Abnormity identification method and device of virtual machine, storage medium and electronic equipment

Abstract

The invention discloses an exception identification method and device of a virtual machine, a storage medium and electronic equipment. The method comprises the following steps: acquiring running state data of a plurality of virtual machines; dimension reduction processing is carried out on the operation state data of the multiple virtual machines, and dimension reduction data corresponding to the multiple virtual machines are determined; determining dimensionality reduction cost values generated from dimensionality reduction of the operation state data of the multiple virtual machines to dimensionality reduction data; and under the condition that the dimension reduction cost value is smaller than or equal to a preset cost threshold value, performing anomaly analysis based on the dimension reduction data corresponding to the plurality of virtual machines respectively to obtain anomaly identification results corresponding to the plurality of virtual machines respectively. According to the method and the device, the technical problem of non-ideal abnormal recognition efficiency of the virtual machine in the related technology is solved.

Description

Technical Field

[0001] The present application relates to the fields of virtualization technology and cloud computing technology, and in particular to a method, device, storage medium and electronic device for identifying anomalies of a virtual machine. Background Art

[0002] A virtual machine is a technology that simulates hardware functions through software, allowing multiple independent operating system instances to run on a physical computer. Through virtualization technology, a physical server can be divided into multiple virtual machines, each of which can run different operating systems and applications. Virtual machines can provide isolation, flexibility, and portability.

[0003] Virtual machine technology is one of the core foundations of cloud computing. Cloud computing platforms usually use virtual machine technology to virtualize and isolate resources to provide more efficient, flexible and scalable computing services. Cloud computing platforms can automatically create, destroy and migrate virtual machines as needed, and dynamically allocate computing resources according to load conditions. Virtual machines enable cloud computing platforms to achieve multi-tenant resource sharing, high availability and elastic scaling.

[0004] At present, the operation and maintenance department uses various professional tools to conduct hierarchical monitoring and remote inspections of cloud computing platforms. The operation and maintenance personnel enter the computer room every day to conduct on-site inspections of the hardware equipment status of the system. Usually, professional tools are mostly used for remote inspections and are deployed in a scattered manner. Monitoring data is obtained by manual statistics, which is labor-intensive and inefficient. It is also difficult to mine the value of monitoring data, and it is impossible to perform abnormal analysis based on monitoring data, and thus it is impossible to issue abnormal warnings for the operating status of the virtual machines on the cloud computing platform. There is a problem of unsatisfactory efficiency in identifying abnormalities in the virtual machine status.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present application provide a method, device, storage medium and electronic device for identifying anomalies of a virtual machine, so as to at least solve the technical problem of unsatisfactory efficiency of identifying anomalies of a virtual machine in the related art.

[0007] According to one aspect of an embodiment of the present application, a method for identifying anomalies of a virtual machine is provided, including: obtaining operating status data of multiple virtual machines; performing dimensionality reduction processing on the operating status data of the multiple virtual machines respectively, and determining the reduced dimensionality data corresponding to the multiple virtual machines respectively; determining dimensionality reduction cost values ​​generated by reducing the operating status data of the multiple virtual machines to the reduced dimensionality data respectively; when the dimensionality reduction cost values ​​are less than or equal to a predetermined cost threshold, performing anomaly analysis based on the reduced dimensionality data corresponding to the multiple virtual machines respectively, and obtaining anomaly identification results corresponding to the multiple virtual machines respectively.

[0008] According to another aspect of an embodiment of the present application, a device for identifying anomalies of a virtual machine is provided, including: a data acquisition module, used to acquire operating status data of multiple virtual machines; a dimensionality reduction module, used to perform dimensionality reduction processing on the operating status data of multiple virtual machines respectively, and determine the reduced dimensionality data corresponding to the multiple virtual machines respectively; a cost value determination module, used to determine the dimensionality reduction cost values ​​generated by reducing the operating status data of multiple virtual machines to the reduced dimensionality data respectively; an anomaly analysis module, used to perform anomaly analysis based on the reduced dimensionality data corresponding to the multiple virtual machines respectively when the dimensionality reduction cost value is less than or equal to a predetermined cost threshold, and obtain anomaly identification results corresponding to the multiple virtual machines respectively.

[0009] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, wherein the non-volatile storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing any one of the methods for identifying an abnormality of a virtual machine.

[0010] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the virtual machine exception identification methods.

[0011] In the embodiment of the present application, the operation status data of multiple virtual machines are obtained; the operation status data of multiple virtual machines are respectively subjected to dimensionality reduction processing to determine the dimensionality reduction data corresponding to the multiple virtual machines; the dimensionality reduction cost values ​​generated by reducing the operation status data of multiple virtual machines to the dimensionality reduction data are determined; when the dimensionality reduction cost value is less than or equal to the predetermined cost threshold, anomaly analysis is performed based on the dimensionality reduction data corresponding to the multiple virtual machines to obtain the anomaly identification results corresponding to the multiple virtual machines. The purpose of non-intrusive data extraction and dimensionality reduction analysis is achieved to reduce the computational overhead of virtual machine anomaly identification, and the technical effect of improving anomaly detection efficiency is achieved, thereby solving the technical problem of unsatisfactory anomaly identification efficiency of virtual machines in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0013] Figure 1 is a flowchart of an optional method for identifying anomalies of a virtual machine provided according to an embodiment of the present application;

[0014] Figure 2 is a schematic diagram of an optional method for identifying abnormalities of a virtual machine provided according to an embodiment of the present application;

[0015] Figure 3 It is a schematic diagram of an optional virtual machine anomaly identification device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0017] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0018] According to an embodiment of the present application, a method embodiment of abnormal identification of a virtual machine is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0019] Figure 1 is a flowchart of a method for identifying anomalies of a virtual machine according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0020] Step S102, obtaining operation status data of multiple virtual machines;

[0021] It can be understood that, through the pre-deployed data extraction module, the real-time operating status parameters of multiple virtual machines are collected from the virtualization layer, including CPU, memory, disk and network status data.

