Abnormality detection method and device, equipment, storage medium and product

Abstract

The invention discloses an anomaly detection method and device, equipment, a storage medium and a product, and relates to the technical field, and the method comprises the steps: obtaining traffic time sequence index data of a target container cluster based on a preset time interval; performing classification detection on the traffic time sequence index data based on a pre-constructed classification anomaly detection model to obtain a traffic classification detection result; and performing anomaly identification and fault alarm based on the traffic classification detection result, through the above scheme, detecting the traffic time sequence index of the container cluster within the preset time, and classifying the traffic index data according to the specially constructed classification anomaly detection model to obtain the traffic trend category of the cluster traffic within a period of time. And then anomaly identification and fault alarm are carried out based on the trend category, so that the traffic trend is identified and alarmed after being classified, and the accuracy and efficiency of traffic time sequence index anomaly detection in a container cluster with a large data volume are remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of anomaly detection technology, and in particular to an anomaly detection method, device, equipment, storage medium and product. Background Art

[0002] In the current era of cloud computing and big data, container clusters are important platforms for resource scheduling and application deployment. Their stability and performance directly affect the reliability and efficiency of enterprise services. With the widespread application of container technology, the scale and complexity of container clusters are increasing, and with it comes the growing demand for cluster performance monitoring and anomaly detection. Traffic time series indicators of container clusters, such as request volume and response time, are key data for evaluating the health of clusters. However, due to the time series and high dimensionality of these indicator data, traditional anomaly detection methods, such as setting thresholds, calculating baselines, or algorithms designed based on data, face the problems of complex design, difficult maintenance, and difficulty in improving accuracy.

[0003] Existing anomaly detection technologies usually require a lot of manual design and subsequent maintenance work, which not only increases the operation and maintenance costs, but also makes it difficult to guarantee its efficiency and accuracy as the cluster scales up. In addition, these methods often rely on static thresholds or rules, which are difficult to adapt to the dynamically changing cluster environment, resulting in false positives and false negatives. For example, when the cluster encounters sudden traffic or service changes, the detection method based on static rules may not be able to identify anomalies in time, or may misjudge normal fluctuations as anomalies, thus affecting the normal operation of the cluster and the administrator's decision-making.

[0004] In addition, traditional anomaly detection methods are often inefficient when processing large-scale data and are difficult to meet the needs of real-time monitoring. As the scale of container clusters expands, the amount of indicator data that needs to be detected increases dramatically. Traditional rule-based or statistical methods may encounter performance bottlenecks when processing this data, resulting in detection delays and failure to respond to potential anomalies in a timely manner. Summary of the invention

[0005] The main purpose of this application is to provide an anomaly detection method, apparatus, device, storage medium and computer program product, aiming to improve the accuracy and efficiency of anomaly detection of traffic timing indicators in container clusters with large data volumes.

[0006] To achieve the above objectives, the present application proposes an anomaly detection method, the method comprising:

[0007] Obtain traffic time series indicator data of the target container cluster based on preset time intervals;

[0008] Based on a pre-built classification anomaly detection model, the traffic time series indicator data is classified and detected to obtain a traffic classification detection result;

[0009] Anomaly identification is performed based on the traffic classification detection result.

[0010] In one embodiment, the training process of the classification anomaly detection model includes:

[0011] Obtain pre-classified historical traffic time series classification indicator data;

[0012] Based on the historical traffic time series classification index data and the pre-built deep learning CNN neural network model, convolution classification training is performed to obtain a training index, wherein the training index includes at least one of a correct rate, a loss rate, and a correct number;

[0013] When the training index reaches a preset index threshold and the standard stability reaches a preset stability threshold, a classification anomaly detection model is obtained.

[0014] In one embodiment, the step of performing convolution classification training based on the historical traffic time series classification index data and a pre-built deep learning CNN neural network model to obtain a training index includes:

[0015] Storing the historical traffic time series classification index in a preset character-separated value CSV file;

[0016] Convert the CSV file into an array of indicator data;

[0017] Converting the indicator data array into a model recognition tensor through a preset optimization algorithm;

[0018] The model recognition tensor is sent into the CNN neural network model as a training input set, and convolution classification training is performed to obtain training indicators.

[0019] In one embodiment, the step of performing classification detection on the traffic time series indicator data based on a pre-built classification anomaly detection model to obtain a traffic classification detection result includes:

[0020] Generate a corresponding flow time series indicator data array based on the flow time series indicator data;

[0021] The flow time series indicator data array is converted into a flow time series indicator original tensor matrix through a preset tensor conversion algorithm, and the flow time series indicator original tensor matrix includes a plurality of indicator matrix data points;

[0022] According to the slope between adjacent indicator matrix data points, the original tensor matrix of the flow time series indicator is smoothed and supplemented to obtain the flow time series indicator detection tensor matrix;

[0023] The flow time series indicator detection tensor matrix is ​​input into the classification anomaly detection model for classification detection to obtain a flow classification detection result.

[0024] In one embodiment, the traffic classification detection result includes a traffic trend category of the traffic time series indicator within the time interval, and the step of performing anomaly identification based on the traffic classification detection result includes:

[0025] If the traffic trend category is the preset target trend category, a secondary confirmation of abnormal identification is performed to obtain a secondary confirmation result;

[0026] If the secondary confirmation result is confirmed abnormal, cluster indicator abnormal information is obtained, and the cluster indicator abnormal information includes at least one of alarm cluster information, abnormal indicator type, abnormal time point and abnormal status information;

[0027] Determine the root cause of the fault according to the abnormal indicator type to obtain the estimated root cause of the fault;

[0028] The cluster indicator abnormality information and the estimated root cause of the fault are returned to the pre-connected management terminal and stored in a preset fault information database.

