Server anomaly detection method and device, equipment and medium

Abstract

The invention provides a server anomaly detection method and device, equipment and a medium, and relates to the technical field of data processing, and the method comprises the steps: obtaining an original index value of each server of a data center at an ith moment; mining the relevance of the original index values to optimize the initial relevance weight matrix to obtain an optimized relevance weight matrix; according to original index values of the server to be detected in the data center and other servers at historical moments before the current moment and the optimized association weight matrix, obtaining an index prediction value of the server to be detected at the current moment; and according to the index prediction value of the to-be-detected server at the current moment, determining whether the to-be-detected server is abnormal at the current moment. According to the method, the index data associated with the to-be-detected server can be automatically determined from the whole data center, and the associated data are used for prediction, so that manual judgment of the association relationship between the server and the index is reduced, and the accuracy and efficiency of anomaly detection can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a server anomaly detection method, device, equipment and medium. Background Art

[0002] With the rapid development of modern Internet technology, servers have become the core infrastructure of many enterprises and organizations. However, servers are also facing challenges of various anomalies and failures, which may lead to service interruption, data loss and business damage. Therefore, server anomaly detection technology has become a key means to ensure the stable operation of servers.

[0003] Existing server anomaly detection technologies mainly include detection methods based on threshold overrun and detection methods based on statistical learning. The detection method based on threshold overrun determines whether a server is abnormal by presetting thresholds for various indicators, such as network traffic, CPU usage, memory usage, disk space usage, etc. When a certain indicator of the server exceeds the preset threshold, the server is considered to be abnormal. However, this method often fails to take into account the individual differences and dynamic changes between servers, which can easily lead to false positives or false negatives. Summary of the invention

[0004] The present application provides a server anomaly detection method, device, equipment and medium to solve the above-mentioned problems existing in the existing server anomaly detection methods.

[0005] In a first aspect, an embodiment of the present application provides a server anomaly detection method, the method comprising:

[0006] Obtaining the original index value of each server in the data center at the i-th moment, wherein the original index value includes the values ​​of multiple indicators;

[0007] Mining the relevance of the original indicator values ​​to optimize the initial association weight matrix to obtain an optimized association weight matrix, wherein the optimized association weight matrix is ​​used to predict the value of any indicator of any server in the data center at the i+τth moment;

[0008] Obtaining a predicted index value of the server to be detected at the current moment according to the original index values ​​of the server to be detected and other servers in the data center at historical moments before the current moment, and the optimized association weight matrix;

[0009] According to the predicted value of the indicator of the server to be detected at the current moment, it is determined whether the server to be detected is abnormal at the current moment.

[0010] In an optional implementation, determining whether the server to be detected is abnormal at the current moment according to the predicted index value of the server to be detected at the current moment includes:

[0011] Obtain the real value of the indicator of the server to be detected at the current moment;

[0012] When the difference between the predicted value of the indicator and the actual value of the indicator is greater than a preset threshold, determining that the server to be detected is abnormal at the current moment;

[0013] When the difference between the predicted value of the indicator and the actual value of the indicator is less than or equal to the preset threshold, it is determined that the server to be detected is normal at the current moment.

[0014] In an optional embodiment, the optimized association weight matrix is

[0015] represents the relevance of the servers in the entire data center to the value of the index x of the server j, where x represents the index of the server, the index x includes the first index a, the second index b and the third index c, and T represents transposition;

[0016] when When , there is no correlation between the values ​​of index b of server k and index x of server j;

[0017] when hour, The value indicates the strength of the correlation between the value of index b of server k and the value of index x of server j, k=1, 2, ...m.

[0018] In an optional implementation, the relevance of the original index values ​​is mined to optimize the initial relevance weight matrix to obtain an optimized relevance weight matrix, including:

[0019] The optimized association weight matrix is ​​obtained with the goal of minimizing the difference between the original indicator prediction value and the original indicator true value of the server.

[0020] In an optional implementation, the optimized association weight matrix is ​​obtained with the goal of minimizing the difference between the original indicator prediction value and the original indicator true value of the server, including:

[0021] The optimized association weight matrix is ​​obtained by minimizing the difference between the original indicator prediction value and the original indicator true value of the server and controlling the non-zero elements in the initial association weight matrix.