[0022] In an optional embodiment, multiple virtual machines share a virtualization layer, and the virtualization layer is used to allocate virtualization resources to the virtual machines and obtain the operating status data of the multiple virtual machines, including: establishing communication interaction with the virtualization layer; using a non-invasive data extraction module to obtain the operating status data of the multiple virtual machines through the virtualization layer.

[0023] It is understandable that a communication connection needs to be established with the virtualization layer, which is an intermediate software layer that manages the relationship between virtual machines and physical resources and is responsible for resource allocation and virtual machine operation control. By establishing communication, the data extraction module can directly obtain information from the virtualization layer without directly accessing or affecting the operating environment of the virtual machine, ensuring the non-intrusiveness of anomaly detection. Using the data extraction module, it is possible to collect the operating status data of multiple virtual machines through the virtualization layer without interfering with the normal operation of the virtual machine. The operating status data includes but is not limited to key performance indicators such as CPU, memory, disk I / O, network traffic, as well as log information and virtual machine configuration parameters.

[0024] The non-intrusive monitoring method avoids the negative impact of data collection on the performance of the virtual machine and will not affect the normal operation of the virtual machine. At the same time, data exchange through the virtualization layer can also increase the security of the monitoring system, prevent data leakage or tampering, and provide strong support for virtual machine anomaly detection and resource optimization.

[0025] Optionally, based on the pre-deployed data extraction module, the interaction between the data extraction module and the virtualization layer in the virtual environment is established, and the data extraction module is one or more of a custom script tool, a data integration tool, a log collection tool, and a data replication tool. The data extraction module can extract data by logging into the virtual machine.

[0026] There are many types of custom script tools, including, for example, Python scripts, which use Python to write scripts and extract data through the virtual machine's API (Application Programming Interface); PowerShell scripts, which can use PowerShell to extract data in Windows virtualization environments. The API can be different virtualization interface types such as VMware API, Hyper-V WMI, etc.

[0027] There are many types of data integration tools, including, for example: Informatica Virtual Data Machine (VDM): an ETL (Extract-Transform-Load) tool designed specifically for virtualized environments; Talend for Virtual Appliances: supports data integration and data extraction in virtualized environments.

[0028] There are many log collection tools, such as Splunk, which can collect and analyze log data generated by virtual machines; ELK Stack (Elasticsearch, Logstash, Kibana), which is used to process and analyze log data and can extract logs from virtual machines.

[0029] There are many types of data replication tools, including, for example: Zerto Virtual Machine Real-time Replication System (Zerto VirtualReplication): used for real-time replication and migration of virtual machine data; Double-Take High Availability Solution (Double-Take Availability): provides real-time data replication and failover functions for virtual machines.

[0030] Optionally, based on the data extraction module, the operating status data of several virtual machines in the virtualization layer are collected; wherein the operating status data of each virtual machine is the operating parameters of each virtual machine executing the pre-assigned task, and the operating parameters include at least: CPU (Central Processing Unit) status data, memory status data, disk status data and network status data; wherein the CPU status data includes parameters such as CPU main frequency, CPU utilization, CPU running time, etc.; the memory status data includes parameters such as total physical memory, used physical memory, free memory, shared memory, cache and buffer memory and available memory, etc.; the disk status data includes parameters such as disk usage capacity, read and write speed and number of I / O operations, etc.; the network status data includes parameters such as connection status, transmission rate, network utilization, delay and packet loss, etc.

[0031] By deploying the data extraction module in a virtual environment, the data extraction module can establish communication with the virtualization layer. After establishing communication, the data extraction module can directly collect the operating status data of several virtual machines in the virtualization layer; since the data extraction module is an independently running software entity, it does not rely on the operating system or application inside the virtual machine. Therefore, during the data collection process, the data extraction module will not modify any configuration or status of the virtual machine, ensuring the non-invasiveness of the monitoring operation.

[0032] It should be noted that when a virtual machine executes different tasks, different running status data will be generated; when different virtual machines execute the same type of tasks, the running status data generated are also basically the same.

[0033] Step S104, performing dimensionality reduction processing on the running status data of the multiple virtual machines respectively, and determining the dimensionality reduction data corresponding to the multiple virtual machines respectively;

[0034] It can be understood that the purpose of dimensionality reduction processing on the collected high-dimensional operating status data is to reduce the data dimension and simplify the subsequent anomaly analysis calculations, while trying to preserve the relative relationship between virtual machine states. During the dimensionality reduction process, the data of each virtual machine is converted into points in a low-dimensional space, i.e., dimensionality-reduced data. Through the above processing, the computing resources and time required for processing data are greatly reduced, so that anomaly detection can be carried out quickly, and the response speed of the entire monitoring system is improved.

[0035] Optionally, the collected running status data of several virtual machines are preprocessed respectively to obtain key monitoring data of each virtual machine, wherein the preprocessing includes: data cleaning, data conversion and data dimension reduction.

[0036] The running status data of each virtual machine is cleaned and converted to obtain the converted running status data of each virtual machine; wherein, data cleaning can remove invalid, erroneous or duplicated data, and data conversion can convert data in different formats into a unified format to facilitate subsequent analysis; the converted running status data of each virtual machine is stored in the database of the server.

[0037] The converted running status data of each virtual machine is subjected to data dimensionality reduction to obtain the running status data of each virtual machine after dimensionality reduction, and the running status data of each virtual machine after dimensionality reduction is used as the key monitoring data of each virtual machine.

[0038] It should be noted that since the running status data of the virtual machine has multiple types, each type represents a dimension, the original running status data of the virtual machine is high-dimensional data. Directly using high-dimensional data will increase the overhead of subsequent abnormality analysis. Therefore, it is necessary to reduce the dimensionality of the high-dimensional running status data of the virtual machine.

[0039] Step S106, determining dimensionality reduction cost values ​​generated by reducing the dimension of the operating status data of the plurality of virtual machines to the dimensionality reduction data;

[0040] It can be understood that by comparing the data distribution before and after dimensionality reduction and calculating the cost value (i.e., distribution deviation) during dimensionality reduction, it is ensured that dimensionality reduction will not be over-simplified, so as to lose important anomaly detection information.