[0029] In one embodiment, the step of performing secondary confirmation of abnormal identification to obtain a secondary confirmation result includes:

[0030] Confirm whether the target traffic cluster log collection is in an available state. If not, generate an alarm to be confirmed instruction; or,

[0031] Confirm whether the duration of the abnormal indicator exceeds the preset abnormal time threshold. If it exceeds, generate an alarm to be confirmed instruction; or,

[0032] Confirm whether the abnormal indicator is a regular abnormal warning. If not, generate an alarm to be confirmed instruction;

[0033] In response to the alarm to be confirmed instruction, confirm whether the target trend category is within the abnormal alarm cooling time;

[0034] If the target trend category is not within the abnormal alarm cooling time, a confirmed abnormal result is generated.

[0035] In addition, to achieve the above purpose, the present application also proposes an abnormality detection device, which includes:

[0036] An acquisition module is used to obtain the traffic time series indicator data of the target container cluster based on a preset time interval;

[0037] A detection module, used to perform classification detection on the traffic time series indicator data based on a pre-built classification anomaly detection model to obtain a traffic classification detection result;

[0038] An alarm module is used to identify anomalies based on the traffic classification detection results.

[0039] In addition, to achieve the above-mentioned purpose, the present application also proposes an anomaly detection device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the anomaly detection method described above.

[0040] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the anomaly detection method described above are implemented.

[0041] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the anomaly detection method described above are implemented.

[0042] One or more technical solutions proposed in the present application obtain the flow timing indicator data of the target container cluster based on a preset time interval; classify and detect the flow timing indicator data based on a pre-constructed classification anomaly detection model to obtain a flow classification detection result; and perform anomaly identification and fault alarm based on the flow classification detection result. Through the above solution, the flow timing indicator of the container cluster within a preset time is detected, and the flow indicator data is classified according to a specially constructed classification anomaly detection model to obtain the flow trend category of the cluster flow within a period of time, and then anomaly identification and fault alarm are performed based on the trend category. This solution of classifying the flow trend, identifying and alarming significantly improves the accuracy and efficiency of anomaly detection of flow timing indicators in container clusters with large data volumes. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] Figure 1A flowchart of the first embodiment of the anomaly detection method of the present application is provided;

[0046] Figure 2 The system architecture and data interaction diagram corresponding to the anomaly detection method of this application;

[0047] Figure 3 This is a schematic diagram of specific cluster traffic related indicators in the anomaly detection method of this application;

[0048] Figure 4 This is a schematic diagram of traffic anomaly classification for the anomaly detection method of this application;

[0049] Figure 5 This is a schematic diagram of the neural network model structure of the anomaly detection method of this application;

[0050] Figure 6 This is a schematic diagram of the changing trends of various data during the model training process in this embodiment;

[0051] Figure 7 This is a schematic diagram of the training optimization process of the anomaly detection model for this application;

[0052] Figure 8 A flowchart of the second embodiment of the anomaly detection method of the present application is provided;

[0053] Fig. 9 Schematic diagram of the optimization algorithm for converting time series of indicators to tensors for the anomaly detection method of this application;

[0054] Fig.10 This is a schematic diagram of sending an alarm notification when the fault alarm module of the abnormality detection method of this application detects an abnormality;

[0055] Fig.11 This is a schematic diagram of the fault daily report of the fault alarm module of the abnormal detection method of this application;

[0056] Fig.12 This is a schematic diagram of the module structure of the abnormality detection device according to an embodiment of the present application;

[0057] Fig.13 Schematic diagram of the device structure of the hardware operating environment involved in the anomaly detection method in the embodiment of the present application.

[0058] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0059] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0060] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0061] The main solution of the embodiment of the present application is to propose a method for detecting anomalies in container cluster traffic time series indicators based on deep learning, which aims to efficiently identify and warn of abnormal conditions in container clusters. The solution consists of four main modules: model training, indicator query, indicator detection and fault alarm.

[0062] First, the model training module uses historical indicator data to train the deep learning CNN neural network to identify abnormal indicator graphs. The module divides the time series graph into five categories, including stable or chaotic, stable followed by a sudden increase, sudden drop followed by a sudden increase, stable followed by a sudden drop, and sudden increase followed by a sudden drop. The last four categories are the abnormal situations that are the focus of attention. The neural network model is optimized based on the classic classification model LeNet-5, and multiple rounds of training are performed through the Pytorch training program to finally achieve five-category classification of the time series graph.

[0063] Secondly, the indicator query module periodically queries cluster traffic-related indicators from data sources such as Prometheus, RTR, log keywords, etc., and inputs the data into the indicator detection module. These indicators include cluster request volume, average response time, abnormal response code, etc., which are stored in the Clickhouse database after abnormal detection of RTR logs of cluster requests by streaming processing consumption, and are obtained periodically through SQL statements.

[0064] Next, the indicator detection module will classify and detect the queried indicator data through the latest CNN neural network model. The detection process includes using the matplotlib toolkit to generate original images from time series data, then converting them into grayscale images and normalizing them into tensors, inputting them into the detection model trained by Pytorch, and outputting the detection results. In addition, the module will also decide whether to trigger a fault alarm based on factors such as overall traffic or Prometheus status, indicator duration, year-on-year and month-on-month similarity detection, and repeatability judgment.

