Model training method, database state detection method, device and equipment

Abstract

The invention provides a model training method, a database state detection method, a device and equipment. Relates to the technical field of computers. The method comprises the steps of obtaining target feature data of a database in a historical period, wherein the target feature data is data of features related to a database state; sample data can be constructed according to the target feature data and a database state corresponding to the target feature data, and the database state comprises database abnormity or database normality; and training the initial model according to the sample data to obtain a database state detection model. Wherein the initial model is constructed after result amplification processing is carried out on a Bayesian classifier. The database state is subjected to anomaly detection through the database state detection model obtained through training, and the timeliness of detection can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a model training method, a database status detection method, a device and equipment. Background Art

[0002] In information system management, it is crucial to keep the database running normally. A well-functioning database can not only ensure the high availability and excellent performance of the system, thereby ensuring the smooth progress of business processes and avoiding downtime and data loss caused by system failures, but also support real-time decision-making and analysis and speed up task response by providing reliable data access and processing capabilities. In addition, a properly functioning database can also simplify operation and maintenance work and reduce losses caused by emergency fault repairs.

[0003] In the related art, manual methods are usually used to comprehensively analyze the characteristic data of the database during operation to determine whether the database is abnormal. However, this method of relying on manual analysis of characteristic data requires database operation and maintenance personnel to spend a lot of time to accurately identify and interpret various complex database characteristic data, resulting in poor timeliness of database anomaly detection. Summary of the invention

[0004] The present application provides a model training method, a database status detection method, an apparatus and a device to improve the timeliness of anomaly detection on a database.

[0005] In a first aspect, the present application provides a model training method, comprising:

[0006] Acquire target feature data of the database in a historical period, wherein the target feature data is feature data related to the database state;

[0007] Constructing sample data according to the target feature data and a database state corresponding to the target feature data, wherein the database state includes a database abnormality or a database normality;

[0008] The initial model is trained according to the sample data to obtain a database status detection model, wherein the initial model is constructed after amplifying the results of the Bayesian classifier.

[0009] In a possible implementation, obtaining target feature data from a database within a historical period includes:

[0010] According to the acquired target feature, data corresponding to the target feature is screened out from the original feature data of the database in the historical period to obtain original target feature data, wherein the correlation between the target feature and the database state is greater than a preset threshold;

[0011] The original target feature data is preprocessed to obtain the target feature data, wherein the preprocessing includes at least one of the following: removing duplicate data, filling missing data, and data standardization.

[0012] In a possible implementation, the step of filtering out data corresponding to the target feature from the original feature data in the database within the historical period according to the acquired target feature to obtain the original target feature data includes:

[0013] According to the mutual information or chi-square test tool, at least one feature whose correlation with the database state is greater than the preset threshold is selected from the features of the database as the target feature;

[0014] The feature data corresponding to the target feature is screened out from the original feature data in the database within the historical period to obtain the original target feature data.

[0015] In a possible implementation, the characteristics of the database include: CPU characteristics, memory characteristics, disk characteristics, and SQL task processing characteristics.

[0016] In a possible implementation, the target features include the following features:

[0017] A first time duration ratio of a CPU usage rate in a CPU feature being greater than a first preset threshold, and / or a second time duration ratio of a CPU usage rate being greater than a second preset threshold;

[0018] a third duration percentage during which the memory usage rate in the memory feature is greater than a third preset threshold, and / or a fourth duration percentage during which the memory usage rate is greater than a fourth preset threshold;

[0019] a fifth duration ratio during which the disk load in the disk feature is greater than a fifth preset threshold, and / or a sixth duration ratio during which the disk load is greater than a sixth preset threshold;

[0020] The average running time of SQL tasks in the SQL task processing characteristics and / or the median running time of SQL tasks.

[0021] In a possible implementation manner, training the initial model according to the sample data to obtain a database status detection model includes:

[0022] Processing the target feature data in the sample data according to the initial model to obtain a database prediction state;

[0023] Determine the database prediction accuracy by comparing the database prediction state with the database state corresponding to the target feature data;

[0024] When the database prediction accuracy is greater than a preset accuracy threshold, the database state detection model is obtained.

[0025] In a second aspect, the present application provides a database status detection method, comprising:

[0026] Acquire current feature data of features related to the state in the database during the current period;

[0027] Inputting the current feature data into a database status detection model to perform database status detection to obtain a detection result, wherein the detection result is used to indicate whether the status of the database in the current period is normal or abnormal;

[0028] The database status detection model is trained according to the method described in any one of the first aspects.