[0041] In an optional embodiment, determining dimensionality reduction cost values ​​generated by reducing the dimension of the operating status data of multiple virtual machines to the reduced dimension data includes: dividing the multiple virtual machines according to the pre-allocated tasks corresponding to the multiple virtual machines, and determining similar sets corresponding to the multiple virtual machines, wherein the similar sets include a predetermined number of virtual machines that are the same as the pre-allocated tasks of the corresponding virtual machines; based on the operating status data and the similar sets corresponding to the multiple virtual machines, using a Gaussian distribution probability model, determining the first distribution probabilities corresponding to the multiple virtual machines; based on the reduced dimension data and the similar sets corresponding to the multiple virtual machines, using a continuous probability distribution model, determining the second distribution probabilities corresponding to the multiple virtual machines; and determining the dimensionality reduction cost values ​​generated by the multiple virtual machines based on the difference between the first distribution probabilities corresponding to the multiple virtual machines and the corresponding second distribution probabilities.

[0042] It can be understood that according to the pre-assigned tasks performed by each virtual machine, all virtual machines are classified to identify a set of virtual machines with the same or similar tasks, i.e., similar sets. Each similar set contains a predetermined number of other virtual machines that perform the same task as a specific virtual machine. The purpose is to provide a reasonable data comparison benchmark for the subsequent dimensionality reduction and anomaly detection process, i.e., the operating state of the virtual machine under similar tasks. Based on the high-dimensional operating state data of each virtual machine (such as CPU utilization, memory usage, disk I / O rate, etc.), and their similar sets, a Gaussian distribution probability model is used to determine the first distribution probability of each virtual machine in the high-dimensional space. The Gaussian model is a statistical model used to describe the distribution of the operating state data of a virtual machine in a similar set when performing a specific task, which helps to quantify the position and characteristics of each virtual machine in the high-dimensional space. According to the distribution of its operating state data in a similar set, it helps to quantify the position and characteristics of each virtual machine in the high-dimensional space. After the dimensionality reduction process, the high-dimensional operating state data of each virtual machine is converted into reduced dimensionality data (for example, from multi-dimensional to two-dimensional or three-dimensional). Then, based on the reduced-dimensional data and its similar sets, a continuous probability distribution model is used to determine the second distribution probability of each virtual machine in the reduced-dimensional space. The distribution description suitable for reduced-dimensional data helps to evaluate the degree to which the dimensionality reduction process retains the data distribution characteristics.

[0043] The dimensionality reduction cost of each virtual machine is determined by calculating the difference between the first distribution probability and the second distribution probability of each virtual machine. The dimensionality reduction cost reflects the degree of influence of the dimensionality reduction operation on the distribution of the original high-dimensional data. A low dimensionality reduction cost indicates that the dimensionality reduction process effectively retains the similarity and structure between the data, which helps to improve the efficiency of anomaly detection.

[0044] Optionally, the converted running state data of each virtual machine is subjected to data dimensionality reduction to obtain the running state data of each virtual machine after dimensionality reduction (i.e., dimensionality reduction data), including: creating a similar set for each virtual machine according to the pre-allocated tasks performed by each virtual machine, wherein the similar set includes multiple similar virtual machines; combining all virtual machines into a set to obtain a virtual machine set; selecting a virtual machine from the virtual machine set to extract the pre-allocated tasks of the virtual machine; and selecting a preset number of virtual machines from the remaining virtual machines in the virtual machine set, wherein the types of the pre-allocated tasks of the preset number of virtual machines are the same as the types of the pre-allocated tasks of the virtual machine.

[0045] All other virtual machines that perform the same task as the selected virtual machine are found in the virtual machine set, and a certain proportion of virtual machines are selected from the other virtual machines, such as a predetermined percentage of the total number of other virtual machines, such as 30% to 50%.

[0046] A preset number of virtual machines corresponding to the selected virtual machine is taken as a set to obtain a similar set of the virtual machine, and a preset number of virtual machines in the similar set of the virtual machine are taken as a plurality of similar virtual machines.

[0047] Reselect a new virtual machine from the virtual machine set, and re-screen the similar set of the new virtual machine until every virtual machine in the virtual machine set is selected to obtain the similar set of each virtual machine; at this point, each virtual machine has a similar set, which ensures that all virtual machines participate in dimensionality reduction and can greatly improve the algorithm operation speed with a low loss in accuracy.

[0048] Optionally, the similarity set setting method can be set according to specific needs. When the total number of virtual machines is small, a smaller similarity set can be selected because the similarity between each virtual machine is higher; when the number of virtual machines is large, a larger similarity set needs to be selected to ensure the accuracy of the dimensionality reduction result. When the number of pre-assigned task types is small, a smaller similarity set can be selected because the number of virtual machines of the same task type is large; when the number of pre-assigned task types is large, a larger comparison data set needs to be selected to ensure that virtual machines between different task types can also be effectively included.

[0049] Optionally, a cost value is calculated based on the first distribution probability and the second distribution probability of each virtual machine; wherein the cost value is solved using a KL distance function, and the KL distance function is Kullback-Leibler Divergence, which is a method for measuring the difference between two probability distributions.

[0050] In an optional embodiment, the method also includes: when there is a first virtual machine among multiple virtual machines whose dimensionality reduction cost value is greater than a predetermined cost threshold, adjusting the dimensionality reduction data corresponding to the first virtual machine to obtain adjusted dimensionality reduction data; determining an adjusted second distribution probability of the first virtual machine based on the adjusted dimensionality reduction data; determining an adjusted dimensionality reduction cost value based on the difference between the first distribution probability corresponding to the first virtual machine and the adjusted second distribution probability; until the adjusted dimensionality reduction cost value is less than or equal to the predetermined cost threshold, performing anomaly analysis based on the adjusted dimensionality reduction data corresponding to the first virtual machine to obtain anomaly identification results corresponding to the first virtual machine.