[0065] Finally, the fault alarm module triggers fault alarms based on the judgment of the CNN neural network model and other factors, sends alarm messages to container cluster administrators, and generates fault reports regularly. The alarm content includes cluster, indicator type, abnormal time point and abnormal status information, and makes root cause judgment based on indicator type to reduce administrator troubleshooting time.

[0066] In addition, in order to solve the bottleneck problem of detection performance, an optimization solution is proposed, which is to directly convert the time series indicator data into tensor data that the model can recognize, instead of converting it into images first. This optimization algorithm significantly improves the detection efficiency by storing the indicator data in a CSV file and then converting the data into tensors using pandas and optimization algorithms, reducing the detection time from 120ms to 10ms.

[0067] In summary, this solution uses deep learning technology to achieve efficient anomaly detection of container cluster traffic timing indicators, and improves detection performance through optimization algorithms. Finally, the fault alarm module notifies the administrator in a timely manner to ensure the stable operation of the container cluster.

[0068] Traditional anomaly detection methods in the existing technology are often inefficient when processing large-scale data and cannot meet the needs of real-time monitoring. As the scale of container clusters expands, the amount of indicator data that needs to be detected increases dramatically. Traditional rule-based or statistical methods may encounter performance bottlenecks when processing this data, resulting in detection delays and failure to respond to potential anomalies in a timely manner.

[0069] The present application provides a solution, which obtains the flow timing indicator data of the target container cluster based on a preset time interval; classifies and detects the flow timing indicator data based on a pre-constructed classification anomaly detection model to obtain a flow classification detection result; and performs anomaly identification and fault alarm based on the flow classification detection result. Through the above solution, the flow timing indicator of the container cluster within a preset time is detected, and the flow indicator data is classified according to a specially constructed classification anomaly detection model to obtain a trend category of the cluster flow within a period of time, and then anomaly identification and fault alarm are performed based on the trend category. This solution of classifying the flow trend, identifying and alarming significantly improves the accuracy and efficiency of anomaly detection of flow timing indicators in container clusters with large data volumes.

[0070] It should be noted that the execution subject of this embodiment may be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, anomaly detection system, etc. The following takes the anomaly detection system as an example to illustrate this embodiment and the following embodiments.

[0071] Based on this, the present application embodiment provides an abnormality detection method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the abnormality detection method of the present application.

[0072] In this embodiment, the anomaly detection method includes steps S1000 to S4000:

[0073] Step S1000: Obtaining traffic time series indicator data of the target container cluster based on a preset time interval;

[0074] It should be noted that a method for detecting anomalies in container cluster traffic timing indicators based on deep learning is provided in this embodiment, aiming to provide a solution to efficiently determine whether a large number of timing indicators of a container cluster are abnormal, so as to ensure that the container cluster administrator can promptly discover abnormal conditions of the container cluster. This solution uses a deep learning CNN neural network to train a model that can identify abnormal indicator graphics, and optimizes the detection solution when there is a detection performance bottleneck in image recognition, and converts the timing indicator data directly into tensor data that the model can recognize instead of converting it into images, thereby improving detection efficiency.

[0075] Specific reference Figure 2 , Figure 2 This is a schematic diagram of the system architecture and data interaction corresponding to the anomaly detection method of this application. The specific solution for anomaly detection of container cluster traffic time series indicators based on deep learning is mainly divided into modules such as model training, indicator query, indicator detection, and fault alarm.

[0076] The model training module uses the historical indicator data from various data sources, and the deep learning CNN neural network performs convolution classification training to classify and output abnormal indicator graphs;

[0077] The indicator query module periodically queries various indicator data sources including Prometheus, RTR, log keywords, etc., and then inputs them into the indicator detection module for anomaly detection; the indicator detection module is responsible for classifying and detecting the indicator data of various data sources according to the required detection method, selecting the latest CNN neural network model for classification detection, and then judging whether an abnormal situation occurs based on the overall traffic or Prometheus status, indicator duration, year-on-year and month-on-month similarity detection, and repeatability. If an abnormal situation occurs, a fault alarm is issued;

[0078] The fault alarm module triggers fault alarms based on the CNN neural network model and other factors. The alarm message is sent to the container cluster administrator and a fault report is generated regularly.

[0079] Specifically, in this embodiment, the target container cluster refers to the container cluster that needs to perform traffic monitoring and anomaly detection. Traffic timing indicator data refers to the traffic information of the cluster at different time points. This information usually includes key performance indicators such as request volume, average response time, and abnormal response code. The preset time interval means that the system collects these indicator data according to the set time frequency (such as every minute, every hour). The purpose of this is to continuously monitor the cluster status and detect possible abnormal situations in a timely manner.

[0080] In addition, it should be noted that obtaining traffic time series indicator data is the first step in the anomaly detection process, and its purpose is to collect sufficient information for subsequent model analysis and judgment. This step is performed periodically to ensure that it can cover the entire period of cluster operation. In this embodiment, the indicator query module is responsible for periodically pulling cluster traffic related indicators, such as Figure 3 As shown, Figure 3 This is a schematic diagram of specific cluster traffic related indicators in the anomaly detection method of this application, including cluster request volume, average response time, abnormal response code, response\request Bpr and other cluster traffic related indicators. At present, these data are processed by streaming consumption cluster request RTR log data and stored in Clickhouse database. SQL statements are used to obtain relevant traffic indicator data in the last hour on a regular basis, and then the results are returned and placed in the indicator detection module. For example, in a specific implementation method, the system will configure a scheduled task to pull the cluster traffic timing indicator data from the Prometheus database every 5 minutes or one hour. These data will be stored in memory or database for use in subsequent steps.

