the model outputs the anomaly judgment result based on the probability distribution.

[0054] That is to say, in the above anomaly detection model, the input data generates a position vector for each position through positional encoding, so that the model can understand the position information in the monitoring indicator data sequence. The main body of the anomaly detection model uses the encoder part of the Transformer. Each encoder layer contains two sublayers, namely the multi-head self-attention mechanism and the fully connected feedforward network. These sublayers are connected to each other through residual connections and layer normalization layers to help the encoder better learn the representation of the input sequence. Among them, the multi-head self-attention mechanism is used to model the dependencies between the positions in the input sequence. Through the self-attention mechanism, the anomaly detection model can simultaneously consider the information of all positions in the input sequence, so as to better capture the global dependencies. Introducing residual connections between the input and output of each sublayer and applying layer normalization after the output can alleviate the gradient vanishing and exploding problems and accelerate the training process. Finally, the output of the encoder is processed by the linear layer and the softmax layer. The linear layer flattens the attention value from the neural network. Softmax normalizes the attention weights and transforms the output of the linear layer into a probability distribution while ensuring that they sum to 1.

[0055] For a given training input host load time series data Γ, Γ =

[0056] x1, x2, x3, ..., x T}, where T is the timestamp length of the sequence data. For an unseen test time series Γ' with a length of T' and the same modality as the training sequence, it is necessary to predict y = {y1, y2, y3, ..., x T′}, where y t ∈{0, 1} to represent the tt of the test set h Whether the data point at the timestamp is abnormal (1 indicates an abnormal data point).

[0057] In summary, this anomaly detection model leverages the power of the Transformer architecture to handle anomaly detection tasks in time series data. By introducing positional encoding to capture the location information of the data, using a multi-head self-attention mechanism to capture the complex relationships between the data, and improving the model training process through residual connections and layer normalization, this anomaly detection model can learn the potential patterns and regularities in the input data and accurately determine whether the data is abnormal. This anomaly detection model has significant advantages in processing large-scale, high-dimensional time series data.

[0058] Example 2

[0059] The present application provides a host load anomaly detection system, which includes:

[0060] The probe module is used to obtain the monitoring indicator data of the target host; the indicator alarm configuration module is used to configure the indicators to be monitored and the rules for triggering alarms; the anomaly recognition module is used to receive the monitoring indicator data obtained by the probe module, and classify the monitoring indicator data according to fixed indicators, black-and-white indicators, and dynamically changing indicators, and construct data sets under corresponding categories; and input the monitoring indicator data classified into dynamically changing indicators into the anomaly detection model for detection, so as to understand the position information in the corresponding data sequence through position encoding, use the multi-head self-attention mechanism of the Transformer encoder and the fully connected feedforward network to learn the representation of the input sequence, and output the anomaly judgment result through the linear layer and the softmax layer.

[0061] For the specific implementation process of the above system, please refer to the host load anomaly detection method provided in Example 1, which will not be repeated here.

[0062] In some implementations of the present application, the system further includes: a message notification module, configured to send notification information to a predetermined person when the abnormality identification module triggers an alarm.

[0063] In some implementations of the present application, the system further includes: an indicator alarm display module, which is used to display the indicators configured by the indicator alarm configuration module.

[0064] During deployment, the probe module needs to be installed on the target server and communicate with other modules deployed on the application server through the computer network to implement the dispatch of various tasks and data upload. Figure 3 shown.

[0065] Example 3

[0066] See also Figure 4 , the embodiment of the present application provides an electronic device, which includes at least one processor 201 and at least one memory 202; wherein the processor 201 and the memory 202 are directly connected to each other, or communicate with each other through a communication interface 203, or are electrically connected through one or more communication buses or signal lines to achieve data transmission or interaction; the memory 202 stores program instructions that can be executed by the processor 201, and the processor 201 calls the program instructions to execute a host load abnormality detection method. For example, the following is implemented:

[0067] Obtain the monitoring indicator data of the target host; classify the monitoring indicator data into fixed indicators, black-and-white indicators, and dynamically changing indicators, and construct data sets under the corresponding categories; input the monitoring indicator data classified into dynamically changing indicators into the anomaly detection model for detection, so as to understand the position information in the corresponding data sequence through position encoding, use the multi-head self-attention mechanism of the Transformer encoder and the fully connected feedforward network to learn the representation of the input sequence, and output the anomaly judgment result through the linear layer and the softmax layer. This technical solution can quickly and accurately detect host load anomalies.

[0068] Among them, the memory 202 can be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc.