[0022] In an optional embodiment, the expression of the target is as follows:

[0023]

[0024] Among them, w x,j is the initial association weight matrix, is the optimized association weight matrix, α is the Lagrange multiplier, ||w x,j ||1 is w x,j The 1-normal form indicates that the sum of the absolute values ​​of the association weights between all the original index values ​​at the i-th moment is a preset value, which is used to control the number of non-zero elements. represents the square of the 2-norm, which is used to measure the difference between the original indicator prediction value of server j for indicator x and the original indicator true value. V represents the indicator state matrix corresponding to the original indicator value of each server in the data center at the i-th moment. represents the raw indicator prediction value of indicator x for server j.

[0025] In a second aspect, an embodiment of the present application provides a server anomaly detection device, the device comprising:

[0026] An acquisition module, used to acquire the original index value of each server in the data center at the i-th moment, wherein the original index value includes the values ​​of multiple indicators;

[0027] An optimization module, used for mining the relevance of the original indicator values ​​to optimize the initial association weight matrix to obtain an optimized association weight matrix, wherein the optimized association weight matrix is ​​used to predict the value of any indicator of any server in the data center at the i+τth moment;

[0028] A prediction module, used to obtain the predicted index value of the server to be detected at the current moment according to the original index values ​​of the server to be detected and other servers in the data center at historical moments before the current moment, and the optimized association weight matrix;

[0029] The determination module is used to determine whether the server to be detected is abnormal at the current moment according to the predicted index value of the server to be detected at the current moment.

[0030] In an optional implementation, the determining module includes:

[0031] The acquisition submodule is used to obtain the real value of the indicator of the server to be detected at the current moment;

[0032] An abnormality determination submodule, used to determine that the server to be detected is abnormal at the current moment when the difference between the predicted value of the indicator and the actual value of the indicator is greater than a preset threshold;

[0033] The normal determination submodule is used to determine that the server to be detected is normal at the current moment when the difference between the predicted value of the indicator and the actual value of the indicator is less than or equal to the preset threshold.

[0034] In a third aspect of an embodiment of the present application, an electronic device is proposed, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the server anomaly detection method described in any one of the first aspects above.

[0035] In a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the server anomaly detection method described in any one of the first aspects above is implemented.

[0036] The present application includes the following advantages: The present application proposes a server anomaly detection method, device, equipment and medium, firstly, by obtaining the original index value of each server in the data center at the i-th moment, the original index value includes the values ​​of multiple indicators; then, the correlation of the original index value is mined to optimize the initial correlation weight matrix to obtain the optimized correlation weight matrix, the optimized correlation weight matrix is ​​used to predict the value of any index of any server in the data center at the i+τth moment; further, according to the original index values ​​of the server to be detected and other servers in the data center at the historical moments before the current moment, and the optimized correlation weight matrix, the index prediction value of the server to be detected at the current moment is obtained; finally, according to the index prediction value of the server to be detected at the current moment, it is determined whether the server to be detected is abnormal at the current moment. Through this method, the index data related to the server to be detected can be automatically determined from the entire data center, and the associated data can be used for prediction, reducing the manual judgment of the relationship between the server and the index, and can effectively improve the accuracy and efficiency of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0038] Figure 1 It is a schematic diagram of the steps of a server anomaly detection method proposed in an embodiment of the present application;

[0039] Figure 2 It is a flow chart of a server abnormality checking method proposed in an embodiment of the present application;

[0040] Figure 3 It is a module schematic diagram of a server anomaly detection device proposed in an embodiment of the present application;

[0041] Figure 4 It is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0043] With the rapid development of modern Internet technology, servers have become the core infrastructure of many enterprises and organizations. However, servers are also facing challenges of various anomalies and failures, which may lead to service interruption, data loss and business damage. Therefore, server anomaly detection technology has become a key means to ensure the stable operation of servers.

[0044] Traditional server anomaly detection technologies mainly include detection methods based on threshold overrun and detection methods based on statistical learning. The detection method based on threshold overrun determines whether the server is abnormal by presetting thresholds of various indicators, such as network traffic, CPU (Central Processing Unit) usage, memory usage, disk space usage, etc. When a certain indicator of the server exceeds the preset threshold, it is considered that the server is abnormal. Specifically, based on the normal operating status of the server and the historical indicator values, a threshold is set for each indicator that needs to be measured, and the threshold is used to determine whether the server is abnormal.

