System performance anomaly detection method and device, computer equipment and readable storage medium

Abstract

The invention relates to a system performance anomaly detection method and device, computer equipment and a computer readable storage medium, and relates to the technical field of artificial intelligence. The method comprises the following steps: acquiring current performance data of multiple dimensions of a system; inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score; the trained performance anomaly detection model is obtained by training an initial teacher neural network through historical normal performance data of multiple dimensions of the system and multiple pieces of simulated anomaly performance data subjected to Gaussian distribution simulation and training an initial student neural network through historical normal performance data of multiple dimensions; and obtaining a performance anomaly detection result of the system according to the anomaly score and a preset score threshold. By adopting the method, the anomaly detection accuracy can be improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer device and computer-readable storage medium for detecting system performance anomalies. Background Art

[0002] In the current Internet environment, system performance anomalies may lead to business interruption, reduced user experience and economic losses. Timely detection and response to these anomalies can significantly reduce these risks. In related technologies, the method of using deep learning to detect system anomalies usually collects system abnormal data to train the deep learning model, and uses the trained deep learning model for system anomaly detection. However, in the actual system performance anomaly detection scenario, the system generates relatively little abnormal data, which leads to a small number of training samples for training the deep learning model, and further leads to poor performance of the trained deep learning model. Therefore, the current system performance anomaly detection method has the problem of low accuracy in detecting anomalies. Summary of the invention

[0003] Based on this, it is necessary to provide a system performance anomaly detection method, device, computer equipment and computer-readable storage medium that can improve the accuracy of anomaly detection in response to the above technical problems.

[0004] In a first aspect, the present application provides a method for detecting system performance anomalies, comprising:

[0005] Get current performance data of multiple dimensions of the system;

[0006] Inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score; the trained performance anomaly detection model is obtained by training an initial teacher neural network through the historical normal performance data of multiple dimensions of the system and multiple simulated abnormal performance data simulated by Gaussian distribution, and training an initial student neural network through the historical normal performance data of multiple dimensions;

[0007] A performance anomaly detection result of the system is obtained according to the anomaly score and a preset score threshold.

[0008] In one embodiment, inputting the current performance data of multiple dimensions into a trained performance anomaly detection model to obtain an anomaly score includes:

[0009] Inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain the intermediate layer features of the teacher neural network included in the trained performance anomaly detection model and the intermediate layer features of the student neural network included in the trained performance anomaly detection model;

[0010] According to the intermediate layer characteristics of the teacher neural network and the intermediate layer characteristics of the student neural network, the corresponding loss function value is calculated, and the loss function value is used as the abnormality score.

[0011] In one embodiment, the trained performance anomaly detection model is trained by the following method, including:

[0012] Obtain historical normal performance data of multiple dimensions of the system;

[0013] Performing Gaussian distribution simulation based on the historical normal performance data of multiple dimensions to obtain multiple simulated abnormal performance data;

[0014] The historical normal performance data and the simulated abnormal performance data are used to train the initial teacher neural network, and the historical normal performance data is used to train the initial student neural network until the preset training end conditions are met, thereby obtaining a trained performance anomaly detection model.

[0015] In one embodiment, the Gaussian distribution simulation is performed based on the historical normal performance data of multiple dimensions to obtain multiple simulated abnormal performance data, including:

[0016] According to the historical normal performance data of multiple dimensions, a performance matrix corresponding to the historical normal performance data of each dimension is constructed respectively; the performance matrix includes multiple feature vectors, each of which corresponds to an indicator included in the historical normal performance data of each dimension;

[0017] Taking each of the eigenvectors as a sample of a multidimensional Gaussian distribution, calculating the corresponding likelihood region and Gaussian distribution boundary;

[0018] According to the Gaussian distribution boundary, random sampling is performed from each of the likelihood regions to obtain a plurality of simulated abnormal performance data.

[0019] In one embodiment, taking each of the feature vectors as a sample of a multi-dimensional Gaussian distribution and calculating the corresponding likelihood region and Gaussian distribution boundary includes:

[0020] Taking each of the eigenvectors as a sample of a multidimensional Gaussian distribution, calculating the eigenmean corresponding to each of the eigenvectors and the covariance matrix between the features;

[0021] According to each of the feature means and the covariance matrix, the likelihood region and the Gaussian distribution boundary corresponding to each of the feature vectors are calculated.

[0022] In one embodiment, the initial neural network is trained using the simulated abnormal performance data and the historical normal performance data until a preset training end condition is met to obtain a trained performance anomaly detection model, including:

[0023] The initial teacher neural network is trained using the simulated abnormal performance data and the historical normal performance data until a preset training end condition is met, thereby obtaining a trained teacher neural network;

[0024] Inputting the historical normal performance data into the trained teacher neural network to obtain a plurality of first intermediate layer features output by the intermediate layer included in the trained teacher neural network;

[0025] The initial student neural network is trained using the plurality of first intermediate layer features and the historical normal performance data, and the loss function values ​​between the plurality of second intermediate layer features output by the intermediate layer included in the student neural network and the plurality of first intermediate layer features are iteratively calculated until a preset training end condition is met, thereby obtaining a trained student neural network;

[0026] The trained teacher neural network and the trained student neural network are used as a trained performance anomaly detection model.