[0069] The processor 201 may be an integrated circuit chip with signal processing capability. The processor 201 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0070] Understandably, Figure 4 The structure shown is for illustration only. The electronic device may also include Figure 4 More or fewer components as shown, or with Figure 4 Different configurations are shown. Figure 4 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0071] Example 4

[0072] The present application provides a computer-readable storage medium having a computer program stored thereon, which implements a host load anomaly detection method when executed by the processor 201. For example, the following is implemented:

[0073] Obtain the monitoring indicator data of the target host; classify the monitoring indicator data into fixed indicators, black-and-white indicators, and dynamically changing indicators, and construct data sets under the corresponding categories; input the monitoring indicator data classified into dynamically changing indicators into the anomaly detection model for detection, so as to understand the position information in the corresponding data sequence through position encoding, use the multi-head self-attention mechanism of the Transformer encoder and the fully connected feedforward network to learn the representation of the input sequence, and output the anomaly judgment result through the linear layer and the softmax layer. This technical solution can quickly and accurately detect host load anomalies.

[0074] If the above functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0075] It will be apparent to those skilled in the art that the present application is not limited to the details of the exemplary embodiments described above, and that the present application can be implemented in other specific forms without departing from the spirit or essential features of the present application. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the present application is defined by the appended claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims be included in the present application. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A method for detecting abnormal host load, characterized in that: The following steps are involved: Obtain monitoring indicator data of the target host; Classify monitoring indicator data into fixed indicators, black-and-white indicators, and dynamically changing indicators, and construct data sets under corresponding categories; The monitoring indicator data classified into the dynamic change indicator category is input into the anomaly detection model for detection, so as to understand the position information in the corresponding data sequence through position encoding, use the multi-head self-attention mechanism of the Transformer encoder and the fully connected feedforward network to learn the representation of the input sequence, and output the anomaly judgment result through the linear layer and the softmax layer.

2. The method according to claim 1, characterized in that The monitoring indicator data is classified into fixed indicators, black-and-white indicators, and dynamically changing indicators, and data sets under corresponding categories are constructed, including: The same indicator data in the monitoring indicator data classified as dynamic change indicators are sorted according to timestamps, supplemented with historical values ​​of the same period as feature dimensions, and normalized at the same time, and the corresponding data set is constructed through a sliding window method.

3. The method according to claim 2, characterized in that When some values ​​are missing in the sliding window, the data of the most recent timestamp before the missing data timestamp is copied to fill the missing data.

4. The method according to claim 1, characterized in that: The anomaly detection model includes: In the model input part, position encoding is used to generate a position vector for each position of the input monitoring indicator data; The main part of the model uses the Transformer encoder. Each encoder layer consists of two sub-layers, namely the multi-head self-attention mechanism and the fully connected feed-forward network. The sub-layers are connected to each other through residual connections and layer normalization layers. In the output part of the model, the output of the encoder is processed through the linear layer and the softmax layer to output the abnormal judgment result.

5. The method according to claim 1, characterized in that The monitoring indicator data classified into fixed indicators are used to respond to display instructions for display, and the indicators classified into black-and-white indicators are used for sequential detection through the Prometheus database.

6. The method according to claim 1, characterized in that The fixed indicators include the total server memory size, the number of CPU cores and the system activation time; the black-and-white indicators include detection of activity, downtime and network connectivity; the dynamically changing indicators include CPU usage, real-time I / O rate and real-time upstream and downstream traffic transmission rates.

7. A host load anomaly detection system, characterized in that: include: Probe module, used to obtain monitoring indicator data of the target host; The indicator alarm configuration module is used to configure the indicators that need to be monitored and the rules for triggering alarms; The anomaly recognition module is used to receive the monitoring indicator data obtained by the probe module, and classify the monitoring indicator data into fixed indicators, black-and-white indicators, and dynamically changing indicators, and construct data sets under corresponding categories; and input the monitoring indicator data classified into dynamically changing indicators into the anomaly detection model for detection, so as to understand the position information in the corresponding data sequence through position encoding, use the multi-head self-attention mechanism of the Transformer encoder and the fully connected feedforward network to learn the representation of the input sequence, and output the anomaly judgment result through the linear layer and the softmax layer.

8. The system according to claim 7, characterized in that The system further comprises: The message notification module is used to send notification information to the scheduled personnel when the abnormal identification module triggers an alarm.

9. An electronic device, characterized in that: include: A memory for storing one or more programs; processor; When the one or more programs are executed by the processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images