[0045] Then, various performance indicators of the server are collected, which may include network traffic, CPU (Central Processing Unit) usage, memory usage, disk space usage, etc. After the data is collected, these indicators are monitored in real time and compared with the previously pre-set thresholds. If the actual detection value of a certain indicator exceeds the preset threshold, the system will consider that the server has an abnormality. Once an abnormality is detected, the monitoring system will notify the administrator through email, SMS, application notification, etc., so that timely measures can be taken. After receiving the alert, the administrator needs to further analyze the cause of the abnormality and take corresponding measures, such as restarting the service, adding resources, optimizing configuration, etc.

[0046] In addition, there is also analysis through abnormal behavior patterns, building a normal behavior profile by analyzing historical data, and real-time monitoring of behaviors that deviate from this profile to identify potential threats. For example, analyze the abnormal changes in server traffic within a specific time period. There is also anomaly detection through monitoring information, including log-based root cause location and trace-based root cause location, and anomaly detection through modeling, statistical analysis, and topological analysis. Based on this, the application proposes a method of relationship mining using multi-factor short-term data to automatically learn various status data of the server, thereby discovering abnormal behavior of the server.

[0047] However, the above methods often fail to take into account the individual differences and dynamic changes between servers, which can easily lead to false positives or missed negatives. For example, for dynamically changing systems, the setting of the above preset thresholds is not flexible enough to adapt to changes in system load. Improper threshold setting may lead to false positives (normal situations are misjudged as abnormal) or missed negatives (abnormal situations are not detected). For complex systems, a single threshold is difficult to cover all possible abnormal situations.

[0048] Based on the above problems, in the first aspect, the present application embodiment proposes a server abnormality detection method, referring to Figure 1 , Figure 1 The following is a flow chart of a method for checking server abnormality according to an embodiment of the present invention, wherein the method comprises the following steps:

[0049] Step 101: Obtain the original index value of each server in the data center at the i-th moment.

[0050] In order to statistically analyze the correlation between the index data of different servers in the data center, firstly, the original index values ​​of all servers in the same data center at the i-th moment are obtained. The above original index values ​​are the detection values ​​corresponding to the different indexes of the server at the i-th moment, which are the real values ​​corresponding to the server's indexes. The above indicators include but are not limited to CPU usage, network bandwidth and flow, server load, memory usage, IO status (referring to IO status), system average load, hard disk SMART status (Self-Monitoring Analysis and Reporting Technology, used to monitor the health status, performance and availability of the hard disk, and detect and prevent hard disk failures in advance), system resource usage, and hardware temperature monitoring. The above i-th moment refers to the historical moment relative to the current moment. By obtaining multiple original index values ​​between multiple servers, the accuracy of the predicted index value of the server can be improved.

[0051] The above method for obtaining the original indicator value may be to collect the real value corresponding to each indicator of each server in the data center through an indicator collection method.

[0052] In an example, if the time interval for collecting the original indicator value is set to 1 minute, it can be expressed in the following form using a matrix:

[0053]

[0054] Wherein, V represents the indicator status of all servers in the data center, a represents the first indicator, b represents the second indicator, c represents the third indicator, n represents the collection time of the indicator value, and m represents the number of servers in the data center. represents the value of the first indicator a of server m at the nth moment, represents the value of the second index b of server m at the nth moment, It represents the value of the third indicator c of server m at the nth moment, and n represents the time corresponding to the collection of the indicator.

[0055] In a possible implementation, the first indicator may be network traffic, the second indicator may be load, and the third indicator may be memory usage. The indicators may also be other indicators of the server. Here, only three indicators are used as examples for illustration. In the actual detection process, more than three indicators may be included, and more other indicators may be included. The actual detection process shall prevail.

[0056] Step 102: mining the relevance of the original index values ​​to optimize the initial relevance weight matrix to obtain an optimized relevance weight matrix.

[0057] After obtaining the original index values ​​of all servers in the data center, the correlations among all the original index values ​​are mined, and the initial correlation weight matrix is ​​optimized by mining the correlations among different original index values ​​to obtain an optimized correlation weight matrix.

[0058] It should be noted that the initial correlation weight matrix contains the initial correlation of each server in the data center to the original indicator value of a server. The optimization purpose is achieved by optimizing the correlation weights that have no correlation in the initial correlation weight matrix, or by reducing the difference between the indicator prediction value and the actual indicator value.

[0059] Specifically, the above optimized association weight matrix is ​​used to predict the value of any indicator of any server in the data center at the i+τth moment, that is, using the historical indicator value at the i-th moment to predict the indicator value after the τth moment.