[0027] In one of the embodiments, in the method described in any one of the above embodiments, the performance data includes one or more of processor usage, memory usage, processor performance indicators and read and write usage.

[0028] In a second aspect, the present application also provides a system performance anomaly detection device, comprising:

[0029] Data acquisition module, used to obtain current performance data of multiple dimensions of the system;

[0030] An anomaly detection module, used for inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score; the trained performance anomaly detection model is obtained by training an initial teacher neural network through historical normal performance data of multiple dimensions of the system and multiple simulated abnormal performance data simulated by Gaussian distribution, and training an initial student neural network through the historical normal performance data of multiple dimensions;

[0031] The result determination module is used to obtain the performance anomaly detection result of the system according to the anomaly score and a preset score threshold.

[0032] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0033] Get current performance data of multiple dimensions of the system;

[0034] Inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score; the trained performance anomaly detection model is obtained by training an initial teacher neural network through the historical normal performance data of multiple dimensions of the system and multiple simulated abnormal performance data simulated by Gaussian distribution, and training an initial student neural network through the historical normal performance data of multiple dimensions;

[0035] A performance anomaly detection result of the system is obtained according to the anomaly score and a preset score threshold.

[0036] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0037] Get current performance data of multiple dimensions of the system;

[0038] Inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score; the trained performance anomaly detection model is obtained by training an initial teacher neural network through the historical normal performance data of multiple dimensions of the system and multiple simulated abnormal performance data simulated by Gaussian distribution, and training an initial student neural network through the historical normal performance data of multiple dimensions;

[0039] A performance anomaly detection result of the system is obtained according to the anomaly score and a preset score threshold.

[0040] The above-mentioned system performance anomaly detection method, device, computer equipment and computer-readable storage medium obtain the current performance data of multiple dimensions of the system, provide a comprehensive performance of the system to provide a basis for subsequent anomaly monitoring, and then input the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score, wherein the trained performance anomaly detection model is obtained by training the initial teacher neural network through the historical normal performance data of multiple dimensions of the system and multiple simulated abnormal performance data simulated by Gaussian distribution, and training the initial student neural network through the historical normal performance data of multiple dimensions, and obtaining the system performance anomaly detection results according to the anomaly score and the preset score threshold. The abnormal performance detection model is trained by the historical normal performance data and the Gaussian distribution simulated performance data, which can fill the defect of less real abnormal performance data samples, thereby improving the training effect of the model and further improving the accuracy of detecting anomalies through the abnormal performance detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 1 is a flow chart of a method for detecting abnormal system performance in one embodiment;

[0043] Figure 2 A schematic diagram of a process for training a performance anomaly detection model in one embodiment;

[0044] Figure 3 A schematic diagram of a flow chart of a performance anomaly detection model training step in another embodiment;

[0045] Figure 4 A flowchart of a training method for a system performance anomaly detection tool based on abnormal data generation in one embodiment;

[0046] Figure 5 A schematic diagram of the structure of an abnormal performance detection model for a teacher-student network in one embodiment;

[0047] Figure 6 is a structural block diagram of a system performance anomaly detection device in one embodiment;

[0048] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] like Figure 1 As shown, a method for detecting abnormal system performance is provided. This embodiment uses the method applied to a terminal as an example for illustration. It can be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0051] Step S102, obtaining current performance data of multiple dimensions of the system.

[0052] Among them, performance data can be various indicators of the system that measure the operating efficiency of the computer system. They reflect key characteristics of the system such as speed, response time, resource utilization, and throughput.

[0053] Optionally, the monitoring system obtains current performance data of multiple dimensions of the system to be monitored as a basis for performance anomaly detection.

[0054] Step S104, inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score.

[0055] The trained performance anomaly detection model is obtained by training the initial teacher neural network through the system's historical normal performance data in multiple dimensions and multiple simulated abnormal performance data simulated by Gaussian distribution, and training the initial student neural network through historical normal performance data in multiple dimensions; Gaussian distribution is also called normal distribution, which is a very important continuous probability distribution in statistics and probability theory. The teacher-student neural network and the teacher-learning neural network are deep learning architectures for knowledge distillation and model compression, in which a powerful model called "Teacher" is used to guide a smaller model called "Student" to learn.

[0056] Optionally, the monitoring system inputs the current performance data of multiple dimensions into a trained performance anomaly detection model to obtain an anomaly score output by the performance anomaly detection model, which represents an anomaly assessment of the current performance data by the performance anomaly detection model.

[0057] Step S106, obtaining a performance anomaly detection result of the system according to the anomaly score and a preset score threshold.