[0029] In a third aspect, the present application provides a model training device, comprising:

[0030] An acquisition module, used to acquire target feature data of the database in a historical period, wherein the target feature data is feature data related to the database state;

[0031] A first processing module, configured to construct sample data according to the target feature data and a database status corresponding to the target feature data, wherein the database status includes a database abnormality or a database normality;

[0032] The second processing module is used to train the initial model according to the sample data to obtain a database status detection model, wherein the initial model is constructed after amplifying the results of the Bayesian classifier.

[0033] In a fourth aspect, the present application provides a database status detection device, including:

[0034] An acquisition module, used to acquire current feature data of features related to the state in the database during the current period;

[0035] A processing module, used for inputting the current feature data into a database status detection model to perform database status detection to obtain a detection result, wherein the detection result is used to indicate whether the status of the database in the current period is normal or abnormal;

[0036] The database status detection model is trained according to the method described in any one of the first aspects.

[0037] In a fifth aspect, the present application provides an electronic device, including: a memory, a processor;

[0038] The memory stores computer-executable instructions;

[0039] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the model training method described in any one of the first aspects or the database status detection method described in the second aspect.

[0040] In a sixth aspect, the present application provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, they are used to implement the model training method as described in any one of the first aspect or the database status detection method as described in the second aspect.

[0041] In a seventh aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the model training method as described in any one of the first aspect or the database status detection method as described in the second aspect.

[0042] The present application provides a model training method, a database status detection method, an apparatus and a device. The electronic device can obtain target feature data of a database in a historical period, construct sample data according to the target feature data and the database status corresponding to the target feature data, and train the initial model constructed after the result amplification processing of the sample data Bayesian classifier to obtain a database status detection model; the database status detection model obtained by training processes the current feature data of the features related to the status of the database in the current period to obtain a detection result indicating whether the status of the database in the current period is normal or abnormal, thereby improving the timeliness of abnormality detection on the database. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] Figure 1 A schematic diagram of an application scenario provided by an embodiment of the present application;

[0045] Figure 2 Schematic diagram of the model training method provided in the embodiment of the present application Figure 1 ;

[0046] Figure 3 Schematic diagram of the model training method provided in the embodiment of the present application Figure 2 ;

[0047] Figure 4 Schematic diagram of the model training method provided in the embodiment of the present application Figure 3 ;

[0048] Figure 5 A flowchart of a database status detection method provided in an embodiment of the present application;

[0049] Figure 6 A flowchart of an example of a database status detection method provided in an embodiment of the present application;

[0050] Figure 7 A schematic diagram of the structure of a model training device provided in an embodiment of the present application;

[0051] Figure 8 A schematic diagram of the structure of a database status detection device provided in an embodiment of the present application;

[0052] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0053] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0054] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0055] First, the terms involved in this application are explained:

[0056] Bayesian classifier: A statistical classification method based on Bayesian theorem, which classifies by calculating the probability of feature attributes appearing in different categories. The main idea is to use Bayesian theorem in probability theory to predict the probability of a sample of unknown category belonging to each category, and assign the sample to the category with the highest probability.

[0057] SQL task: refers to the calculation or data processing operation triggered by the Structured Query Language (SQL) query or command.

[0058] Mutual Information: A measure based on information theory that measures the degree of mutual dependence between two random variables. It quantifies the amount of information contained in one variable about another variable and is often used in feature selection to determine which features have a strong association with the target variable.

[0059] Chi-square test: A method used to test the independence between two categorical variables. It determines whether there is a significant association between the variables by comparing the observed frequency with the expected frequency.

[0060] In modern information system management, the normal operation of the database is the cornerstone of the successful operation of an enterprise or organization. With the acceleration of digital transformation, data has become one of the most important assets of an enterprise. As a core component of data storage and management, the performance and stability of the database directly affect the efficiency and reliability of business processes.

[0061] A well-functioning database can quickly retrieve and update data, support complex queries and data analysis, and enable enterprises to make wise decisions in a rapidly changing market environment. Through real-time data processing capabilities, enterprises can better monitor operational conditions, identify potential problems, and quickly take corrective measures to ensure the smooth progress of business processes and improve overall operational efficiency.

[0062] In related technologies, database anomaly detection usually relies on manual methods, that is, database operation and maintenance personnel conduct a comprehensive analysis of the characteristic data during operation to determine whether there are anomalies. However, this method of relying on manual analysis of characteristic data requires operation and maintenance personnel to have deep professional knowledge and rich experience in order to accurately identify and interpret various complex database characteristic data. In addition, operation and maintenance personnel also need to spend a lot of time processing and analyzing this data, which leads to poor timeliness of database anomaly detection.