[0060] In an example, if the number of servers in a data center is m, the original index includes a first index value, a second index value b, and a third index c, and the initial association weight matrix of the servers in the entire data center to the first index a of server j is expressed as:

[0061]

[0062] represents the correlation between the value of the first indicator a of server m and the value of the first indicator a of server j, represents the correlation between the value of the first indicator a of server m and the value of the first indicator b of server j, It represents the correlation between the value of the first indicator a and the value of the third indicator c of server m for server j. The correlation weights in the initial correlation weight matrix can be calculated by the sparse expression optimization method (LARS algorithm). The LARS (Least Angle Regression Stagewise) algorithm is a feature selection and regression coefficient calculation algorithm for linear regression problems, which aims to quickly find the features most relevant to the response variable and calculate the corresponding regression coefficients.

[0063] Step 103: Obtain the predicted index value of the server to be detected at the current moment based on the original index values ​​of the server to be detected and other servers in the data center at historical moments before the current moment, and the optimized association weight matrix.

[0064] After optimizing the initial association weight matrix, the server to be detected in the data center is determined, and the original index values ​​of the historical moments of other servers in the same data center as the server to be detected are obtained, where the historical moment refers to any moment before the current moment.

[0065] In one example, if the current moment is the i+τth moment, then the historical moment is the i-th moment.

[0066] It should be noted that the predicted index value of the server to be detected at the current moment is obtained based on the original index values ​​of the server to be detected and other servers in the data center at historical moments before the current moment and the optimized association weight matrix.

[0067] Step 104: Determine whether the server to be detected is abnormal at the current moment based on the predicted index value of the server to be detected at the current moment.

[0068] After obtaining the index prediction value of the server to be detected at the current moment, the state of the server to be detected at the current moment is judged based on the index prediction value. Compared with the existing method of detecting anomalies on servers, when making anomaly judgments on the server to be detected in this application, the influence of all servers in the data center on the index value of the server to be detected is considered, and the influence between multiple index values ​​is considered at the same time. By mining the correlation between multiple factors, this is used as the basis for predicting index values, which greatly improves the accuracy of the predicted index values. Compared with traditional manual detection, it saves time and is highly efficient.

[0069] The present application proposes a server anomaly detection method, which first obtains the original indicator values ​​of each server in the data center at the i-th moment, wherein the original indicator values ​​include the values ​​of multiple indicators; then, the correlation of the original indicator values ​​is mined to optimize the initial correlation weight matrix to obtain the optimized correlation weight matrix, and the optimized correlation weight matrix is ​​used to predict the value of any indicator of any server in the data center at the i+τ-th moment; further, based on the original indicator values ​​of the server to be detected and other servers in the data center at historical moments before the current moment, and the optimized correlation weight matrix, the indicator prediction value of the server to be detected at the current moment is obtained; finally, based on the indicator prediction value of the server to be detected at the current moment, it is determined whether the server to be detected is abnormal at the current moment.

[0070] This method can automatically determine the indicator data related to the server to be detected from the entire data center, and make predictions based on the associated data, reducing the need for manual judgment of the relationship between servers and indicators, and effectively improving the accuracy and efficiency of anomaly detection.

[0071] In an optional implementation, in the above step 104, determining whether the server to be detected is abnormal at the current moment according to the predicted index value of the server to be detected at the current moment specifically includes the following sub-steps:

[0072] Step 1041: Obtain the real value of the indicator of the server to be detected at the current moment.

[0073] Considering that directly comparing the predicted index value at a certain moment with the normal threshold value of the index may lead to false alarms or omissions. Based on this, the embodiment of the present application compares the index fluctuation value of the server to be detected at the current moment with the preset threshold value, and further determines whether the server is abnormal by determining whether the index fluctuation range of the server to be detected is abnormal. The dynamic threshold can be adaptively adjusted according to the actual performance of the server index, which is particularly useful for indicators with periodic fluctuations or trend changes. This method can avoid the problems that may be caused by static thresholds, such as erroneously triggering an alarm within the normal fluctuation range of the index, or failing to detect the problem in time when the index is truly abnormal. Reasonable threshold settings can avoid server overload problems caused by too high thresholds, or frequent false alarms caused by too low thresholds. This not only ensures the stability of the server, but also improves the reliability of the monitoring system.