[0051] It can be understood that after the preliminary dimensionality reduction processing, by calculating the dimensionality reduction cost value, the first virtual machines whose dimensionality reduction cost values ​​are greater than the predetermined cost threshold are identified. The dimensionality reduction data of these virtual machines may not well retain their distribution characteristics in the high-dimensional space. For each identified first virtual machine, the corresponding dimensionality reduction data is adjusted so that the distribution of the data in the dimensionality reduction space is closer to its distribution in the high-dimensional space. The position of the virtual machine is adjusted in the dimensionality reduction space to better reflect its relationship with other virtual machines in the similar set. Based on the adjusted dimensionality reduction data, the second distribution probability of the first virtual machine is recalculated, and the dimensionality reduction cost value, that is, the difference between the first distribution probability and the new second distribution probability, is calculated again. The above adjustment and recalculation process is iterative until the adjusted dimensionality reduction cost value is less than or equal to the predetermined cost threshold. It means that the distribution of the data after dimensionality reduction is close enough to the distribution of the original high-dimensional data to ensure the accuracy and efficiency of the abnormality analysis. Once the dimensionality reduction cost value of the first virtual machine meets the conditions, the abnormality analysis is performed based on its adjusted dimensionality reduction data to obtain the abnormality identification result. By using the optimized dimensionality reduction data, the abnormal state of the virtual machine can be detected more accurately.

[0052] By iteratively optimizing and adjusting the dimensionality reduction data, we ensure that the dimensionality reduction process retains the structure and meaning of the virtual machine's operating status data as much as possible, thereby improving the accuracy of anomaly detection. For virtual machines with different data distribution characteristics, we can automatically adjust the dimensionality reduction data to ensure that the anomaly analysis strategy can adapt to the operating status of different virtual machines, thereby improving the overall adaptability and flexibility of the system.

[0053] Optionally, based on the optimization algorithm, the position of each virtual machine in the low-dimensional space is adjusted, and the cost value is recalculated until the cost value reaches a preset value; low-dimensional feature data (reduced dimensionality data) of each virtual machine is obtained, such as two-dimensional feature data, and the low-dimensional feature data of each virtual machine is used as the operating status data of each virtual machine after dimensionality reduction.

[0054] In an optional embodiment, based on the running status data and similar sets respectively corresponding to the multiple virtual machines, a Gaussian distribution probability model is used to determine the first distribution probabilities respectively corresponding to the multiple virtual machines, including: for each virtual machine among the multiple virtual machines, based on the running status data corresponding to each virtual machine and the running status data corresponding to other virtual machines included in the similar set corresponding to each virtual machine, a cosine similarity function is used to determine the similarity sequence of each virtual machine; the similarity sequences of the multiple virtual machines are input into the Gaussian distribution probability model for processing to determine the first distribution probabilities respectively corresponding to the multiple virtual machines.

[0055] It can be understood that for each virtual machine, the cosine similarity function is used to compare its running state data with the running state data of other virtual machines in the similar set to generate a similarity sequence. Cosine similarity is a statistical measure of the angle between two vectors, which is applicable to multidimensional data space and can reflect the similarity of the running states between virtual machines. The running state data of each virtual machine can be regarded as a point or vector in a high-dimensional space, and the similarity sequence represents the degree of similarity between the running state of the virtual machine and other similar virtual machines. The calculated similarity sequence is used as input and processed by the Gaussian distribution probability model to obtain the first distribution probability of each virtual machine. Gaussian distribution (i.e., normal distribution) is a widely used continuous probability distribution, which is suitable for describing the probability distribution of many random variables in nature and engineering. The Gaussian model is used to describe the running state distribution of virtual machines in a similar set. The first distribution probability reflects the position and characteristics of the virtual machine in the high-dimensional space, as well as the conditional probability distribution between them and other virtual machines in the similar set.

[0056] Through similarity sequences and first distribution probabilities, we can understand the operating status of virtual machines from a statistical and probabilistic perspective, providing a more comprehensive and in-depth data perspective for anomaly detection, and helping to achieve more accurate anomaly warnings.

[0057] Optionally, a high-dimensional space is constructed according to the operating status data of each virtual machine, and each dimension of the high-dimensional space is used to characterize an operating parameter of the virtual machine.

[0058] In a high-dimensional space, based on a Gaussian distribution probability model and a similarity set of each virtual machine, a first distribution probability of each virtual machine is calculated; specifically, for each virtual machine, the similarity between the virtual machine and multiple similar virtual machines in a similarity set corresponding to the virtual machine is calculated to obtain a similarity sequence, and the similarity sequence is input into a Gaussian distribution probability model to obtain a conditional distribution probability between the virtual machine and multiple similar virtual machines, and the conditional distribution probability of the virtual machine is used as the first distribution probability of the virtual machine; wherein, the similarity between the virtual machine and multiple similar virtual machines in a similarity set corresponding to the virtual machine is calculated using a cosine similarity function, using the data of each virtual machine in the high-dimensional space to calculate the similarity.

[0059] In an optional embodiment, based on the dimensionality reduction data and similarity sets respectively corresponding to the multiple virtual machines, a continuous probability distribution model is used to determine the second distribution probabilities respectively corresponding to the multiple virtual machines, including: for each virtual machine among the multiple virtual machines, based on the dimensionality reduction data corresponding to each virtual machine and the dimensionality reduction data corresponding to other virtual machines included in the similarity set corresponding to each virtual machine, a cosine similarity function is used to determine the similarity sequence of each virtual machine; the similarity sequences of the multiple virtual machines are input into the continuous probability distribution model for processing to determine the second distribution probabilities respectively corresponding to the multiple virtual machines.

[0060] It can be understood that, unlike the previous generation of similarity sequences based on high-dimensional running status data, the reduced-dimensional data is used to calculate the similarity between each virtual machine and other virtual machines in the similar set. The reduced-dimensional data of each virtual machine (such as the representation in two-dimensional or three-dimensional space) is compared with the reduced-dimensional data of other virtual machines in the similar set using the cosine similarity function to generate a similarity sequence that reflects the position and relationship of the virtual machine in the low-dimensional space after dimensionality reduction. The calculated similarity sequence is used as input and processed by a continuous probability distribution model (such as the t-distribution model) to obtain the second distribution probability of each virtual machine. The t-distribution model is a statistical model suitable for describing the distribution of low-dimensional data and is widely used in the field of data dimensionality reduction (such as the t-SNE algorithm). Compared with the Gaussian distribution model, the t-distribution model helps to maintain the local similarity between points when describing data in low-dimensional space, while reducing the data crowding problem when mapping from high dimension to low dimension.