[0063] In response to the above problems, the inventors consider that the current feature data of the features related to the state of the database in the current time period can be processed through a database state detection model to obtain a model output result, thereby determining whether the database is abnormal. Specifically, the target feature data of the database in the historical time period can be obtained, and sample data can be constructed based on the target feature data and the database state corresponding to the target feature data; the initial model constructed after the result amplification processing of the Bayesian classifier is performed based on the sample data to obtain a database state detection model, and then the current feature data of the features related to the state of the database in the current time period can be processed according to the database state detection model to obtain an output result of whether the database is abnormal, so as to improve the timeliness of database anomaly detection. Based on this, the present application provides a model training method and a database state detection method, which improves the timeliness of database anomaly detection by training a successfully trained database state detection model.

[0064] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of the present application. Figure 1, the current feature data of the features related to the state of the database in the current time period can be obtained, and the current feature data can be input into the database state detection model for processing to obtain the detection result. According to the detection result, it can be determined whether the state of the database in the current time period is normal or abnormal.

[0065] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0066] The technical solution of this application mainly involves two processes, namely the process of model training and the process of using the model. Figure 2 ,First, the process of model training is explained.

[0067] Figure 2 Schematic diagram of the model training method provided in the embodiment of the present application Figure 1 . See Figure 2 , the method comprising:

[0068] S201. Obtain target feature data from a database within a historical period.

[0069] The execution subject of the embodiment of the present application may be an electronic device, or a model training device provided in the electronic device. The model training device may be implemented by software, or by a combination of software and hardware. The model training device may be a processor in the electronic device. For ease of understanding, the following description is made by taking the execution subject as an electronic device as an example.

[0070] In this step, the electronic device may obtain target feature data in a historical period in the database by performing a specific query operation, where the target feature data is feature data related to the database state.

[0071] In an optional embodiment, the electronic device can connect to a server that stores feature data of a database, and by constructing an SQL query statement containing a time range and target features, request the server to return data records that meet these conditions; after receiving the query request, the server can search in the data set it stores and return a matching result set.

[0072] Optionally, the characteristics of the database may include CPU characteristics, memory characteristics, disk characteristics, and SQL task processing characteristics.

[0073] Specifically, the CPU characteristics may include: average CPU usage, maximum CPU usage, minimum CPU usage, a first duration ratio when the CPU usage is greater than a first preset threshold, and a second duration ratio when the CPU usage is greater than a second preset threshold;

[0074] The memory characteristics may include: average memory usage, maximum memory usage, minimum memory usage, a third duration percentage when the memory usage is greater than a third preset threshold, and a fourth duration percentage when the memory usage is greater than a fourth preset threshold;

[0075] The disk characteristics may include: average disk load, maximum disk load, minimum disk load, a fifth duration ratio when the disk load is greater than a fifth preset threshold, and a sixth duration ratio when the disk load is greater than a sixth preset threshold;

[0076] The SQL task processing characteristics may include: the maximum number of SQL tasks processed by a data node, the minimum number of SQL tasks processed by a data node, the average SQL task running time, and the median SQL task running time;

[0077] The average running time of SQL tasks refers to the average running time of all SQL tasks in a period of time. Specifically, the running time of all SQL tasks can be added up and then divided by the total number of SQL tasks.

[0078] The median duration of a SQL task can refer to the middle value after sorting the running time of all SQL tasks. If the number of tasks is an even number, it is the average of the two middle values.

[0079] In an optional implementation, the database may be composed of multiple servers, each of which may serve as a data node. The maximum value of the number of SQL tasks processed by a data node may refer to the maximum value of the number of SQL tasks processed by each server in a period of time; the minimum value of the number of SQL tasks processed by a data node may refer to the minimum value of the number of SQL tasks processed by each server in a period of time.

[0080] In a specific implementation, the feature related to the database state is selected from the features of the database. In a specific implementation, at least one feature whose correlation with the database state is greater than a preset threshold can be selected as the target feature based on the mutual information or chi-square test tool.

[0081] For example, four features whose correlation with the database status is greater than a preset threshold can be selected as target features based on mutual information. The four features can be the first duration percentage when the CPU usage is greater than the first preset threshold, the third duration percentage when the memory usage is greater than the third preset threshold, the fifth duration percentage when the disk load is greater than the fifth preset threshold, and the average running time of the SQL task.

[0082] Optionally, the historical period may include multiple ones, and the target feature data in each historical period may be acquired respectively. For example, 100 historical periods may be included, and the electronic device may acquire the target feature data in historical periods 1, ..., and historical period 100 respectively.

[0083] Exemplarily, four target feature data of the database in the historical period 1 may be obtained, and each target feature and target feature data may be as shown in Table 1:

[0084] Table 1

[0085]

[0086]

[0087] Optionally, the first preset threshold, the third preset threshold, and the fifth preset threshold may be the same, for example, the first preset threshold, the third preset threshold, and the fifth preset threshold may all be 75%.