[0058] Among them, the preset scoring threshold can be the abnormal score boundary between normal performance data and abnormal performance data obtained by fitting after comparing the abnormal score obtained after inputting the actual performance data into the initial neural network during the actual model training process and the classification label of the actual performance data.

[0059] Optionally, the monitoring system compares the abnormality score with a preset score threshold, and determines the performance abnormality detection result of the system to be monitored based on the comparison result. For example, if the abnormality score is lower than the preset score threshold, the performance of the system to be monitored is in a normal state, and if the abnormality score is higher than the preset score threshold, the performance of the system to be monitored is in an abnormal state.

[0060] In the above-mentioned system performance anomaly detection method, the current performance data of the system in multiple dimensions is obtained to provide a comprehensive performance situation of the system to provide a basis for subsequent anomaly monitoring, and then the current performance data in multiple dimensions is input into the trained performance anomaly detection model to obtain an anomaly score, wherein the trained performance anomaly detection model is obtained by training the initial teacher neural network through the historical normal performance data of multiple dimensions of the system and multiple simulated abnormal performance data simulated by Gaussian distribution, and training the initial student neural network through the historical normal performance data of multiple dimensions, and obtaining the system performance anomaly detection results according to the anomaly score and the preset score threshold. The abnormal performance detection model is trained by the historical normal performance data and the Gaussian distribution simulated performance data, which can fill the defect of less real abnormal performance data samples, thereby improving the training effect of the model and further improving the accuracy of detecting anomalies through the abnormal performance detection model.

[0061] In an exemplary embodiment, step S106 inputs the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score, including:

[0062] The current performance data of multiple dimensions are input into the trained performance anomaly detection model to obtain the intermediate layer features of the teacher neural network included in the trained performance anomaly detection model and the intermediate layer features of the student neural network included in the trained performance anomaly detection model; according to the intermediate layer features of the teacher neural network and the intermediate layer features of the student neural network, the corresponding loss function value is calculated, and the loss function value is used as the anomaly score.

[0063] Among them, the intermediate layer features (or hidden layer features) are the representations obtained after the input data is processed and transformed by the neurons in each layer. These features largely determine the learning ability of the neural network and the performance of the model.

[0064] Among them, the loss function can be a function used in machine learning and deep learning to measure the difference between the model prediction results and the actual results. In this embodiment, the intermediate layers of the teacher neural network and the student neural network correspond one to one, so the output intermediate layer features also correspond to each other. The loss function is a function that comprehensively characterizes the difference between the corresponding intermediate layer features of the two neural networks.

[0065] Optionally, the monitoring system inputs the current performance data of multiple dimensions into the trained performance anomaly monitoring model, obtains the intermediate layer features of the teacher neural network included in the trained performance anomaly monitoring model, and the intermediate layer features of the student neural network included in the trained performance anomaly monitoring model, calculates the corresponding loss function value according to the intermediate layer features of the teacher neural network and the intermediate layer features of the student neural network, and uses the loss function value as the anomaly score. The calculation method is as follows:

[0066]

[0067]

[0068]

[0069]

[0070]

[0071] in, and Represents the current performance data of the teacher neural network and the student neural network for the input The middle layer obtained Same position on the layer The middle layer features at Indicates current performance data The middle layer obtained Same position on the layer The loss of represents the average loss of all intermediate layers, h is the height of the intermediate layer, w is the width of the intermediate layer, It is the final loss function value that integrates the difference between all intermediate layer features of the teacher neural network and the student neural network.

[0072] In this embodiment, by comparing the intermediate layer features of the teacher neural network and the student neural network, the feature differences in anomaly detection can be identified, and the loss function value is used as the anomaly score. The scoring mechanism is clarified, making the anomaly detection results more interpretable. The intermediate layer features of the teacher neural network can help the student neural network to transition smoothly, enhance the model's adaptability to different types of input data, and improve the robustness of anomaly detection.

[0073] In an exemplary embodiment, Figure 2 As shown, the trained performance anomaly detection model in the above embodiment is obtained by training using the following method, including:

[0074] Step S202, obtaining historical normal performance data of multiple dimensions of the system.

[0075] The historical normal performance data may be the performance data with a normal status in the historical performance data of the system to be monitored.

[0076] Optionally, the monitoring system obtains historical normal performance data of multiple dimensions of the system to be monitored to provide a data basis for subsequent training models. Historical normal performance data of different dimensions can provide fine-grained information, which helps to better understand and judge system performance problems instead of relying solely on a single indicator.

[0077] Step S204, performing Gaussian distribution simulation based on historical normal performance data of multiple dimensions to obtain multiple simulated abnormal performance data.

[0078] Optionally, the monitoring system uses historical normal performance data of multiple dimensions as samples of a Gaussian distribution, performs Gaussian distribution simulation, performs random sampling in the simulated Gaussian distribution, and uses multiple outliers obtained by sampling as simulated abnormal performance data.