[0081] Step S2000: performing classification detection on the traffic time series indicator data based on a pre-built classification anomaly detection model to obtain a traffic classification detection result;

[0082] It should be noted that in this embodiment, the classification anomaly detection model is a CNN neural network based on deep learning, which learns the characteristics of normal and abnormal traffic patterns during the training phase. The model is constructed to accurately distinguish whether the traffic indicator data belongs to the normal range or abnormal conditions. Classification detection refers to the model analyzing and judging the traffic time series indicator data collected in real time to determine its category. In this embodiment, reference Figure 4 , Figure 4 This is a schematic diagram of the classification of traffic anomalies in the anomaly detection method of this application. The trend of traffic time series indicator data over a period of time can be divided into five categories, including stable or chaotic, sudden increase after stability, sudden increase after sudden decrease, sudden decrease after stability, and sudden increase after sudden decrease. The last four categories that need to be paid attention to are abnormal situations.

[0083] In addition, it should be noted that the purpose of classification detection is to quickly identify possible abnormal behaviors for further analysis and processing. The classification detection results will provide a basis for the next step of abnormal identification and fault alarm.

[0084] For example, in a specific implementation, the model training module uses historical data to train a classification model that can identify five different traffic patterns. When new traffic time series indicator data arrives, the model will classify it in real time to determine whether it conforms to a known abnormal pattern.

[0085] Step S3000: performing anomaly identification based on the traffic classification detection result.

[0086] It should be noted that anomaly identification is a further analysis and confirmation of the classification detection results. Fault alarm means that after confirming the anomaly, the system will automatically notify the administrator or relevant maintenance team so that timely measures can be taken. The purpose of anomaly identification and fault alarm is to ensure the stable operation of the container cluster and prevent possible faults from affecting the business.

[0087] In addition, it should be noted that in the process of anomaly identification, the system may consider multiple factors, such as overall traffic conditions, indicator duration, year-on-year and month-on-month similarity, and repeatability, etc., to reduce false alarms and missed alarms.

[0088] In a feasible implementation, the training process of the classification anomaly detection model includes steps A1000 to A4000:

[0089] Step A1000: Obtain pre-classified historical traffic time series classification index data;

[0090] Step A2000: Based on the historical traffic time series classification index data and the pre-built deep learning CNN neural network model, convolution classification training is performed to obtain a training index, wherein the training index includes at least one of the accuracy rate, the loss rate and the correct number;

[0091] Step A3000: When the training index reaches a preset index threshold and the standard stability reaches a preset stability threshold, a classification anomaly detection model is obtained.

[0092] It should be noted that in this embodiment, the training process of the classification anomaly detection model is the core of building an effective anomaly detection system. First, obtaining pre-classified historical traffic time series classification indicator data is the basis for training the model. These data include normal and abnormal traffic patterns, providing samples for the model to learn and distinguish abnormal situations. The classification of historical data needs to rely on professional knowledge or previous detection results.

[0093] Specifically, the neural network model structure in this embodiment is as follows: Figure 5 As shown in the figure, the neural network model used refers to the classic classification model LeNet-5, which also has two convolutional layers and three fully connected layers. The parameters of the convolutional layers and fully connected layers have been optimized after multiple adjustments. The prepared historical indicator data is input into the Pytorch training program. After multiple rounds of training, the final output divides the traffic time series indicator data change trends into five categories.

[0094] Based on these historical data and the pre-built deep learning CNN neural network model, the system will conduct convolution classification training. CNN neural network is selected for its high performance in image recognition. It automatically extracts the features of traffic data through convolution layers to identify abnormal patterns. During the training process, the system will continuously adjust the network parameters to improve the accuracy of the model.

[0095] During the training process, the system collects training output indicators, including accuracy, loss rate, and correct number, which reflect the performance of the model and the progress of training. Accuracy indicates the proportion of correct classifications by the model, loss rate usually refers to the proportion of incorrect classifications by the model, and correct number indicates the number of samples correctly predicted by the model in one training iteration.

[0096] In addition, it should be noted that when the training output index reaches the preset index threshold and the standard stability also reaches the preset stability threshold, the system will stop training. This is done to avoid overfitting and ensure that the model can perform well on unknown data. The preset index threshold and stability threshold are to prevent the model from performing well on the training set but having poor generalization ability in actual applications.

[0097] For example, in a feasible implementation, the system first extracts the traffic time series data within a certain period of time from the database, puts all the training data into the Pytorch neural network for training, and the accuracy, loss rate and total correct number after training can be seen in TensorBoard, such as Figure 6 As shown, Figure 6 This is a schematic diagram of the changing trends of various data in the model training process in this embodiment. After 15 rounds in this embodiment, the model accuracy, loss rate and correct number meet the preset requirements, and the model we need is obtained. Based on this model, the timing diagram will be identified and then classified into five items. The types of the last four items will trigger subsequent alarm actions.