[0061] Optionally, a low-dimensional space is randomly generated, and each virtual machine in the high-dimensional space is projected to the low-dimensional space. After each virtual machine is projected to the low-dimensional space, each virtual machine has a corresponding position in the low-dimensional space, and this position can be adjusted in subsequent steps.

[0062] In low-dimensional space, based on the t-distribution probability model (Student's t-distribution, continuous probability distribution) and the similarity set of each virtual machine, the second distribution probability of each virtual machine is calculated. For each virtual machine, the similarity between the virtual machine and multiple similar virtual machines in the similarity set corresponding to the virtual machine is calculated, and a similarity sequence can be obtained by calculating using the cosine similarity function. In low-dimensional space, the current low-dimensional feature data of each virtual machine in the low-dimensional space is used as the input of the cosine similarity function.

[0063] By inputting the similarity sequence into the t distribution probability model, a second distribution probability of each virtual machine obeying the t distribution can be obtained. This embodiment can avoid crowding of data after dimensionality reduction by using the t distribution model.

[0064] Step S108, when the dimensionality reduction cost is less than or equal to the predetermined cost threshold, anomaly analysis is performed based on the dimensionality reduction data corresponding to the multiple virtual machines respectively, to obtain anomaly identification results corresponding to the multiple virtual machines respectively.

[0065] It can be understood that when the dimensionality reduction cost is within an acceptable range (i.e., less than or equal to a predetermined cost threshold), the reduced data can be used for anomaly analysis to identify the abnormal state of the virtual machine, for example, by calculating the local density and local outlier factor, to obtain the anomaly identification result for each virtual machine.

[0066] In an optional embodiment, anomaly analysis is performed based on the dimensionality reduction data corresponding to the multiple virtual machines to obtain anomaly identification results corresponding to the multiple virtual machines, including: determining the local density corresponding to the multiple virtual machines based on the dimensionality reduction data corresponding to the multiple virtual machines, wherein the local density indicates the density of the distance between the corresponding virtual machine and the adjacent virtual machines; marking the virtual machines among the multiple virtual machines whose corresponding local density is greater than the preset density to obtain the second virtual machine, and k neighboring virtual machines corresponding to the second virtual machine, wherein k is a positive integer, and the k neighboring virtual machines are the k virtual machines closest to the corresponding second virtual machine; determining the local outlier factors corresponding to the k neighboring virtual machines, wherein the local outlier factor indicates the degree of deviation of the corresponding neighboring virtual machine from other neighboring virtual machines among the k neighboring virtual machines; in the case that there is a local outlier factor greater than the preset factor threshold among the k neighboring virtual machines, determining the anomaly identification results corresponding to the k neighboring virtual machines and the corresponding second virtual machine as an abnormal state.

[0067] It can be understood that for multiple virtual machines, the local density of each virtual machine is first calculated based on the dimensionality reduction data. Local density is an indicator that measures the density of the virtual machine's surrounding environment in the dimensionality reduction space. For each virtual machine, the distance between it and the nearest virtual machine (i.e., "k nearest neighbor virtual machines") is calculated, and a local density is calculated based on these distances. This density value reflects the relative position density of the virtual machine in space, that is, how many other virtual machines exist around it in the dimensionality reduction space. Those virtual machines whose local density is greater than the preset density threshold are marked and called second virtual machines. The preset density threshold is set based on the distribution of virtual machines in normal operation. The marked second virtual machine may be located in a relatively isolated position or is likely to be in an abnormal operation mode. For each marked second virtual machine, the local outlier factor of its k nearest neighbor virtual machines is determined. The local outlier factor (LOF) is a statistical measure used to quantify the degree of deviation of a data point relative to its nearest neighbor points. For each nearest neighbor virtual machine of the second virtual machine, the LOF relative to the other k nearest neighbor virtual machines is calculated to determine whether the nearest neighbor virtual machine has significantly deviated from the normal state. For the second virtual machine and its k neighboring virtual machines, if the local outlier factor of any neighboring virtual machine is greater than a preset factor threshold, these neighboring virtual machines and the corresponding second virtual machine are marked as being in an abnormal state. The factor threshold is set based on the LOF distribution of normal data points to distinguish abnormal points from normal points.

[0068] By combining local density and local outlier factor, abnormal VMs can be identified more accurately. Local density helps identify potentially isolated VMs, while local outlier factor further checks whether these VMs deviate significantly from normal state. Using k nearest neighbor VMs and local density and local outlier factor for anomaly analysis greatly reduces computational complexity and resource consumption compared to processing raw high-dimensional data.

[0069] It should be noted that the above embodiments are suitable for different numbers of virtual machines and various types of tasks. By adjusting the k value and the density threshold, the anomaly detection strategy can be optimized according to specific application scenarios.

[0070] In an optional embodiment, local densities corresponding to the multiple virtual machines are determined based on the dimensionality reduction data corresponding to the multiple virtual machines, including: determining the distance between each virtual machine in the multiple virtual machines and other virtual machines in the multiple virtual machines based on the dimensionality reduction data corresponding to the multiple virtual machines; determining k neighboring virtual machines corresponding to each virtual machine based on the distance between each virtual machine and the other virtual machines; and obtaining the local densities corresponding to the multiple virtual machines based on the average value of the distances of the k neighboring virtual machines corresponding to each virtual machine.

[0071] It can be understood that based on the dimension reduction data of each virtual machine, the distance between all virtual machines is calculated in the dimension reduction space. The distance calculation can adopt methods such as Euclidean distance, Manhattan distance or cosine distance, depending on the nature of the dimension reduction data and the requirements of the selected model. For each virtual machine, find the k virtual machines closest to it. The selection of the k value needs to be determined according to the total number of virtual machines and the needs of anomaly detection. A larger k value can improve the stability of detection, but may mask local anomalies; a smaller k value is more sensitive to local anomalies, but may increase the false alarm rate. Based on the distance of the k nearest neighbor virtual machines of each virtual machine, the average value of the distance is calculated. The inverse of this average distance is taken as the local density of the virtual machine. The local density reflects the compactness of the virtual machine in the dimension reduction space, that is, the concentration of the k nearest neighbor virtual machines around it. A high local density indicates that the environment around the virtual machine is relatively dense, while a low local density indicates that the environment around the virtual machine is relatively empty.