[0079] Step S206, use historical normal performance data and simulated abnormal performance data to train the initial teacher neural network, and use historical normal performance data to train the initial student neural network until the preset training end conditions are met, thereby obtaining a trained performance anomaly detection model.

[0080] The initial teacher neural network and the initial student neural network can be teacher-student neural networks, and the backbone networks of the teacher neural network and the student neural network can both adopt neural networks such as ResNet18 (18-layer deep convolutional neural network).

[0081] Optionally, the monitoring system uses simulated abnormal performance data and historical normal performance data obtained by Gaussian distribution simulation to train the initial teacher neural network, and uses historical normal performance data to train the initial student neural network until preset training end conditions are met, such as the calculated loss function value is lower than a preset threshold, or the number of iterative training reaches a preset iteration number threshold, to obtain a trained performance anomaly detection model.

[0082] In this embodiment, the historical normal performance data of the system to be monitored is used as samples of the Gaussian distribution, and random sampling is performed on the Gaussian distribution to obtain simulated abnormal performance data that deviates from the normal data. The initial teacher neural network is trained according to the historical normal performance data and the simulated abnormal performance data, and the initial student neural network is trained with the historical normal data. This solves the problem of the system's actual historical abnormal performance data samples being small, provides sufficient training data for model training, thereby improving the effect of model training and further improving the accuracy of subsequent anomaly detection using anomaly detection models.

[0083] In an exemplary embodiment, step S204 performs Gaussian distribution simulation based on historical normal performance data of multiple dimensions to obtain multiple simulated abnormal performance data, including:

[0084] According to the historical normal performance data of multiple dimensions, the performance matrix corresponding to the historical normal performance data of each dimension is constructed respectively; each eigenvector is used as a sample of the multidimensional Gaussian distribution, and the corresponding likelihood region and Gaussian distribution boundary are calculated; according to the Gaussian distribution boundary, random sampling is performed from each likelihood region to obtain multiple simulated abnormal performance data.

[0085] The performance data includes one or more of the CPU (Central Processing Unit) processor usage, memory usage, processor performance index, and read / write usage of the system to be monitored. The performance matrix includes multiple eigenvectors, each of which corresponds to an index included in the historical normal performance data of each dimension.

[0086] The Gaussian distribution boundary can be the range of values ​​corresponding to a specific probability value (such as confidence level, such as 95%) defined under the Gaussian distribution. This is usually used to determine the range of values ​​of the random variable X at a certain confidence level.

[0087] Among them, the likelihood region can be the ϵ-likelihood region, which is a region defined based on the marginal likelihood, representing the set of all parameters (or states) that make the likelihood function sufficiently close to the maximum likelihood value given the observed data x, and is usually used to reflect the uncertainty of the model parameters.

[0088] Optionally, based on the historical normal performance data of multiple dimensions, a performance matrix corresponding to the historical normal performance data of each dimension is constructed respectively, for example, the performance matrix It consists of n types of performance data. Represents the eigenvector of the i-th performance category. Let N be 4. The performance matrix includes 4 performance categories, namely CPU utilization, memory utilization, CPU performance index, and I / O usage. Then, the corresponding performance matrices are constructed respectively: The performance matrix of CPU utilization is ,in, represents the jth indicator of performance 1, where Indicates CPU usage. Indicates the total number of CPUs. represents the utilization rate of the jth CPU; the performance matrix of memory utilization is ,in, represents the kth indicator of performance 2, where , They represent total memory usage, free memory, cache and buffer memory, shared memory, used memory, available memory, total swap space, and used swap space respectively; the performance matrix of CPU performance indicators is , represents the lth indicator of performance 3, where , They represent the percentage of CPU occupied by user space, the percentage of CPU occupied by system kernel space, the percentage of CPU occupied by user processes used for nice operations, the percentage of idle CPU, the percentage of CPU time waiting for input and output (I / O), the percentage of CPU time processing hardware interrupts, the percentage of CPU time processing software interrupts, and the percentage of CPU time stolen by virtualization. If there is disks, then , Indicates The I / O performance of the disks, the performance matrix of the disk I / O performance is: , Indicates Disk No. performance indicators, here They represent the number of transmissions completed per second, the amount of data read from the device per second, the amount of data written to the device per second, the amount of data discarded per second, the total amount of data read from the device, and the total amount of data written to the device.

[0089] In addition, the constructed performance matrix must be standardized to obtain a standardized input, and the performance matrix P is standardized into an N×M matrix. ,in For each sample, if the dimension of the feature is less than M, zero padding can be used to make the length of the feature vector reach M. The resulting standardized matrix is, . In which, each vector is completed to a vector with a modulus length of M.

[0090] Furthermore, the monitoring system treats each feature vector as a sample of a multidimensional Gaussian distribution, such as the standardized performance matrix Each column in represents a sample of a multidimensional Gaussian distribution, that is, each is an m-dimensional vector, representing the value of m features. The corresponding likelihood region and Gaussian distribution boundary are calculated, and random sampling is performed from each likelihood region according to the Gaussian distribution boundary. The sampled outliers should be as close to the Gaussian distribution boundary as possible to obtain multiple simulated abnormal performance data.