[0074] Specifically, first obtain the real value of the indicator of the server to be detected at the current moment. For example, if the server to be detected is server j in the data center, and the value of the first indicator a of the server to be detected is predicted, then what is obtained is the real value corresponding to the first indicator a of server j at the current moment. The real indicator value obtained by detecting the first indicator value a of the server to be detected at the current moment can be expressed as

[0075] Step 1042: When the difference between the predicted value of the indicator and the actual value of the indicator is greater than a preset threshold, it is determined that the server to be detected is abnormal at the current moment.

[0076] It should be noted that the preset threshold is the fluctuation threshold of the server's indicator value. The dynamic threshold reduces the reliance on manual intervention and the maintenance cost caused by regular manual adjustment of the threshold. By automatically learning the historical change rules of the indicator and adjusting the threshold, the manual burden is reduced. Furthermore, the dynamic threshold can more accurately capture the abnormal changes of the indicator and avoid the decline in alarm quality caused by improper threshold setting. This method makes the alarm more accurate and ensures the relevance and timeliness of the alarm information. When the difference between the predicted value of the indicator and the actual value of the indicator is greater than the preset threshold, it is determined that the server to be detected is abnormal at the current moment. In this way, the accuracy of monitoring the abnormal state of the server to be detected can be improved, and false alarms and missed alarms can be reduced. This method can be more flexible and adaptable to changing business environments.

[0077] In order to ensure the accuracy of this judgment method, the absolute value of the difference between the predicted value of the indicator and the true value of the indicator is compared with the preset threshold.

[0078] In an example, assuming that the server to be detected is the kth server in the data center, the predicted index value obtained by predicting the first index value a of the server to be detected k at the current moment is expressed as The real index value obtained by detecting the first index value a of the server k to be detected at the current moment is expressed as The preset threshold is ε, and the absolute value of the difference between the predicted value of the indicator and the true value of the indicator is expressed as follows: like Then it is determined that the server k to be detected is abnormal. Furthermore, the system can issue an alarm in time to help the administrator quickly locate and solve the problem.

[0079] Step 1043: When the difference between the predicted value of the indicator and the actual value of the indicator is less than or equal to the preset threshold, determine that the server to be detected is normal at the current moment.

[0080] On the contrary, if the difference between the predicted value of the indicator and the actual value of the indicator is less than or equal to the preset threshold, it is determined that the server to be detected is normal at the current moment.

[0081] In an example, assuming that the server to be detected is the kth server in the data center, the predicted index value obtained by predicting the first index value a of the server to be detected k at the current moment is expressed as The real index value obtained by detecting the first index value a of the server k to be detected at the current moment is expressed as The preset threshold is ε, and the absolute value of the difference between the predicted value of the indicator and the true value of the indicator is expressed as follows: like It is determined that the server to be detected is normal.

[0082] In one example, let represents the value corresponding to the network traffic collected by server j in the data center at the i-th time. a, b, and c represent the server indicators respectively. a represents network traffic, b represents load, and c represents memory usage. Assuming that there are m servers in a data center, the server indicator state matrix of the entire data center at the i-th time is expressed as The linear regression model for predicting the index a of server j at time τ in advance is expressed as: Among them, w a,j is the initial association weight matrix, is the predicted value based on the initial association weight matrix, and τ is 1, 2, ..., 10, that is, the predicted value of the server j index x is obtained by 1 minute, 2 minutes, ..., 10 minutes in advance. After optimizing the initial association weight matrix, the optimized association weight matrix and the above linear regression model are used to obtain the predicted index value of the server to be detected.

[0083] Comparing the fluctuation range of server indicators with the threshold not only improves the accuracy and efficiency of monitoring, but also reduces maintenance costs, improves the quality of alarms, and makes server management more intelligent and automated.

[0084] In an optional implementation, the initial association weight matrix is ​​optimized, and the optimized association weight matrix is ​​expressed as The details are as follows:

[0085]

[0086] The optimized association weight matrix represents the association of the servers in the entire data center with respect to the index value x of server j, where x represents the index of the server, and the index x can be the first index a, the second index b and the third index c, and T represents transposition; when When , there is no correlation between the value of index b of server k and the value of index x of server j; when hour, The value indicates the strength of the correlation between the value of index b of server k and the value of index x of server j, k = 1, 2, ... m. For example, if The correlation between the value of index b of server k and the value of index x of server j is strong. It indicates that the correlation between the value of index b of server k and the value of index x of server j is weak.