[0072] The calculation of local density provides a strong basis for anomaly detection. Abnormal virtual machines usually show that their local density is significantly different from the local density of normal virtual machines, either abnormally high (indicating that they may be in an abnormal area in the cluster) or abnormally low (indicating that they may be isolated or deviate from the normal cluster). This density-based anomaly detection method can effectively distinguish anomalies from normal data points. The calculation of local density is based on k nearest neighbor virtual machines, and the k value can be flexibly adjusted according to the total number of virtual machines and the anomaly detection strategy. In addition, this method can be easily applied to virtual machine environments of different sizes and configurations, and has good scalability.

[0073] Through the above step S102, the running status data of multiple virtual machines are obtained; step S104, the running status data of multiple virtual machines are respectively subjected to dimensionality reduction processing to determine the dimensionality reduction data corresponding to the multiple virtual machines; step S106, the dimensionality reduction cost values ​​generated by reducing the running status data of multiple virtual machines to the dimensionality reduction data are determined; step S108, when the dimensionality reduction cost value is less than or equal to the predetermined cost threshold, anomaly analysis is performed based on the dimensionality reduction data corresponding to the multiple virtual machines to obtain the anomaly identification results corresponding to the multiple virtual machines. Non-intrusive data extraction and dimensionality reduction analysis can be achieved to reduce the computational overhead of virtual machine anomaly identification, and the technical effect of improving anomaly detection efficiency is achieved, thereby solving the technical problem of unsatisfactory anomaly identification efficiency of virtual machines in related technologies.

[0074] Based on the above embodiments and optional embodiments, the present application proposes an optional implementation mode: Figure 2 is a schematic diagram of an optional method for identifying abnormalities of a virtual machine provided according to an embodiment of the present application, such as Figure 2 As shown, the following is explained.

[0075] Step S10, based on the pre-deployed data extraction module, establish the interaction between the data extraction module and the virtualization layer in the virtual environment; in this embodiment, the data extraction module is one or more of a custom script tool, a data integration tool, a log collection tool and a data replication tool.

[0076] Step S20, based on the data extraction module, collect the running status data of several virtual machines in the virtualization layer; wherein the running status data of each virtual machine is the running parameters of each virtual machine executing the pre-assigned task, and the running parameters at least include: CPU status data, memory status data, disk status data and network status data; wherein the CPU status data includes parameters such as CPU main frequency, CPU utilization, CPU running time, etc.; the memory status data includes parameters such as total physical memory, used physical memory, free memory, shared memory, cache and buffer memory and available memory, etc.; the disk status data includes parameters such as disk usage capacity, read and write speed and number of I / O operations, etc.; the network status data includes parameters such as connection status, transmission rate, network utilization, delay and packet loss, etc.

[0077] In this embodiment, by deploying the data extraction module in a virtual environment, the data extraction module can establish communication with the virtualization layer. After establishing communication, the data extraction module can directly collect the operating status data of several virtual machines in the virtualization layer; since the data extraction module is an independently running software entity, it does not rely on the operating system or application inside the virtual machine. Therefore, during the data collection process, the data extraction module will not modify any configuration or status of the virtual machine, ensuring the non-invasiveness of the monitoring operation.

[0078] In this embodiment, when the virtual machines execute different tasks, different running status data will be generated; when different virtual machines execute the same type of tasks, the running status data generated are also substantially the same.

[0079] Step S30, pre-processing the collected running status data of the plurality of virtual machines to obtain key monitoring data of each virtual machine, wherein the pre-processing includes: data cleaning, data conversion and data dimension reduction.

[0080] As a further optimization of this embodiment, the collected running status data of several virtual machines are preprocessed to obtain key monitoring data of each virtual machine, including:

[0081] Step S301: clean and convert the running status data of each virtual machine to obtain the converted running status data of each virtual machine; wherein, data cleaning can remove invalid, erroneous or duplicate data, and data conversion can convert data in different formats into a unified format to facilitate subsequent analysis; the converted running status data of each virtual machine is stored in the database of the server.

[0082] Step S302: Perform data dimensionality reduction on the converted running status data of each virtual machine to obtain the running status data of each virtual machine after dimensionality reduction, and use the running status data of each virtual machine after dimensionality reduction as the key monitoring data of each virtual machine; in this embodiment, since the running status data of the virtual machine has multiple types, each type represents a dimension, the running status data of the original virtual machine is high-dimensional data. Directly using high-dimensional data will increase the overhead of subsequent abnormality analysis, so it is necessary to perform dimensionality reduction processing on the high-dimensional running status data of the virtual machine.

[0083] As a further optimization of this embodiment, the converted running state data of each virtual machine is subjected to data dimensionality reduction to obtain the running state data of each virtual machine after dimensionality reduction, including:

[0084] Step a10: creating a similarity set for each virtual machine according to the pre-assigned tasks executed by each virtual machine, wherein the similarity set includes a plurality of similar virtual machines.

[0085] In step a10, a similarity set is created for each virtual machine, including:

[0086] Step a101: combine all virtual machines into a set to obtain a virtual machine set;

[0087] Step a102: selecting a virtual machine from the virtual machine set and extracting pre-allocated tasks of the virtual machine;

[0088] Step a103: Select a preset number of virtual machines from the remaining virtual machines in the virtual machine set, and the types of pre-assigned tasks of the preset number of virtual machines are the same as the type of pre-assigned tasks of the virtual machine; that is, find all other virtual machines in the virtual machine set that perform the same task as the selected virtual machine, and select a certain proportion of virtual machines from these other virtual machines, for example, 30% to 50% of the total number of other virtual machines;

[0089] Step a104: taking a preset number of virtual machines corresponding to the selected virtual machine as a set, obtaining a similar set of the virtual machine, and taking the preset number of virtual machines in the similar set of the virtual machine as a plurality of similar virtual machines;

[0090] Step a105: reselect a new virtual machine from the virtual machine set, and rescreen the similarity set of the new virtual machine until every virtual machine in the virtual machine set is selected to obtain a similarity set of each virtual machine; at this point, each virtual machine has a similarity set, which ensures that all virtual machines participate in dimensionality reduction and can greatly improve the algorithm operation speed with a low accuracy loss.