[0088] That is, on September 1, 2024, within the 10 minutes from 8:00 to 8:10, the first period when the CPU usage is greater than 75% accounts for 10%, the third period when the memory usage is greater than 75% accounts for 20%, and the fifth period when the disk load is greater than 75% accounts for 40%. The average running time of the SQL task is 10s. Among them, the first period is 1 minute, the third period is 2 minutes, and the fifth period is 4 minutes.

[0089] S202: Construct sample data according to the target feature data and the database status corresponding to the target feature data.

[0090] In this step, the electronic device can construct sample data according to the acquired target feature data and the database status corresponding to the calibrated target feature data, wherein the database status includes database abnormality or database normality.

[0091] In an optional implementation, the database state to be calibrated may be determined based on the database state in the next period immediately following the historical period, wherein the length of the next period may be set based on database performance monitoring requirements or business requirements.

[0092] For example, multiple sample data may be constructed based on target feature data of the database in multiple historical time periods, and each sample data may include the target feature data of the database in a historical time period and the database state corresponding to the calibrated target feature data.

[0093] S203: Train the initial model according to the sample data to obtain a database status detection model.

[0094] In this step, after constructing a plurality of sample data, an initial model constructed after a result amplification processing of the Bayesian classifier can be trained according to the plurality of sample data to obtain a database status detection model.

[0095] In the Bayesian classifier model, for any sample X∈R m , the low-dimensional representation is V = (V1,…V n ). Where n<<m. If the features of all databases in V are relatively independent, the Bayesian classifier can be obtained as:

[0096]

[0097] In formula (1), H V Represents the output result of the Bayesian classifier; i represents the feature number; n represents the number of features.

[0098] In an optional implementation, the value of y can be set to 1 to indicate that the database is abnormal; the value of y can be set to 0 to indicate that the database is normal. y∈{0,1} is a binary variable.

[0099] In a specific implementation, in order to prevent data underflow, the Bayesian classifier can be amplified to obtain an initial model. Specifically, the initial model can be obtained by dividing the normal response value by the abnormal response value and taking the logarithm of the obtained response value result.

[0100]

[0101] In formula (2), Π represents a product.

[0102] Data underflow means that the output result of the Bayesian classifier is close to zero and cannot be accurately represented within the floating-point representation range of the computer.

[0103] For example, the initial model constructed after the result amplification processing of the Bayesian classifier can be trained according to the constructed multiple sample data to obtain the database status detection model.

[0104] In an embodiment of the present application, the electronic device can obtain the target feature data of the database in the historical period, and construct a training sample based on the target feature data and the database state corresponding to the target feature data. Then, the initial model constructed after the Bayesian classifier is amplified by the training sample is trained to obtain a database state detection model for detecting the database state. In the above process, a database state detection model for database anomaly detection can be obtained by model training, thereby improving the timeliness of database anomaly detection.

[0105] Figure 3 Schematic diagram of the model training method provided in the embodiment of the present application Figure 2 . See Figure 3 In this embodiment, Figure 2 Based on the embodiment, the model training method is described in detail, and the method includes:

[0106] S301. According to the acquired target features, data corresponding to the target features are screened out from the original feature data in the database within a historical period to obtain original target feature data.

[0107] In this step, the electronic device can select at least one feature whose correlation with the database state exceeds a preset threshold as a target feature. Then, according to the selected target feature, the electronic device extracts corresponding data from the original feature data of the database in the historical period, thereby obtaining the original target feature data.

[0108] For example, the preset threshold is 50%. If the correlation between the first time period when the CPU usage is greater than the first preset threshold and the database status is 80%, then the first time period when the CPU usage is greater than the first preset threshold can be selected as the target feature. Then, based on the first time period when the CPU usage is greater than the first preset threshold, the corresponding data is extracted from the original feature data of the database in the historical period, thereby obtaining the original target feature data.

[0109] For example, the target feature can be the first duration ratio of the CPU usage greater than the first preset threshold, and the original target feature data in 100 historical time periods. Specifically, the obtained original target feature and its corresponding original target feature data can be shown in Table 2:

[0110] Table 2

[0111]

[0112] In an optional implementation, when the correlation between the target feature and the database state exceeds a preset threshold, the target feature that can be selected from the features of the database includes the following features:

[0113] A first time duration ratio of a CPU usage rate in a CPU feature being greater than a first preset threshold, and / or a second time duration ratio of a CPU usage rate being greater than a second preset threshold;

[0114] a third duration percentage during which the memory usage rate in the memory feature is greater than a third preset threshold, and / or a fourth duration percentage during which the memory usage rate is greater than a fourth preset threshold;

[0115] a fifth duration ratio during which the disk load in the disk feature is greater than a fifth preset threshold, and / or a sixth duration ratio during which the disk load is greater than a sixth preset threshold;

[0116] The average running time of SQL tasks in the SQL task processing characteristics and / or the median running time of SQL tasks.