[0098] In a feasible implementation manner, step A2000 includes steps A2100 to A2400:

[0099] Step A2100: storing the historical traffic time series classification index into a preset character-separated value CSV file;

[0100] Step A2200: Convert the CSV file into an indicator data array;

[0101] Step A2300: converting the indicator data array into a model recognition tensor through a preset optimization algorithm;

[0102] Step A2400: Send the model recognition tensor as a training input set into the CNN neural network model to perform convolution classification training.

[0103] It should be noted that in this embodiment, a deep learning CNN neural network model is used to train historical traffic time series data, thereby constructing a classification anomaly detection model that can effectively identify abnormal traffic patterns. In this embodiment, if the cluster traffic index anomaly detection depends on the generation of a graph, there is a detection performance bottleneck in the concurrency and the speed of generating the graph, so this application proposes to convert the time series index data directly into tensor data that the model can recognize instead of images to improve the detection efficiency. This optimization algorithm will play a significant role in scenarios that require large-scale index detection:

[0104] Reference Figure 7 , Figure 7 This is a schematic diagram of the training optimization process of the anomaly detection model of this application. In the scheme of using the timing diagram for model training, the original image transforms are first converted into a 224*224 grayscale image, and then the tensor is normalized and trained with the corresponding Label and neural network through the pytorch model to obtain a detection model.

[0105] The optimized model training in this embodiment stores the direct indicator data in a csv file, and then uses the pandas read_csv method to convert the csv file into an indicator data array, and uses the optimization algorithm to convert the indicator data array into a tensor that can be recognized by the Pytorch neural network model.

[0106] First, the historical traffic time series classification indicator data is stored in a preset CSV file. This step is to facilitate data management and processing. CSV files are a common data storage format that can be easily read and parsed by various data processing libraries. Storing classification indicator data in character-separated values ​​ensures data readability and ease of processing.

[0107] Next, the CSV file is converted into an array of indicator data. This conversion process is implemented programmatically, usually using a data processing library, such as the pandas library in Python, to read the CSV file and convert its contents into an array form that the program can more conveniently process. Arrays are a commonly used data structure in numerical computing, which can perform mathematical operations and data iteration efficiently.

[0108] Then, the indicator data array is converted into a tensor recognized by the model through a preset optimization algorithm. This step is the key to realizing model input, because in deep learning, data usually needs to be input into the model in the form of tensors. The purpose of the optimization algorithm is to convert the time series indicator data into a form that the model can understand and process, including normalization and adjusting the shape of the data.

[0109] Finally, the obtained model recognition tensor is sent to the CNN neural network model as a training input set for convolution classification training. This step is the core of model training. Through a large amount of training data and iterative processes, the CNN model can learn how to identify abnormal behavior from normal traffic patterns.

[0110] In addition, it should be noted that during model training, the system will collect and monitor training output indicators, such as accuracy, loss rate, and correct number. These indicators can reflect the performance of the model on the training set and are used to determine whether the model has been trained well enough and whether it has reached the critical point of overfitting.

[0111] For example, in one feasible implementation, the system first collects traffic data from the past year, labels the data as normal or abnormal, and stores it in a CSV file. Then, the CSV file is read using a data processing library and converted into an array, and then an optimization algorithm is applied to convert the array into a tensor suitable for input into the CNN model. The CNN model is trained under the PyTorch framework, and the model's ability to identify abnormal traffic is improved by adjusting the parameters of the convolutional layer and the pooling layer. When the accuracy of the monitored model reaches 95% and the stability is in line with expectations, the training stops and the trained model is saved for real-time traffic anomaly detection.

[0112] The present embodiment provides an anomaly detection method, which obtains traffic timing indicator data of a target container cluster based on a preset time interval; classifies and detects the traffic timing indicator data based on a pre-constructed classification anomaly detection model to obtain a traffic classification detection result; and performs anomaly identification and fault alarm based on the traffic classification detection result. Through the above scheme, the traffic timing indicator of the container cluster within a preset time is detected, and the traffic indicator data is classified according to a specially constructed classification anomaly detection model to obtain a trend category of the cluster traffic within a period of time, and then anomaly identification and fault alarm are performed based on the trend category. This scheme of classifying the traffic trend, identifying and alarming significantly improves the accuracy and efficiency of anomaly detection of traffic timing indicators in container clusters with large data volumes.

[0113] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 8 , step S2000 of the abnormality detection method further includes steps S2100 to S2400:

[0114] Step S2100: generating a corresponding flow time series indicator data array based on the flow time series indicator data;

[0115] Step S2200: converting the flow time series indicator data array into a flow time series indicator original tensor matrix through a preset tensor conversion algorithm, wherein the flow time series indicator original tensor matrix includes a plurality of indicator matrix data points;

[0116] Step S2300: smoothing and supplementing the original tensor matrix of the flow time series indicators according to the slope between adjacent indicator matrix data points to obtain a flow time series indicator detection tensor matrix;

[0117] Step S2400: input the flow time series indicator detection tensor matrix into the classification anomaly detection model for classification detection to obtain a flow classification detection result.

[0118] It should be noted that, first, the system generates a corresponding data array based on the traffic time series indicator data. This step is to convert the original traffic data into a format suitable for model processing. The traffic time series indicator data array contains traffic information collected within a preset time interval, such as request volume, response time, etc. This information is the basis for subsequent analysis.

[0119] Subsequently, the system converts the data array into the original tensor matrix of traffic time series indicators through a preset tensor conversion algorithm. The tensor matrix is ​​a multidimensional data structure that can express the characteristics of the data more richly. In this embodiment, the original tensor matrix contains several indicator matrix data points, which are obtained by mathematically transforming the traffic data, providing a more detailed data analysis basis for subsequent anomaly detection.