[0091] In this embodiment, when the total number of virtual machines is small, a smaller similarity set can be selected because the similarity between each virtual machine is higher; when the number of virtual machines is large, a larger similarity set needs to be selected to ensure the accuracy of the dimensionality reduction results; when the number of types of pre-assigned tasks is small, a smaller similarity set can be selected because the number of virtual machines of the same task type is large; when the number of types of pre-assigned tasks is large, a larger comparison data set needs to be selected to ensure that virtual machines between different task types can also be effectively included.

[0092] Step a20: construct a high-dimensional space according to the operating status data of each virtual machine, where each dimension of the high-dimensional space is used to characterize an operating parameter of the virtual machine.

[0093] Step a30: In a high-dimensional space, based on a Gaussian distribution probability model and a similarity set of each virtual machine, a first distribution probability of each virtual machine is calculated; specifically, for each virtual machine, the similarity between the virtual machine and multiple similar virtual machines in a similarity set corresponding to the virtual machine is calculated to obtain a similarity sequence, and the similarity sequence is input into a Gaussian distribution probability model to obtain a conditional distribution probability between the virtual machine and multiple similar virtual machines, and the conditional distribution probability of the virtual machine is used as the first distribution probability of the virtual machine; wherein, the similarity between the virtual machine and multiple similar virtual machines in a similarity set corresponding to the virtual machine is calculated using a cosine similarity function, using the data of each virtual machine in the high-dimensional space to calculate the similarity.

[0094] Step a40: randomly generate a low-dimensional space, and project each virtual machine in the high-dimensional space to the low-dimensional space. After each virtual machine is projected to the low-dimensional space, each virtual machine has a corresponding position in the low-dimensional space, and this position can be adjusted in subsequent steps.

[0095] Step a50: in the low-dimensional space, based on the t-distribution probability model (Student's t-distribution, continuous probability distribution) and the similarity set of each virtual machine, calculate the second distribution probability of each virtual machine;

[0096] Similarly, the similarity calculation method is mostly the same as that of step a40. For each virtual machine, the similarity between the virtual machine and multiple similar virtual machines in the similarity set corresponding to the virtual machine is calculated, and the cosine similarity function is used to calculate to obtain a similarity sequence. The difference is that in the low-dimensional space, the current low-dimensional feature data of each virtual machine in the low-dimensional space is used as the input of the cosine similarity function.

[0097] By inputting the similarity sequence into the t distribution probability model, a second distribution probability of each virtual machine that obeys the t distribution can be obtained; this embodiment uses the t distribution model to avoid crowding of data after dimensionality reduction.

[0098] Step a60: Calculate the cost value based on the first distribution probability and the second distribution probability of each virtual machine; wherein the cost value is solved using the KL distance function, which is the Kullback-Leibler Divergence, a method for measuring the difference between two probability distributions.

[0099] Step a70: Based on the optimization algorithm, adjust the position of each virtual machine in the low-dimensional space and recalculate the cost until the cost reaches a preset value; obtain low-dimensional feature data of each virtual machine, that is, two-dimensional feature data, and use the low-dimensional feature data of each virtual machine as the operating status data of each virtual machine after dimensionality reduction.

[0100] In this embodiment, since there are many parameters that cause virtual machine anomalies, it is necessary to consider as many virtual machine operating parameters as possible, but this increases the data dimension that needs to be processed, and the usage of computing resources increases rapidly, which is not conducive to the abnormal detection of virtual machines. This embodiment performs dimensionality reduction processing (i.e., reducing to two-dimensional space) on the operating status data of each virtual machine through steps a10 to a70. During the dimensionality reduction processing, the similarities between each virtual machine are considered in the high-dimensional space and the low-dimensional space. Therefore, after the virtual machine is mapped from the high-dimensional space to the low-dimensional space, the similarities between each virtual machine are retained, which is conducive to the later abnormal analysis of the virtual machine, which can not only solve the problem of high computing overhead, but also have a high accuracy of abnormal detection.

[0101] Step S40: performing an abnormality analysis on the key monitoring data of each virtual machine to obtain an abnormality analysis result.

[0102] In this embodiment, an abnormality analysis is performed on the key monitoring data of each virtual machine to obtain abnormality analysis results, including:

[0103] Step S401: In the low-dimensional space, based on the low-dimensional feature data of each virtual machine, the local density of each virtual machine is calculated; in this embodiment, the local density of each virtual machine is calculated using the LOF algorithm, and the calculation steps of the local density of each virtual machine are:

[0104] Calculate k-distance: Take the low-dimensional feature data of a virtual machine as a data point, calculate its distance to all other points, and find the distance to the kth nearest neighbor, i.e., k-distance;

[0105] Calculate the reachable distance: For each point, calculate its reachable distance to its k-nearest neighbor;

[0106] Calculate the local reachability density: For each point, calculate its local reachability density, that is, the inverse of the average of the reachability distances of its k-nearest neighbors, and use the local reachability density as the local density.

[0107] Step S402: Mark virtual machines whose local density is greater than a preset density to obtain a plurality of necessary virtual machines.

[0108] Step S403: Determine k neighbor virtual machines corresponding to each necessary virtual machine, where k is a positive integer; since the distances of the k nearest neighbors of each virtual machine have been determined in step S401, when any virtual machine is a necessary virtual machine, the k neighbor virtual machines can be directly obtained.

[0109] Step S404: Select any one neighbor virtual machine from the k neighbor virtual machines corresponding to each necessary virtual machine, and calculate the local outlier factor of the neighbor virtual machine; wherein calculating the local outlier factor of the neighbor virtual machine includes: obtaining the local density of the neighbor virtual machine; and calculating the local outlier factor of the neighbor virtual machine according to the local density of the neighbor virtual machine.