[0117] Similarly, the first preset threshold, the third preset threshold, and the fifth preset threshold may be the same. For example, the first preset threshold, the third preset threshold, and the fifth preset threshold may all be 75%;

[0118] The second preset threshold, the fourth preset threshold, and the sixth preset threshold may be the same. For example, the second preset threshold, the fourth preset threshold, and the sixth preset threshold may all be 99%;

[0119] It should be noted that the first preset threshold, the second preset threshold, the third preset threshold, the fourth preset threshold, the fifth preset threshold, and the sixth preset threshold may also take different values ​​according to the specific requirements of the database, performance indicators, historical data analysis results, or application scenarios. The settings of these thresholds can be flexibly adjusted to adapt to different database environments and detection targets, thereby optimizing database performance.

[0120] Optionally, the SQL task includes any of the following: a query task, a data operation task, a data analysis task, a database management task, a data migration task, or a data cleaning task. For example, SQL task 1 may be to create a table, SQL task 2 may be to insert data into the table, and SQL task 3 may be to query data from the table.

[0121] S302: Preprocess the original target feature data to obtain target feature data.

[0122] In this step, the original target feature data may be preprocessed to obtain the target feature data, wherein the preprocessing includes at least one of the following: removing duplicate data, filling missing data, and data standardization.

[0123] For example, in the historical period 1 and the historical period 2 in Table 2, the original target feature data is consistent and is duplicate data, so only the target feature data corresponding to the historical period 1 or the historical period 2 can be retained;

[0124] For another example, in historical period 5 of Table 2, the original target feature data is null, and the target feature data can be filled by filling the missing data. Optionally, the average value of 40% of the target feature data of historical period 4 and 60% of the target feature data of historical period 6 can be selected as the original target feature data of historical period 5.

[0125] Optionally, data standardization refers to unifying the units in data from different sources to improve the accuracy and efficiency of data analysis. In practical applications, data standardization may involve converting different units of measurement into a unified standard.

[0126] For example, for the average running time of a SQL task, if the unit of the original target feature data is milliseconds (ms), it can be converted to seconds (s) to make the units uniform.

[0127] S303: Construct sample data according to the target feature data and the database status corresponding to the target feature data.

[0128] S304: Process the target feature data in the sample data according to the initial model to obtain a database prediction state.

[0129] In this step, the initial model constructed after the result amplification processing of the Bayesian classifier can be used to process multiple sample data in sequence to obtain the database prediction state corresponding to each sample data.

[0130] For example, the target feature data in sample data 1 may be processed according to the initial model to obtain a database prediction state of normal.

[0131] S305: Compare the database prediction state with the database state corresponding to the target feature data to determine the database prediction accuracy.

[0132] In this step, the database prediction state corresponding to each sample data can be compared with the actual database state corresponding to the target feature data in the sample data to determine whether the database state predicted by the sample data is accurate. Furthermore, the accuracy of the database prediction can be calculated based on the database prediction states of all samples.

[0133] In an optional implementation, the plurality of sample data may be divided into a training data set and a test data set to more effectively evaluate and optimize the performance of the model. First, the initial model is trained with the training data set so that it can learn and recognize patterns and features in the data. During the training process, a cross-validation method may be used to evaluate the performance of the model.

[0134] After the model training is completed, the test data set can be used to conduct a comprehensive performance test of the model. The test data set can be used to calculate the accuracy of the model to evaluate the performance of the model on unseen data.

[0135] S306: When the database prediction accuracy is greater than a preset accuracy threshold, a database status detection model is obtained.

[0136] For example, the preset accuracy threshold is 70%. During the model testing process, if the database prediction accuracy obtained through the test data set is 80%, since the database prediction accuracy of 80% is greater than the preset accuracy threshold of 70%, the trained model can be used as a database status detection model.

[0137] In an embodiment of the present application, the electronic device can filter out data corresponding to the target feature from the original feature data of the database in the historical period according to the acquired target feature, and preprocess it to obtain the target feature data. Furthermore, sample data can be constructed according to the target feature data and the database state corresponding to the target feature data. The sample data is processed using the initial model to obtain the database prediction state, and the prediction accuracy is determined by comparing it with the database state corresponding to the target feature data. When the prediction accuracy exceeds a preset threshold, a database state detection model can be obtained. In the above process, by training the model and taking the accuracy exceeding the preset threshold as the criterion for successful model training, a database state detection model for detecting database anomalies can be obtained. Thereby improving the timeliness of database anomaly detection.

[0138] Below, in Figure 3 Based on the embodiment shown, combined Figure 4 , the processing process of filtering out data corresponding to the target feature from the original feature data in the database within the historical period according to the acquired target feature in step S301 to obtain the original target feature data is further described in detail.