[0120] Then, the system smoothes and supplements the original tensor matrix according to the slope between adjacent indicator matrix data points to obtain the flow time series indicator detection tensor matrix for detection. The slope reflects the change trend between data points. Through smooth supplementation, the system can better grasp the overall trend of the data and provide a more accurate and comprehensive data view for anomaly detection.

[0121] Finally, the system inputs the detection tensor matrix into the classification anomaly detection model for classification detection and obtains the traffic classification detection result. The classification anomaly detection model is a CNN neural network based on deep learning, which can identify abnormal patterns in data and classify them. This step is the key to achieve anomaly detection, and its results will directly affect the accuracy of anomaly identification and fault alarm.

[0122] In addition, it should be noted that the entire detection process is automated and efficient, which not only improves the accuracy of anomaly detection, but also reduces the need for manual intervention. In this way, the system can quickly identify anomalies in large amounts of data and provide timely feedback to container cluster administrators.

[0123] Specifically, refer to Fig. 9, Fig. 9 This is a schematic diagram of the optimization algorithm for converting the time series of indicators of the anomaly detection method of this application into tensor tensors. In this embodiment, in the detection scheme based on the time series diagram, the original image generated by Matplotlib is shown in the figure. After the image is converted into a tensor, it is displayed as above using an Excel color scale diagram. It can be seen that the color scale diagram is also similar to the time series trend diagram. The visualization image displayed by Pytorch training TensorBoard is roughly consistent with the original image.

[0124] In this embodiment, based on the detection scheme based on the timing diagram, the optimization scheme proposed is to directly convert the indicator data array into a tensor matrix. In order to achieve the effect of converting the image into a tensor, the size of the tensor matrix is ​​set to 960*960, and then the points of the indicator data are taken and evenly distributed on the 960*960 XY axis. The points in the middle need to be filled in manually according to the slope. The most critical part is to match the Excel color scale. Figure 1 The sample has thickness and curvature, and you need to fill in the upper and lower contents of the point according to the slope. Finally, put it into Pytorch training TensorBoard to display the visualization image effect. Although it cannot achieve the effect of putting the original image into Pytorch, the general graphics and trends can be basically recognized.

[0125] For example, in a feasible implementation, the system first collects traffic timing indicator data within a certain time interval from the container cluster, such as once every 5 minutes. Then, these data are converted into arrays and further converted into tensor matrices. By smoothly supplementing the tensor matrix, the system constructs a detection tensor matrix and inputs the matrix into a pre-trained CNN model. The model analyzes the detection tensor matrix and outputs classification detection results, such as stable, sudden increase, sudden drop and other categories. If the test result shows an abnormal category, the system will further perform a secondary confirmation, and after confirmation, send an alarm message to the administrator, and record the abnormal information in the fault information database for future audit and analysis. This process ensures the accuracy and timeliness of anomaly detection and improves the stability and reliability of the container cluster.

[0126] In a feasible implementation manner, the traffic classification detection result includes the traffic trend category of the traffic time series indicator within the time interval, and step S3000 includes steps S3100 to S3400:

[0127] Step S3100: If the traffic trend category is a preset target trend category, performing secondary confirmation of abnormal identification to obtain a secondary confirmation result;

[0128] Step S3200: If the secondary confirmation result is confirmed abnormal, cluster indicator abnormal information is obtained, and the cluster indicator abnormal information includes at least one of alarm cluster information, abnormal indicator type, abnormal time point and abnormal status information;

[0129] Step S3300: determining the root cause of the fault according to the abnormal indicator type to obtain the estimated root cause of the fault;

[0130] Step S3400: returning the cluster indicator abnormality information and the fault prediction root cause to the pre-connected management terminal, and storing them in a preset fault information database.

[0131] It should be noted that in this embodiment, the purpose of the secondary confirmation of abnormal identification is to prevent false alarms through an additional verification step after the system determines that the traffic trend meets the preset target trend category. This step further verifies that the abnormality has indeed occurred by comprehensively considering real-time data, historical data and environmental factors.

[0132] Specifically, in this embodiment, the fault alarm model triggers the fault alarm based on the judgment of the CNN neural network model and other factors, the alarm message is sent to the container cluster administrator, and a fault report is generated regularly.

[0133] After an alarm is triggered, the alarm cluster, indicator type, abnormal time point, and abnormal status information need to be sent to the container cluster administrator. At the same time, it is also necessary to make certain root cause judgments based on the indicator type to reduce the troubleshooting time of the container cluster administrator. For details, please refer to Fig.10 , Fig.10 This is a schematic diagram of the fault alarm module detecting anomalies and sending alarm notifications for the anomaly detection method of this application. For example, if the number of requests in the container cluster decreases abnormally, the root causes that need to be investigated include the collection end that collects the cluster RTR logs, the stream processing end that converts the consumption processing cluster RTR logs into request volume indicators, whether there is a federated cluster flow cut, whether there are anomalies in applications with large traffic, whether there are anomalies in the cluster inlet network, whether there are anomalies in the cluster control layer components, etc. These cause detection results need to be notified to the container cluster administrator at the same time.

[0134] If the above secondary confirmation result confirms the anomaly, the system will obtain cluster indicator anomaly information, including alarm cluster information, anomaly indicator type, anomaly time point and anomaly status information. This information is crucial to understanding the nature and scope of the anomaly, and provides basic data for subsequent troubleshooting and repair.