[0091] In this embodiment, by constructing a performance matrix, the system can accurately capture the relationship between different indicators in the performance data to improve the effect of subsequent model training. Through standardization, the influence of different dimensions and scales between various performance data categories is eliminated, making model training more stable and effective. Random sampling based on the Gaussian distribution boundary and likelihood region to obtain simulated performance data can improve the similarity between simulated abnormal performance data and actual abnormal performance data, and can also improve the effect of subsequent model training, and further improve the accuracy of abnormal detection of the monitoring system using the abnormal detection model.

[0092] In an exemplary embodiment, each feature vector is used as a sample of a multi-dimensional Gaussian distribution, and the corresponding likelihood region and Gaussian distribution boundary are calculated, including:

[0093] Each eigenvector is taken as a sample of multidimensional Gaussian distribution, and the feature mean corresponding to each eigenvector and the covariance matrix between each feature are calculated; based on each feature mean and covariance matrix, the likelihood region and Gaussian distribution boundary corresponding to each eigenvector are calculated.

[0094] The feature mean may be the average value of each feature in the training data set.

[0095] Among them, the covariance matrix can be an important tool to describe the relationship between features, and can reflect the variability and correlation between different features.

[0096] Optionally, the monitoring system uses each eigenvector as a sample of a multidimensional Gaussian distribution, and calculates the eigenvalue corresponding to each eigenvector and the covariance matrix between each feature. The corresponding calculation method is: if a vector There are m features, then the i-th element of the mean vector μ is the average value of all samples on the i-th feature, calculated as follows:

[0097]

[0098] Among them, μ is an m-dimensional vector representing the mean of each feature.

[0099] The covariance matrix Σ describes the correlation and variation between the features. The i-th row and j-th column of the covariance matrix represent the covariance between the i-th feature and the j-th feature. The calculation formula is as follows:

[0100]

[0101] Where Σ is an m×m matrix, representing the covariance matrix.

[0102] Furthermore, according to each feature mean and covariance matrix, the likelihood region and Gaussian distribution boundary corresponding to each eigenvector are calculated, and random sampling is performed from the likelihood region. The corresponding sampling formula is:

[0103]

[0104] in, represents the sampled outlier of the eigenvector of the i-th type, where It should be small enough to ensure that the sampled points are close to the boundary of the Gaussian distribution.

[0105] In this embodiment, the covariance matrix provides quantitative information on the linear relationship and variability between features, which helps to understand the mutual influence between different features. The decision boundary can be calculated using the Gaussian distribution characteristics, and the feature vector can be divided into normal and abnormal states, so that when random sampling is performed, simulated abnormal performance data that is more similar to the actual abnormal performance data can be obtained.

[0106] In an exemplary embodiment, Figure 3 As shown, step S206 uses historical normal performance data and simulated abnormal performance data to train the initial teacher neural network, and uses historical normal performance data to train the initial student neural network until the preset training end condition is met, and a trained performance anomaly detection model is obtained, including:

[0107] Step S302, using simulated abnormal performance data and historical normal performance data to train the initial teacher neural network until the preset training end conditions are met, thereby obtaining a trained teacher neural network.

[0108] Among them, the preset training end condition can be that the number of training iterations reaches a preset threshold, or the loss function of the teacher neural network during training is lower than a preset function threshold. The preset function threshold can be set according to actual training needs and the desired model accuracy.

[0109] Optionally, the teacher neural network in the initial neural network is trained using simulated abnormal performance data and historical normal performance data to achieve binary classification, so that the teacher neural network has the ability to distinguish between normal performance data and abnormal performance data. During the training process, it is necessary to adjust the last fully connected layer in the initial neural network and adjust its output node number to 2 to adapt to the binary classification task, ensure that the initial neural network output is suitable for a specific classification task, and calculate the loss function value of the teacher neural network to characterize the difference between the abnormal judgment result of the teacher neural network on the training data and the actual classification label of the training data. The cross entropy loss function can be used. In the formula of the cross entropy loss function, class represents the actual category label, that is, the true category of the sample. In the binary classification task, class usually takes the value of 0 or 1, corresponding to two categories (such as "abnormal data" and "normal data"). When calculating the cross entropy loss, the probability distribution of the model output is compared with the true category label to measure the difference between the model prediction and the true label. Then, select a suitable optimizer to optimize the model parameters, such as Stochastic Gradient Descent (SGD) and other optimizers. During the training process, it is necessary to iterate the data set, calculate the loss between the model output and the true label, and update the model parameters according to the loss value until the set training rounds are reached to ensure model convergence and meet the preset training end conditions to obtain a trained performance anomaly detection model.