[0139] Figure 4 Schematic diagram of the model training method provided in the embodiment of the present application Figure 3 . See Figure 4 , the method may include:

[0140] S401. According to a mutual information or chi-square test tool, at least one feature whose correlation with the database state is greater than a preset threshold is selected from the features of the database as a target feature.

[0141] For example, if the preset threshold is 70%, five features with a correlation with the database state greater than 70% can be selected from the features of the database according to the mutual information as target features. Specifically, the five features can be: the first duration percentage of the CPU usage greater than the first preset threshold in the CPU feature, the second duration percentage of the CPU usage greater than the second preset threshold in the memory feature, the third duration percentage of the memory usage greater than the third preset threshold in the memory feature, the sixth duration percentage of the disk load greater than the sixth preset threshold in the disk feature, and the average running time of the SQL task in the SQL task processing feature.

[0142] S402: Filter out feature data corresponding to the target feature from the original feature data in the database within the historical period to obtain original target feature data.

[0143] In an embodiment of the present application, the electronic device can use mutual information or chi-square test tools to select at least one feature from the features of the database whose correlation with the database state exceeds a preset threshold as the target feature. Then, feature data corresponding to these target features are screened out from the historical data of the database to obtain the original target feature data. In the above process, by selecting features that are highly correlated with the database state, it is possible to ensure that the model focuses on the most informative features, thereby improving the training efficiency and prediction accuracy of the model.

[0144] The contents shown in the above embodiments are all the process of model training. Figure 5 , explaining the process of using the model.

[0145] Figure 5 This is a flowchart of the database status detection method provided in the embodiment of the present application. Figure 5 , the method may include:

[0146] S501, obtaining current feature data of features related to the state in the current period from a database.

[0147] In this step, during the operation of the database, the electronic device can obtain the current characteristic data of the database, wherein the current characteristic data is characteristic data related to the state of the database in the current period.

[0148] For example, during the operation of the database, the electronic device can obtain that the first time period in which the CPU usage of the database is greater than 75% accounts for 20% in the current period, the third time period in which the memory usage is greater than 75% accounts for 30%, the fifth time period in which the disk load is greater than 75% accounts for 40%, and the average operation time of the SQL task is 5s. The current moment can be the database within the current 10 minutes.

[0149] S502: Input the current feature data into the database status detection model to perform database status detection and obtain a detection result.

[0150] In this step, the electronic device can input the acquired current feature data into the database state detection model to perform database state detection, and obtain a detection result indicating whether the state of the database in the current period is normal or abnormal. The database state detection model is the model trained in the above embodiment.

[0151] For example, the electronic device can input the acquired database data in the current time period where the CPU usage is greater than 75%, which accounts for 20% of the first period; the memory usage is greater than 75%, which accounts for 30% of the third period; the disk load is greater than 75%, which accounts for 40% of the fifth period; and the average running time of the SQL task is 5s, into the database status detection model for database status detection, and obtain that the detection result of the database in the current time period is abnormal.

[0152] In an optional implementation, when the detection result of the database is determined to be abnormal, an alarm can be issued and relevant information can be recorded. After the alarm is issued, the database operation and maintenance personnel can handle the alarm. If it is determined that emergency measures need to be taken, the preset emergency plan can be combined to achieve rapid response and ensure business continuity. Among them, the emergency plan may include: data backup, or switching of the standby database.

[0153] In an embodiment of the present application, the electronic device can obtain the current feature data of the database, process the current feature data according to the trained database state detection model, obtain a detection result indicating whether the state of the database in the current period is normal or abnormal, and realize abnormality detection of the database. In the above process, multiple feature data can be detected by the database state detection model, and the state of the database can be determined in time, thereby improving the timeliness of abnormality detection of the database.

[0154] Figure 6 This is a flow chart of an example of a database status detection method provided in an embodiment of the present application. Figure 6 , the method may include:

[0155] S601: Target feature selection.

[0156] For example, at least one feature whose correlation with the database state is greater than a preset threshold value may be selected from the features of the database according to the mutual information as the target feature.

[0157] S602: Acquire original target feature data.

[0158] For example, according to the acquired target features, data corresponding to the target features can be screened out from the original feature data of the database in the historical period to obtain the original target feature data.

[0159] S603: Preprocess the original target feature data to obtain target feature data.

[0160] For example, the original target feature data may be processed by removing duplicate data, filling missing data, and performing data standardization to obtain the target feature data.

[0161] S604: Is it the model training stage?

[0162] If yes, execute S605, if no, execute S606.

[0163] S605: Construct sample data, train the initial model, and obtain a database status detection model.

[0164] S606: Deploy a database status detection model to perform database status prediction.

[0165] Optionally, after the electronic device trains the initial model and obtains the database status detection model, it can deploy the database status detection model into the database and determine whether the status of the database in the current time period is normal or abnormal based on the current feature data of the features related to the status of the database in the current time period.