[0087] In an optional implementation, in the above step 102, mining the relevance of the original index values ​​to optimize the initial relevance weight matrix to obtain an optimized relevance weight matrix specifically includes the following sub-steps:

[0088] Step 1021: With the goal of minimizing the difference between the original indicator prediction value and the original indicator true value of the server, the optimized association weight matrix is ​​obtained.

[0089] By optimizing the difference between the predicted value of the original indicator of the server and the actual value of the original indicator, the initial association weight matrix is ​​optimized to obtain the optimized association weight matrix. In this way, the accurate prediction of the server indicator value can be improved, and the accurate judgment of the server status can be further achieved.

[0090] In an example, suppose that the predicted value of the first indicator a of server j at the i+τth time is expressed as The true value of the first indicator a of server j at time i+τ is expressed as Vw a,j , then the optimization goal is The smaller the difference, the better the optimization effect, indicating that the predicted value of the indicator for server j at the i+τth moment is closer to the true value of the indicator, which is expressed as Vw a,j .

[0091] In an optional implementation, the above step 1041 aims to minimize the difference between the original indicator prediction value of the server and the original indicator true value to obtain the optimized association weight matrix, which specifically includes the following sub-steps:

[0092] Step 10411: With the goal of minimizing the difference between the original indicator prediction value of the server and the original indicator true value, and with the goal of controlling the non-zero elements in the initial association weight matrix, the optimized association weight matrix is ​​obtained.

[0093] Since the initial association weight matrix contains the association weights of all servers in the data center to the index value of a certain server, the initial association weight matrix contains all association weights with a correlation of 0 or a non-zero correlation. However, these association weights with a correlation of 0 are of little significance for the actual prediction of the index value of the server.

[0094] Based on this, the optimized association weight matrix is ​​obtained with the goal of minimizing the difference between the original indicator prediction value and the original indicator true value of the server and controlling the non-zero elements in the initial association weight matrix. That is, the zero association weights in the initial association weight matrix are optimized, and only non-zero association weights are included in the optimized association weight matrix.

[0095] Based on the above implementation, the expression of the above goal is as follows:

[0096]

[0097] In this target expression, w x,j is the initial association weight matrix, is the optimized association weight matrix, α is the Lagrange multiplier, ||w x,j ||1 is w x,j The 1-normal form indicates that the sum of the absolute values ​​of the association weights between all the original index values ​​at the i-th moment is a preset value, which is used to control the number of non-zero elements. represents the square of the 2-norm, which is used to measure the difference between the original indicator prediction value of server j for indicator value x and the original indicator true value. V represents the indicator state matrix corresponding to the original indicator value of each server in the data center at the i-th moment. Represents the original indicator prediction value of indicator value x of server j.

[0098] See also Figure 2 , Figure 2 This is a flow chart of a server anomaly detection method proposed in an embodiment of the present application. First, the values ​​corresponding to the indicator data of all servers included in the data center are collected, and the values ​​corresponding to the original data such as network traffic, server load, memory usage, etc. are collected for each server passing through the data center;

[0099] A regression model is established based on the collected index values. represents the network traffic value collected by server j in the data center at the i-th time. a, b, and c represent server indicators respectively. a represents network traffic, b represents load, and c represents memory usage. Assuming that there are m servers in a data center, the server indicator status of the entire data center at the i-th time is expressed as The linear regression model for predicting the network traffic of server j at time τ in advance is: The weight in the above formula

[0100] are the model parameters to be optimized, is the initial indicator forecast value.

[0101] Then the correlation of server indicators is mined, and the model parameter w is automatically calculated through the sparse expression optimization method (LARS algorithm) a,j , weight It represents the relevance of the servers in the entire data center for predicting the value of index a of the target server j. When , there is no correlation between the b index value of server k and the a index value of server j, otherwise The value indicates the strength of the correlation between the index value of server k and the index value of server j, k = 1, 2, ... m.

[0102] Finally, the associated data of the server to be detected, that is, the original indicator data, and the optimized associated weight matrix are input into the above regression model to predict the server indicators and obtain the indicator prediction value at the current moment. When the difference between the actual indicator value at the current moment and the indicator prediction value is greater than the preset threshold, it is judged whether the server is abnormal.