[0110] Step S304, inputting the historical normal performance data into the trained teacher neural network to obtain a plurality of first intermediate layer features output by the intermediate layer included in the trained teacher neural network.

[0111] Optionally, the historical normal performance data is input into the trained teacher neural network to extract the first intermediate layer features on the normal data. These features can be the output of the hidden layer or the representation of other layers, and usually capture the abstract features of the data. Here, this embodiment selects the difference of each layer of features.

[0112] Step S306, use multiple first intermediate layer features and historical normal performance data to train the student neural network in the initial neural network, iteratively calculate the loss function value between multiple second intermediate layer features output by the intermediate layer included in the student neural network and multiple first intermediate layer features, until the preset training end conditions are met, and a trained student neural network is obtained.

[0113] Optionally, a student neural network is constructed, where the same network structure as the teacher neural network is used as the student neural network. Intermediate layer feature distillation: The first intermediate layer features extracted by the teacher neural network on normal data are used as "soft targets" and historical normal performance data to train the student neural network. In this way, the second intermediate layer features output by the student neural network can simulate the first intermediate layer features of the teacher neural network as much as possible during the learning process, so that the student neural network also has the same feature expression of normal data as the teacher neural network, and the loss function value obtained by comprehensively calculating the difference between the first intermediate layer features and the second intermediate layer features. When the loss function is lower than the preset function threshold, the student neural network is iteratively trained until the preset training end condition is met to obtain a trained student neural network. It should be noted that the iteration number threshold set in the training end condition of the student neural network can be the same as or different from the iteration number threshold set in the training end condition of the teacher neural network. There is no specific limitation on this, and it is set according to actual training needs.

[0114] Step S308, using the trained teacher neural network and the trained student neural network as a trained performance anomaly detection model.

[0115] Optionally, the trained teacher neural network and the trained student neural network are used together as a trained performance anomaly detection model for subsequent anomaly detection through abnormal differences between multiple layers of intermediate features.

[0116] In this embodiment, since the student neural network is "guided" by the teacher neural network during the training phase, the student neural network has the same feature representation of normal data as the teacher neural network. As for abnormal data samples, since the initial parameters of the student neural network are randomly obtained, their feature representations of abnormal samples are likely to be different. Therefore, when the system is monitored for abnormal data, the abnormal difference between the teacher neural network and the student neural network multiple feature layers is calculated as the abnormal score. As long as the final abnormal score exceeds the set threshold, it means that the test data belongs to abnormal performance data. That is, when the abnormal interpolation output by the network after the test input data x is greater than the threshold, this data is abnormal performance data and should be the focus of the tester. The threshold can be determined by inputting normal data and simulated abnormal data into the abnormal detection model. The set threshold should be satisfied so that all simulated abnormal data are identified. Among all the values ​​that meet the conditions, the smallest integer can be selected as the final threshold value.

[0117] In an exemplary embodiment, Figure 4 As shown, a training method for a system performance anomaly detection tool based on abnormal data generation is provided, comprising:

[0118] Step 1: Construct a training sample set.

[0119] Exemplarily, obtain the historical normal performance data of the system to be tested, such as CPU usage, memory usage, CPU performance indicators, I / O usage and other N performance data. Construct the collected N performance data into a performance matrix containing N performance categories, where each performance data includes several evaluation indicators. Standardize the performance matrix into an N×M matrix, and use zero padding to complete each vector into a vector with a modulus length of M.

[0120] Step 2: Generate abnormal performance data.

[0121] For example, a Gaussian distribution assumption is made, the matrix is ​​assumed to be a sample of a multidimensional Gaussian distribution, and the mean vector μ and the covariance matrix Σ are calculated. Outliers are sampled from the estimated multivariate distribution, that is, outliers are randomly sampled from the ϵ-likelihood region as outliers, ensuring that the sampling points are close to the boundary of the Gaussian distribution.

[0122] Step 3: Build an anomaly detection model.

[0123] For example, a neural network such as ResNet18 is used as the backbone network, and the teacher network is trained using the collected normal data and simulated abnormal data to distinguish normal and abnormal data. The student network is trained through the intermediate layer features of the teacher network on the normal data. During testing, the output difference between the teacher network and the student network at each intermediate feature layer is used as the abnormality score.

[0124] Step 4: Iteratively train the anomaly detection model.

[0125] Exemplarily, the teacher network is adjusted to achieve binary classification, using the cross entropy loss function and the stochastic gradient descent (SGD) optimizer. The intermediate layer features of the teacher network are extracted and a student network with the same structure as the teacher network is constructed. The intermediate layer features of the teacher network are used as soft targets, and a suitable loss function (such as mean square error loss) is selected, and multi-scale feature differences are used for training. The student network parameters are optimized using a suitable optimization algorithm (such as SGD). In combination with the principle of knowledge distillation, the teacher-student network anomaly detection framework is used to detect abnormal data. Both the student network and the teacher network use ResNet18 as the backbone network, such as Figure 5As shown in the figure, a structural diagram of the abnormal performance detection model of the teacher-student network is provided. The method adopted is based on an unsupervised strategy. The core implementation is to use the collected normal data and simulated abnormal data to train the teacher network so that it has the ability to "see a lot", that is, to distinguish normal data from abnormal data. Then, by distilling the intermediate layer features of the teacher network on normal data, a student network is trained to identify normal data. During the test, the test performance data is sent to the teacher network and the student network respectively, and the feature differences output by them in each intermediate feature layer are combined as an abnormal score to evaluate whether the performance data to be tested is abnormal performance data.