[0166] In a specific implementation, the output result H of the database status detection model can be determined based on the fact that the random projection of the high-dimensional random vector follows the Gaussian distribution. V The conditions included in P(V i |y=1) and P(V i |y=0), which is consistent with the parameter Gaussian distribution.

[0167]

[0168] In formula (3), is the mean of the characteristic anomalies, is the standard deviation of the characteristic anomaly, is the mean of the characteristic normal, is the standard deviation of the characteristic normal.

[0169] Optionally, the values ​​of the initial probabilities P(y=1) and P(y=0) can be set to 0.5; by marking the feature data of the features, an abnormal data set and a normal data set can be obtained, and then as well as

[0170] S607: Is the database status abnormal?

[0171] If yes, execute S608; if no, end.

[0172] S608: Manually determine whether the judgment is accurate.

[0173] If yes, then perform alarm processing, if no, execute S609.

[0174] In a specific implementation, the database status detection model deployed in the database can monitor the operation behavior of the database in real time, such as data access, modification and deletion, etc. When abnormal behavior is detected, an alarm can be immediately issued and relevant information can be recorded.

[0175] Optionally, after an alarm is issued, database operation and maintenance personnel can perform alarm processing and further determine whether emergency measures need to be taken, thereby reducing the impact of database anomalies on the business.

[0176] S609: Update the database status detection model.

[0177] Optionally, new feature data and feedback information can be collected regularly to update and optimize the database status detection model. Specifically, this can be achieved through incremental learning or regular retraining of the model. Continuous updating of the database status detection model can improve the accuracy and timeliness of database anomaly detection.

[0178] The database status detection method example provided in the embodiment of the present application, during the database status detection process, can refer to the process shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be repeated here.

[0179] Figure 7 This is a schematic diagram of the structure of the model training device provided in the embodiment of the present application. Figure 7 , the model training device 10 comprises:

[0180] An acquisition module 11 is used to acquire target feature data of a database in a historical period, wherein the target feature data is feature data related to a database state;

[0181] A first processing module 12, configured to construct sample data according to the target feature data and a database status corresponding to the target feature data, wherein the database status includes a database abnormality or a database normality;

[0182] The second processing module 13 is used to train the initial model according to the sample data to obtain a database status detection model, wherein the initial model is constructed after amplifying the results of the Bayesian classifier.

[0183] The model training device provided in the embodiment of the present application can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar, and will not be described in detail in this embodiment.

[0184] In a possible implementation manner, the acquisition module 11 is specifically configured to:

[0185] According to the acquired target feature, data corresponding to the target feature is screened out from the original feature data of the database in the historical period to obtain original target feature data, wherein the correlation between the target feature and the database state is greater than a preset threshold;

[0186] The original target feature data is preprocessed to obtain the target feature data, wherein the preprocessing includes at least one of the following: removing duplicate data, filling missing data, and data standardization.

[0187] In a possible implementation manner, the acquisition module 11 is specifically configured to:

[0188] According to the mutual information or chi-square test tool, at least one feature whose correlation with the database state is greater than the preset threshold is selected from the features of the database as the target feature;

[0189] The feature data corresponding to the target feature is screened out from the original feature data in the database within the historical period to obtain the original target feature data.

[0190] In a possible implementation, the characteristics of the database include: CPU characteristics, memory characteristics, disk characteristics, and task processing characteristics.

[0191] In a possible implementation, the target features include the following features:

[0192] A first time duration ratio of a CPU usage rate in a CPU feature being greater than a first preset threshold, and / or a second time duration ratio of a CPU usage rate being greater than a second preset threshold;

[0193] a third duration percentage during which the memory usage rate in the memory feature is greater than a third preset threshold, and / or a fourth duration percentage during which the memory usage rate is greater than a fourth preset threshold;

[0194] a fifth duration ratio during which the disk load in the disk feature is greater than a fifth preset threshold, and / or a sixth duration ratio during which the disk load is greater than a sixth preset threshold;

[0195] The average running time of tasks in the task processing characteristics, and / or the median running time of tasks.

[0196] In a possible implementation manner, the second processing module 13 is specifically configured to:

[0197] Processing the target feature data in the sample data according to the initial model to obtain a database prediction state;

[0198] Determine the database prediction accuracy by comparing the database prediction state with the database state corresponding to the target feature data;

[0199] When the database prediction accuracy is greater than a preset accuracy threshold, the database state detection model is obtained.

[0200] The model training device provided in the embodiment of the present application can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar, and will not be described in detail in this embodiment.