[0103] In a second aspect, the present application embodiment provides a server anomaly detection device, see Figure 3 , Figure 3 : is a module diagram of a server anomaly detection device proposed in an embodiment of the present application, the device comprising:

[0104] An acquisition module 301 is used to acquire the original index value of each server in the data center at the i-th moment, wherein the original index value includes the values ​​of multiple indicators;

[0105] An optimization module 302 is used to mine the relevance of the original indicator values ​​to optimize the initial association weight matrix to obtain an optimized association weight matrix, wherein the optimized association weight matrix is ​​used to predict the value of any indicator of any server in the data center at the i+τth moment;

[0106] Prediction module 303, used to obtain the predicted index value of the server to be detected at the current moment according to the original index values ​​of the server to be detected and other servers in the data center at historical moments before the current moment, and the optimized association weight matrix;

[0107] The determination module 304 is used to determine whether the server to be detected is abnormal at the current moment according to the predicted index value of the server to be detected at the current moment.

[0108] The present application proposes a server anomaly detection device for implementing the server anomaly detection method proposed in any one of the first aspects above, which can automatically determine the indicator data related to the server to be detected from the entire data center, and make predictions based on the associated data, thereby reducing manual judgment of the relationship between the server and the indicator, and can effectively improve the accuracy and efficiency of anomaly detection.

[0109] Wherein, the determination module includes:

[0110] The acquisition submodule is used to obtain the real value of the indicator of the server to be detected at the current moment;

[0111] An abnormality determination submodule, used to determine that the server to be detected is abnormal at the current moment when the difference between the predicted value of the indicator and the actual value of the indicator is greater than a preset threshold;

[0112] The normal determination submodule is used to determine that the server to be detected is normal at the current moment when the difference between the predicted value of the indicator and the actual value of the indicator is less than or equal to the preset threshold.

[0113] Among them, the optimized association weight matrix in the optimization module is

[0114] represents the relevance of the servers in the entire data center to the index value x of server j, where x represents the index value of the server, the index value x includes a first index value a, a second index value b and a third index value c, and T represents transposition;

[0115] when When , there is no correlation between the index value b of server k and the index value x of server j;

[0116] when hour, The value indicates the strength of the correlation between the index value b of server k and the index value x of server j, k = 1, 2, ... m.

[0117] Wherein, the optimization module includes:

[0118] The optimization submodule is used to obtain the optimized association weight matrix with the goal of minimizing the difference between the original indicator prediction value and the original indicator true value of the server.

[0119] Wherein, the optimization submodule includes:

[0120] The optimization unit is used to minimize the difference between the original indicator prediction value of the server and the original indicator true value, and to control the non-zero elements in the initial association weight matrix to obtain the optimized association weight matrix.

[0121] The expression of the objective in the optimization unit is as follows:

[0122]

[0123] Among them, w x,j is the initial association weight matrix, is the optimized association weight matrix, α is the Lagrange multiplier, ||w x,j ||1 is w x,j The 1-normal form indicates that the sum of the absolute values ​​of the association weights between all the original index values ​​at the i-th moment is a preset value, which is used to control the number of non-zero elements. represents the square of the 2-norm, which is used to measure the difference between the original indicator prediction value of server j for indicator value x and the original indicator true value. V represents the indicator state matrix corresponding to the original indicator value of each server in the data center at the i-th moment. Represents the original indicator prediction value of indicator value x of server j.

[0124] Based on the same application concept, the embodiment of the present application discloses an electronic device in a third aspect. Figure 4 A schematic diagram of an electronic device disclosed in an embodiment of the present application is shown. Figure 4 As shown, the electronic device 100 includes: a memory 110 and a processor 120, the memory of the electronic device is not less than 12G, the main frequency of the processor is not less than 2.4GHz, the memory 110 and the processor 120 are connected via a bus communication, and a computer program is stored in the memory 110. The computer program can be run on the processor 120 to implement a server anomaly detection method disclosed in an embodiment of the present application.

[0125] Based on the same application concept, the fourth aspect of the embodiment of the present application discloses a computer-readable storage medium, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, a server anomaly detection method disclosed in the embodiment of the present application is implemented.