[0126] Step 5: Detect abnormal performance data.

[0127] Exemplarily, during abnormal performance detection, the difference between the teacher network and the student network feature layer is calculated, and an abnormality is indicated if it exceeds a set threshold. The threshold can be determined by normal data and simulated abnormal data to ensure that all simulated abnormal data are identified.

[0128] In this embodiment, by collecting historical normal performance data, a standardized N×M performance matrix is ​​created, and outliers are sampled using a multi-dimensional Gaussian distribution to simulate abnormal data. A teacher-student network architecture is used to train an anomaly detection model through a knowledge distillation method, so that the student network can learn effective feature representations from the teacher network, and use features at different levels for comprehensive analysis to score anomalies to improve the accuracy and robustness of detection. There is no need to collect actual abnormal data, and simulated abnormal data is generated from normal data, which reduces the complexity of data collection and labeling. The teacher-student network architecture improves the anomaly recognition ability of the student network through knowledge distillation, enabling it to effectively capture and detect abnormal data. The method of integrating multi-layer feature differences effectively reduces false positives and false negatives by analyzing data from multiple dimensions and levels, and improves the overall performance of the detection model.

[0129] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0130] Based on the same inventive concept, the embodiment of the present application also provides a system performance anomaly detection device for implementing the system performance anomaly detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more system performance anomaly detection device embodiments provided below can refer to the limitations of the system performance anomaly detection method above, and will not be repeated here.

[0131] In an exemplary embodiment, Figure 6 As shown, a system performance anomaly detection device 600 is provided, comprising: a data acquisition module 602, an anomaly detection module 604 and a result determination module 606, wherein:

[0132] The data acquisition module 602 is used to acquire current performance data of multiple dimensions of the system.

[0133] The anomaly detection module 604 is used to input the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score; the trained performance anomaly detection model is obtained by training the initial teacher neural network through the system's historical normal performance data of multiple dimensions and multiple simulated abnormal performance data simulated by Gaussian distribution, and by training the initial student neural network through the historical normal performance data of multiple dimensions.

[0134] The result determination module 606 is used to obtain the performance anomaly detection result of the system according to the anomaly score and the preset score threshold.

[0135] Furthermore, in one embodiment, the result determination module 606 is also used to input the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain the intermediate layer features of the teacher neural network included in the trained performance anomaly detection model, and the intermediate layer features of the student neural network included in the trained performance anomaly detection model; according to the intermediate layer features of the teacher neural network and the intermediate layer features of the student neural network, the corresponding loss function value is calculated, and the loss function value is used as the anomaly score.

[0136] Furthermore, in one embodiment, the system performance anomaly detection device 600 also includes a model training module, which is used to obtain historical normal performance data of multiple dimensions of the system; perform Gaussian distribution simulation based on the historical normal performance data of multiple dimensions to obtain multiple simulated abnormal performance data; use the historical normal performance data and the simulated abnormal performance data to train the initial teacher neural network, and use the historical normal performance data to train the initial student neural network until the preset training end conditions are met, thereby obtaining a trained performance anomaly detection model.

[0137] Furthermore, in one embodiment, the model training module is also used to construct a performance matrix corresponding to the historical normal performance data of each dimension based on the historical normal performance data of multiple dimensions; the performance matrix includes multiple eigenvectors, and each eigenvector corresponds to the indicators included in the historical normal performance data of each dimension; each eigenvector is used as a sample of a multi-dimensional Gaussian distribution, and the corresponding likelihood region and Gaussian distribution boundary are calculated; according to the Gaussian distribution boundary, random sampling is performed from each likelihood region to obtain multiple simulated abnormal performance data.

[0138] Furthermore, in one embodiment, the model training module is also used to take each eigenvector as a sample of a multidimensional Gaussian distribution, calculate the feature mean corresponding to each eigenvector and the covariance matrix between each feature; and calculate the likelihood region and Gaussian distribution boundary corresponding to each eigenvector based on each feature mean and covariance matrix.

[0139] Furthermore, in one embodiment, the model training module is also used to train the initial teacher neural network using simulated abnormal performance data and historical normal performance data until a preset training end condition is met to obtain a trained teacher neural network; input the historical normal performance data into the trained teacher neural network to obtain a plurality of first intermediate layer features output by the intermediate layer included in the trained teacher neural network; use the plurality of first intermediate layer features and the historical normal performance data to train the student neural network in the initial neural network, iteratively calculate the loss function value between the plurality of second intermediate layer features output by the intermediate layer included in the student neural network and the plurality of first intermediate layer features until a preset training end condition is met to obtain a trained student neural network; use the trained teacher neural network and the trained student neural network as a trained performance anomaly detection model.