[0135] The system will try to determine the potential cause of the abnormality by judging the root cause of the fault based on the type of abnormal indicator. This step estimates the root cause of the fault that may cause the abnormality by analyzing the abnormal pattern and related indicators, thereby providing direct fault diagnosis information to the operation and maintenance team.

[0136] In addition, refer to Fig.11 , Fig.11 This is a schematic diagram of the fault daily report of the fault alarm module of the anomaly detection method of this application. After the alarm, the alarm data needs to be stored in the Clickhouse database to facilitate the query of historical alarm data and leave traces. At the same time, these abnormal alarms are integrated into a cluster fault report every day or manually triggered, including fault alarm data trends, fault impact statistics, abnormal situation descriptions, fault alarm root cause analysis, etc.

[0137] For example, in a feasible implementation, the system first reconfirms the suspected abnormal traffic trend based on the classification detection results. If it is confirmed to be abnormal, the system will automatically collect abnormal time series indicator data and analyze the possible causes of the failure. For example, if the abnormal indicator is a sudden drop in the number of cluster requests, the system will check the relevant log collection status, indicator duration, and compare it with historical data to rule out periodic fluctuations or expected changes. After confirming the abnormality, the system will notify the administrator and record detailed information in the fault information database, including the type of abnormality, time point and affected cluster, as well as the root cause of the failure estimated by the system. In this way, administrators can take quick action, and the system also provides valuable feedback for future optimization.

[0138] In a feasible implementation manner, the step of performing secondary confirmation of abnormal identification in step S3100 to obtain a secondary confirmation result includes steps B1000 to B5000:

[0139] Step B1000: confirm whether the target traffic cluster log collection is in an available state, and if not, generate an alarm to be confirmed instruction; or,

[0140] Step B2000: confirm whether the duration of the abnormal indicator exceeds the preset abnormal time threshold, and if so, generate an alarm to be confirmed instruction; or,

[0141] Step B3000: confirm whether the abnormal indicator is a regular abnormal warning. If it is not a regular abnormal warning, generate an alarm to be confirmed instruction;

[0142] Step B4000: In response to the alarm confirmation instruction, confirm whether the target trend category is within the abnormal alarm cooling time;

[0143] Step B5000: If the target trend category is not within the abnormal alarm cooling time, a confirmed abnormal result is generated.

[0144] It should be noted that the secondary confirmation of abnormal identification is a comprehensive judgment process that aims to reduce false alarms and ensure that true abnormal situations are accurately identified. This process verifies the abnormal traffic trend initially identified through multiple judgment criteria to determine whether to issue a fault alarm.

[0145] First, the system confirms the log collection status of the target traffic cluster. Logs are an important data source for monitoring cluster status. If log collection is unavailable, it may mean that a problem has occurred within the cluster, resulting in incomplete or distorted data. In this case, the system generates an alarm to be confirmed instruction to remind the administrator to further check and handle it.

[0146] Next, the system evaluates whether the duration of the abnormal indicator exceeds the preset abnormal time threshold. The abnormal time threshold is an important parameter that helps distinguish short-term fluctuations from real abnormal situations. If the abnormal duration exceeds this threshold, the system also generates an alarm to be confirmed.

[0147] In addition, the system needs to determine whether the abnormal indicator is a regular abnormal warning. In some cases, a specific abnormal indicator may appear due to periodic activities or expected events, and this regular abnormality does not require immediate human intervention. If the abnormal indicator is not such a regular warning, the system will generate an alarm to be confirmed instruction.

[0148] Then, the system responds to the alarm confirmation instruction and checks whether the target trend category is within the abnormal alarm cooling time. The cooling time mechanism can prevent multiple alarms for the same type of abnormality in a short period of time, thereby reducing unnecessary interference.

[0149] Finally, if the target trend category is not within the abnormal alarm cooling time, the system generates a confirmed abnormal result. This means that after the second confirmation, the system determines that the detected traffic trend is indeed an abnormal situation and requires the administrator's attention and processing.

[0150] For example, in one feasible implementation, the system first checks the status of cluster log collection to ensure the integrity and accuracy of the data. Then, the system evaluates the duration of the abnormal indicator to determine whether it has reached the preset abnormal time threshold. At the same time, the system also analyzes the historical data of the abnormal indicator to confirm whether this is a periodic or expected event. If all these conditions are met, the system will enter the cooling time check to ensure that there will be no repeated alarms for the same abnormality. Finally, if all conditions are passed, the system will confirm the abnormal result and notify the administrator for further processing. This series of judgment criteria and processes ensures the accuracy and effectiveness of anomaly detection. This process not only improves the accuracy of anomaly detection, but also helps to improve the overall effectiveness of the system and the response efficiency of administrators.

[0151] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the anomaly detection method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0152] Please refer to Fig.12 The present application also provides an abnormality detection device, the abnormality detection device comprising:

[0153] An acquisition module 121 is used to acquire traffic time series indicator data of a target container cluster based on a preset time interval;

[0154] The detection module 122 is used to perform classification detection on the traffic time series indicator data based on a pre-built classification anomaly detection model to obtain a traffic classification detection result;

[0155] The alarm module 123 is used to perform abnormality identification and fault alarm based on the traffic classification detection result.