[0126] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0127] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, apparatuses, electronic devices, and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0128] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0129] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0130] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0131] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0132] The above is a detailed introduction to a server anomaly detection method, device, equipment and medium provided by the present application. This article uses specific examples to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A server anomaly detection method, characterized in that: The method comprises: Obtaining the original index value of each server in the data center at the i-th moment, wherein the original index value includes the values ​​of multiple indicators; Mining the relevance of the original indicator values ​​to optimize the initial association weight matrix to obtain an optimized association weight matrix, wherein the optimized association weight matrix is ​​used to predict the value of any indicator of any server in the data center at the i+τth moment; Obtaining a predicted index value of the server to be detected at the current moment according to the original index values ​​of the server to be detected and other servers in the data center at historical moments before the current moment, and the optimized association weight matrix; According to the predicted value of the indicator of the server to be detected at the current moment, it is determined whether the server to be detected is abnormal at the current moment.

2. The server anomaly detection method according to claim 1, characterized in that: Determining whether the server to be detected is abnormal at the current moment according to the predicted index value of the server to be detected at the current moment includes: Obtain the real value of the indicator of the server to be detected at the current moment; When the difference between the predicted value of the indicator and the actual value of the indicator is greater than a preset threshold, determining that the server to be detected is abnormal at the current moment; When the difference between the predicted value of the indicator and the actual value of the indicator is less than or equal to the preset threshold, it is determined that the server to be detected is normal at the current moment.

3. The server anomaly detection method according to claim 1, characterized in that: The optimized association weight matrix is: represents the relevance of the servers in the entire data center to the value of the index x of the server j, where x represents the index of the server, the index x includes the first index a, the second index b and the third index c, and T represents transposition; when When , there is no correlation between the values ​​of index b of server k and index x of server j; when hour, The value indicates the strength of the correlation between the value of index b of server k and the value of index x of server j, k=1, 2, ...m.

4. The server anomaly detection method according to claim 1, characterized in that: Mining the relevance of the original index values ​​to optimize the initial relevance weight matrix to obtain an optimized relevance weight matrix, including: The optimized association weight matrix is ​​obtained with the goal of minimizing the difference between the original indicator prediction value and the original indicator true value of the server.

5. The server anomaly detection method according to claim 4, characterized in that: With the goal of minimizing the difference between the original indicator prediction value and the original indicator true value of the server, the optimized association weight matrix is ​​obtained, including: The optimized association weight matrix is ​​obtained by minimizing the difference between the original indicator prediction value and the original indicator true value of the server and controlling the non-zero elements in the initial association weight matrix.

6. The server anomaly detection method according to claim 5, characterized in that: The expression of the target is as follows: Among them, w x,j is the initial association weight matrix, is the optimized association weight matrix, α is the Lagrange multiplier, ||w x,j ||1 is w x,j The 1-normal form indicates that the sum of the absolute values ​​of the association weights between all the original index values ​​at the i-th moment is a preset value, which is used to control the number of non-zero elements. represents the square of the 2-norm, which is used to measure the difference between the original indicator prediction value of server j for indicator x and the original indicator true value. V represents the indicator state matrix corresponding to the original indicator value of each server in the data center at the i-th moment. represents the raw indicator prediction value of indicator x for server j.

7. A server anomaly detection device, characterized in that: The device comprises: An acquisition module, used to acquire the original index value of each server in the data center at the i-th moment, wherein the original index value includes the values ​​of multiple indicators; An optimization module, used for mining the relevance of the original indicator values ​​to optimize the initial association weight matrix to obtain an optimized association weight matrix, wherein the optimized association weight matrix is ​​used to predict the value of any indicator of any server in the data center at the i+τth moment; A prediction module, used to obtain the predicted index value of the server to be detected at the current moment according to the original index values ​​of the server to be detected and other servers in the data center at historical moments before the current moment, and the optimized association weight matrix; The determination module is used to determine whether the server to be detected is abnormal at the current moment according to the predicted index value of the server to be detected at the current moment.

8. The server anomaly detection device according to claim 7, characterized in that: The determination module comprises: The acquisition submodule is used to obtain the real value of the indicator of the server to be detected at the current moment; An abnormality determination submodule, used to determine that the server to be detected is abnormal at the current moment when the difference between the predicted value of the indicator and the actual value of the indicator is greater than a preset threshold; The normal determination submodule is used to determine that the server to be detected is normal at the current moment when the difference between the predicted value of the indicator and the actual value of the indicator is less than or equal to the preset threshold.

9. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the server anomaly detection method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that: A computer program / instruction is stored thereon, and when the computer program / instruction is executed by a processor, the server anomaly detection method described in any one of claims 1-6 is implemented.

Images