[0140] Each module in the above-mentioned system performance anomaly detection device 600 can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0141] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 7As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as current performance data, abnormal scores and preset score thresholds. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a system performance anomaly detection method is implemented.

[0142] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0143] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0144] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0145] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0146] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0147] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0148] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be construed as limiting the scope of the present application. It should be noted that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for detecting abnormal system performance, characterized in that: The method comprises: Get current performance data of multiple dimensions of the system; Inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score; the trained performance anomaly detection model is obtained by training an initial teacher neural network through the historical normal performance data of multiple dimensions of the system and multiple simulated abnormal performance data simulated by Gaussian distribution, and training an initial student neural network through the historical normal performance data of multiple dimensions; A performance anomaly detection result of the system is obtained according to the anomaly score and a preset score threshold.

2. The method according to claim 1, characterized in that The step of inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score includes: Inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain the intermediate layer features of the teacher neural network included in the trained performance anomaly detection model and the intermediate layer features of the student neural network included in the trained performance anomaly detection model; According to the intermediate layer characteristics of the teacher neural network and the intermediate layer characteristics of the student neural network, the corresponding loss function value is calculated, and the loss function value is used as the abnormality score.

3. The method according to claim 1, characterized in that The trained performance anomaly detection model is trained by the following method, including: Obtain historical normal performance data of multiple dimensions of the system; Performing Gaussian distribution simulation based on the historical normal performance data of multiple dimensions to obtain multiple simulated abnormal performance data; The historical normal performance data and the simulated abnormal performance data are used to train the initial teacher neural network, and the historical normal performance data is used to train the initial student neural network until the preset training end conditions are met, thereby obtaining a trained performance anomaly detection model.

4. The method according to claim 3, characterized in that The Gaussian distribution simulation is performed according to the historical normal performance data of multiple dimensions to obtain multiple simulated abnormal performance data, including: According to the historical normal performance data of multiple dimensions, a performance matrix corresponding to the historical normal performance data of each dimension is constructed respectively; the performance matrix includes multiple feature vectors, each of which corresponds to an indicator included in the historical normal performance data of each dimension; Taking each of the eigenvectors as a sample of a multidimensional Gaussian distribution, calculating the corresponding likelihood region and Gaussian distribution boundary; According to the Gaussian distribution boundary, random sampling is performed from each of the likelihood regions to obtain a plurality of simulated abnormal performance data.

5. The method according to claim 4, characterized in that The method of taking each of the feature vectors as a sample of a multidimensional Gaussian distribution and calculating the corresponding likelihood region and Gaussian distribution boundary includes: Taking each of the eigenvectors as a sample of a multidimensional Gaussian distribution, calculating the eigenmean corresponding to each of the eigenvectors and the covariance matrix between the features; According to each of the feature means and the covariance matrix, the likelihood region and the Gaussian distribution boundary corresponding to each of the feature vectors are calculated.

6. The method according to claim 3, characterized in that The use of the historical normal performance data and the simulated abnormal performance data to train the initial teacher neural network, and the use of the historical normal performance data to train the initial student neural network until a preset training end condition is met, to obtain a trained performance anomaly detection model, includes: The initial teacher neural network is trained using the simulated abnormal performance data and the historical normal performance data until a preset training end condition is met, thereby obtaining a trained teacher neural network; Inputting the historical normal performance data into the trained teacher neural network to obtain a plurality of first intermediate layer features output by the intermediate layer included in the trained teacher neural network; The initial student neural network is trained using the plurality of the first intermediate layer features and the historical normal performance data, and the loss function values ​​between the plurality of second intermediate layer features output by the intermediate layer included in the student neural network and the plurality of the first intermediate layer features are iteratively calculated until a preset training end condition is met, thereby obtaining a trained student neural network; The trained teacher neural network and the trained student neural network are used as a trained performance anomaly detection model.

7. The method according to any one of claims 1 to 6, characterized in that: The performance data includes one or more of processor usage, memory usage, processor performance index, and read / write usage.

8. A system performance anomaly detection device, characterized in that: The device comprises: Data acquisition module, used to obtain current performance data of multiple dimensions of the system; An anomaly detection module, used for inputting the current performance data of multiple dimensions into the trained performance anomaly detection model to obtain an anomaly score; the trained performance anomaly detection model is obtained by training an initial teacher neural network through historical normal performance data of multiple dimensions of the system and multiple simulated abnormal performance data simulated by Gaussian distribution, and training an initial student neural network through the historical normal performance data of multiple dimensions; The result determination module is used to obtain the performance anomaly detection result of the system according to the anomaly score and a preset score threshold.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images