[0156] The anomaly detection device provided by the present application adopts the anomaly detection method in the above embodiment to solve the technical problem of anomaly detection. Compared with the prior art, the beneficial effects of the anomaly detection device provided by the present application are the same as the beneficial effects of the anomaly detection method provided by the above embodiment, and other technical features in the anomaly detection device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0157] The present application provides an anomaly detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the anomaly detection method in the above-mentioned embodiment 1.

[0158] Reference below Fig.13 , which shows a schematic diagram of the structure of an abnormality detection device suitable for implementing the embodiment of the present application. The abnormality detection device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.13 The abnormality detection device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0159] like Fig.13 As shown, the abnormality detection device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the abnormality detection device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the anomaly detection device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows an anomaly detection device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0160] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0161] The anomaly detection device provided in the present application adopts the anomaly detection method in the above-mentioned embodiment. Compared with the prior art, the beneficial effects of the anomaly detection device provided in the present application are the same as the beneficial effects of the anomaly detection method provided in the above-mentioned embodiment, and other technical features in the anomaly detection device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0162] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0163] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0164] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the anomaly detection method in the above-mentioned embodiment.

[0165] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0166] The computer-readable storage medium may be included in the abnormality detection device; or may exist independently without being assembled into the abnormality detection device.

[0167] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0168] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0169] The modules involved in the embodiments described in the present application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0170] The readable storage medium provided in the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned anomaly detection method, and can solve the technical problem of anomaly detection. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the present application are the same as the beneficial effects of the anomaly detection method provided in the above-mentioned embodiment, and will not be repeated here.

[0171] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned anomaly detection method when executed by a processor.

[0172] The computer program product provided by the present application can solve the technical problem of anomaly detection. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the anomaly detection method provided by the above embodiment, which will not be repeated here.

[0173] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Obtain traffic time series indicator data of the target container cluster based on preset time intervals; Based on a pre-built classification anomaly detection model, the traffic time series indicator data is classified and detected to obtain a traffic classification detection result; Anomaly identification is performed based on the traffic classification detection result.

2. The method according to claim 1, characterized in that The training process of the classification anomaly detection model includes: Obtain pre-classified historical traffic time series classification indicator data; Based on the historical traffic time series classification index data and the pre-built deep learning CNN neural network model, convolution classification training is performed to obtain a training index, wherein the training index includes at least one of a correct rate, a loss rate, and a correct number; When the training index reaches a preset index threshold and the stability reaches a preset stability threshold, a classification anomaly detection model is obtained.

3. The method according to claim 2, characterized in that The step of performing convolution classification training based on the historical traffic time series classification index data and the pre-built deep learning CNN neural network model to obtain the training index includes: Storing the historical traffic time series classification index in a preset character-separated value CSV file; Convert the CSV file into an array of indicator data; Converting the indicator data array into a model recognition tensor through a preset optimization algorithm; The model recognition tensor is sent into the CNN neural network model as a training input set, and convolution classification training is performed to obtain training indicators.

4. The method according to claim 1, characterized in that The step of performing classification detection on the traffic time series indicator data based on the pre-built classification anomaly detection model to obtain the traffic classification detection result includes: Generate a corresponding flow time series indicator data array based on the flow time series indicator data; The flow time series indicator data array is converted into a flow time series indicator original tensor matrix through a preset tensor conversion algorithm, and the flow time series indicator original tensor matrix includes a plurality of indicator matrix data points; According to the slope between adjacent indicator matrix data points, the original tensor matrix of the flow time series indicator is smoothed and supplemented to obtain the flow time series indicator detection tensor matrix; The flow time series indicator detection tensor matrix is ​​input into the classification anomaly detection model for classification detection to obtain a flow classification detection result.

5. The method according to claim 4, characterized in that The traffic classification detection result includes the traffic trend category of the traffic time series indicator within the time interval, and the step of performing anomaly identification based on the traffic classification detection result includes: If the traffic trend category is the preset target trend category, a secondary confirmation of abnormal identification is performed to obtain a secondary confirmation result; If the secondary confirmation result is confirmed abnormal, cluster indicator abnormal information is obtained, and the cluster indicator abnormal information includes at least one of alarm cluster information, abnormal indicator type, abnormal time point and abnormal status information; Determine the root cause of the fault according to the abnormal indicator type to obtain the estimated root cause of the fault; The cluster indicator abnormality information and the estimated root cause of the fault are returned to the pre-connected management terminal and stored in a preset fault information database.

6. The method according to claim 5, characterized in that The step of performing secondary confirmation of abnormal identification to obtain a secondary confirmation result comprises: Confirm whether the target traffic cluster log collection is in an available state. If not, generate an alarm to be confirmed instruction; or, Confirm whether the duration of the abnormal indicator exceeds the preset abnormal time threshold. If it exceeds, generate an alarm to be confirmed instruction; or, Confirm whether the abnormal indicator is a regular abnormal warning. If not, generate an alarm to be confirmed instruction; In response to the alarm to be confirmed instruction, confirm whether the target trend category is within the abnormal alarm cooling time; If the target trend category is not within the abnormal alarm cooling time, a confirmed abnormal result is generated.

7. An abnormality detection device, characterized in that: The device comprises: An acquisition module is used to obtain traffic time series indicator data of a target container cluster based on a preset time interval; A detection module, used to perform classification detection on the traffic time series indicator data based on a pre-built classification anomaly detection model to obtain a traffic classification detection result; An alarm module is used to identify anomalies based on the traffic classification detection results.

8. An abnormality detection device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the anomaly detection method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the abnormality detection method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the anomaly detection method according to any one of claims 1 to 6 are implemented.

Images