[0201] Figure 8 This is a schematic diagram of the structure of the database status detection device provided in the embodiment of the present application. Figure 8 , the database status detection device 20 comprises:

[0202] The acquisition module 21 is used to acquire current feature data of features related to the state of the database in the current period; the processing module 22 is used to input the current feature data into the database state detection model to perform database state detection to obtain a detection result, and the detection result is used to indicate whether the state of the database in the current period is normal or abnormal;

[0203] The database status detection model is obtained by training using the model training method described in any of the above embodiments.

[0204] The database status detection device provided in the embodiment of the present application can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0205] Fig. 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Fig. 9 The electronic device 30 provided in this embodiment includes: at least one processor 31 and a memory 32. Optionally, the device 30 also includes a communication component 33. The processor 31, the memory 32 and the communication component 33 are connected via a bus 34.

[0206] In the specific implementation process, at least one processor 31 executes the computer execution instructions stored in the memory 32, so that at least one processor 31 executes the above method.

[0207] The specific implementation process of the processor 31 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0208] Optionally, after the electronic device completes the training or updating of the database status detection model, the trained or updated database status detection model may be deployed to the database for detecting the status of the database.

[0209] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0210] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk storage.

[0211] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0212] An embodiment of the present application also provides a computer program product, including a computer program. When the computer program is executed by a processor, it can implement the model training method or database status detection method described in the above method embodiment.

[0213] An embodiment of the present application also provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, they are used to implement the model training method or database status detection method described in the above method embodiment.

[0214] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0215] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0216] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0217] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0218] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0219] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0220] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0221] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A model training method, characterized in that: include: Acquire target feature data of the database in a historical period, wherein the target feature data is feature data related to the database state; Constructing sample data according to the target feature data and a database state corresponding to the target feature data, wherein the database state includes a database abnormality or a database normality; The initial model is trained according to the sample data to obtain a database status detection model, wherein the initial model is constructed after amplifying the results of the Bayesian classifier.

2. The method according to claim 1, characterized in that The obtaining of target feature data of the database in a historical period includes: According to the acquired target feature, data corresponding to the target feature is screened out from the original feature data of the database in the historical period to obtain original target feature data, wherein the correlation between the target feature and the database state is greater than a preset threshold; The original target feature data is preprocessed to obtain the target feature data, wherein the preprocessing includes at least one of the following: removing duplicate data, filling missing data, and data standardization.

3. The method according to claim 2, characterized in that The step of filtering out data corresponding to the target feature from the original feature data in the database within the historical period according to the acquired target feature to obtain the original target feature data includes: According to the mutual information or chi-square test tool, at least one feature whose correlation with the database state is greater than the preset threshold is selected from the features of the database as the target feature; The feature data corresponding to the target feature is screened out from the original feature data in the database within the historical period to obtain the original target feature data.

4. The method according to claim 3, characterized in that The characteristics of the database include: CPU characteristics, memory characteristics, disk characteristics, and SQL task processing characteristics.

5. The method according to claim 4, characterized in that The target features include the following features: A first time duration ratio of a CPU usage rate in a CPU feature being greater than a first preset threshold, and / or a second time duration ratio of a CPU usage rate being greater than a second preset threshold; a third duration percentage during which the memory usage rate in the memory feature is greater than a third preset threshold, and / or a fourth duration percentage during which the memory usage rate is greater than a fourth preset threshold; a fifth duration ratio during which the disk load in the disk feature is greater than a fifth preset threshold, and / or a sixth duration ratio during which the disk load is greater than a sixth preset threshold; The average running time of SQL tasks in the SQL task processing characteristics and / or the median running time of SQL tasks.

6. The method according to any one of claims 1 to 5, characterized in that: The initial model is trained according to the sample data to obtain a database status detection model, including: Processing the target feature data in the sample data according to the initial model to obtain a database prediction state; Determine the database prediction accuracy by comparing the database prediction state with the database state corresponding to the target feature data; When the database prediction accuracy is greater than a preset accuracy threshold, the database state detection model is obtained.

7. A database status detection method, characterized in that: include: Acquire current feature data of features related to the state in the database during the current period; Inputting the current feature data into a database state detection model to perform database state detection to obtain a detection result, wherein the detection result is used to indicate whether the state of the database in the current period is normal or abnormal; Wherein, the database status detection model is trained according to the method according to any one of claims 1-6.

8. A database status detection device, characterized in that: include: An acquisition module, used to acquire current feature data of features related to the state in the database during the current period; A processing module, used for inputting the current feature data into a database status detection model to perform database status detection and obtain a detection result, wherein the detection result is used for indicating whether the status of the database in the current period is normal or abnormal; Wherein, the database status detection model is trained according to the method according to any one of claims 1-6.

9. An electronic device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the model training method according to any one of claims 1 to 6 or the database status detection method according to claim 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the model training method described in any one of claims 1 to 6 or the database status detection method described in claim 7.

Images