[0110] In this embodiment, the LOF algorithm is also sampled to calculate the local outlier factor of the neighboring virtual machine, and the local outlier factor is the ratio of the average local reachable density of the k-nearest neighbors to the local reachable density of the point.

[0111] Step S405: Determine whether the local outlier factor of the neighboring virtual machine is greater than a preset factor threshold. If so, mark the necessary virtual machine and the k neighboring virtual machines corresponding to the necessary virtual machine as abnormal; if not, mark the necessary virtual machine and the k neighboring virtual machines corresponding to the necessary virtual machine as normal.

[0112] In this embodiment, when the local outlier factor of a virtual machine among any necessary virtual machine and the k neighboring virtual machines of the necessary virtual machine is greater than the preset factor threshold, it means that all virtual machines are abnormal; otherwise, it means that all virtual machines are normal; this method can significantly reduce the amount of calculation and improve the efficiency of anomaly detection.

[0113] Step S406: Generate an abnormal virtual machine set according to the abnormal necessary virtual machine and the k neighboring virtual machines corresponding to the necessary virtual machine, and use the abnormal virtual machine set as the abnormality analysis result.

[0114] Step S50: Visually display the abnormality analysis results. In this embodiment, the abnormality analysis results can be sent to the user end through the server. The user end can be a PC, mobile phone or other smart device of the operation and maintenance personnel. The operation and maintenance personnel can understand the status of each virtual machine in a timely manner. If an abnormality occurs in the virtual machine, the operation and maintenance personnel will be prompted and warned at the first time.

[0115] The above optional implementation method achieves at least the following effects: by deploying a data extraction module, a communication interaction is established between the data extraction module and the virtualization layer in the virtual environment. The data extraction module is an independently running software entity that does not rely on the operating system or application inside the virtual machine. In the process of collecting the running status data of several virtual machines in the virtualization layer, the data extraction module does not modify any configuration or status of the virtual machine, thereby ensuring the non-intrusiveness of the monitoring operation; preprocessing the collected running status data of several virtual machines can reduce the amount of data and the computational overhead of the subsequent abnormal analysis of the running status data; by performing abnormal analysis on the key monitoring data of each virtual machine, abnormal warning of the virtual machine can be achieved, and the status of each virtual machine can be understood in a timely manner.

[0116] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0117] In this embodiment, a virtual machine abnormality identification device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the terms "module" and "device" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0118] According to an embodiment of the present application, there is also provided an apparatus embodiment for implementing a method for identifying anomalies of a virtual machine. Figure 3is a schematic diagram of a virtual machine abnormality identification device according to an embodiment of the present application, such as Figure 3 As shown, the above-mentioned virtual machine anomaly identification device includes: a data acquisition module 302, a dimension reduction module 304, a cost value determination module 306, and an anomaly analysis module 308. The device is described below.

[0119] A data acquisition module 302 is used to acquire the operation status data of multiple virtual machines;

[0120] A dimension reduction module 304, connected to the data acquisition module 302, is used to perform dimension reduction processing on the operation status data of the multiple virtual machines respectively, and determine the dimension reduction data corresponding to the multiple virtual machines respectively;

[0121] The cost value determination module 306 is connected to the dimension reduction module 304 and is used to determine the dimension reduction cost values ​​generated by reducing the dimension of the running state data of the multiple virtual machines to the reduced dimension data;

[0122] The anomaly analysis module 308 is connected to the cost determination module 306, and is used to perform anomaly analysis based on the dimensionality reduction data corresponding to the multiple virtual machines respectively when the dimensionality reduction cost is less than or equal to the predetermined cost threshold, so as to obtain anomaly identification results corresponding to the multiple virtual machines respectively.

[0123] In a virtual machine anomaly identification device provided in an embodiment of the present application, by setting a data acquisition module 302, a dimensionality reduction module 304, a cost value determination module 306, and anomaly analysis module 308, non-intrusive data extraction and dimensionality reduction analysis are achieved to reduce the computational overhead of virtual machine anomaly identification, and the technical effect of improving anomaly detection efficiency is achieved, thereby solving the technical problem of unsatisfactory virtual machine anomaly identification efficiency in related technologies.

[0124] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0125] It should be noted that the above data acquisition module 202, dimensionality reduction module 204, cost value determination module 206, and abnormality analysis module 208 correspond to steps S102 to S108 in the embodiment, and the examples and application scenarios implemented by the above modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments. It should be noted that the above modules as part of the device can be run in a computer terminal.

[0126] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0127] The above-mentioned virtual machine anomaly identification device may also include a processor and a memory. The data acquisition module 202, the dimensionality reduction module 204, the cost value determination module 206, the anomaly analysis module 208, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0128] The processor includes a kernel, which retrieves the corresponding program unit from the memory. There can be one or more kernels. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0129] An embodiment of the present application provides a non-volatile storage medium on which a program is stored. When the program is executed by a processor, a method for identifying an abnormality of a virtual machine is implemented.

[0130] The embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program stored in the memory and can be run on the processor. When the processor executes the program, the following steps are implemented: obtaining the operating status data of multiple virtual machines; performing dimensionality reduction processing on the operating status data of multiple virtual machines respectively, and determining the dimensionality reduction data corresponding to the multiple virtual machines respectively; determining the dimensionality reduction cost values ​​generated by reducing the dimensionality of the operating status data of multiple virtual machines to the dimensionality reduction data respectively; when the dimensionality reduction cost value is less than or equal to a predetermined cost threshold, performing anomaly analysis based on the dimensionality reduction data corresponding to the multiple virtual machines respectively, and obtaining the anomaly identification results corresponding to the multiple virtual machines respectively. The device in the present application can be a server, a PC, etc.

[0131] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: obtaining operating status data of multiple virtual machines; performing dimensionality reduction processing on the operating status data of the multiple virtual machines respectively, and determining the dimensionality reduction data corresponding to the multiple virtual machines respectively; determining the dimensionality reduction cost values ​​generated by reducing the operating status data of the multiple virtual machines to the dimensionality reduction data respectively; when the dimensionality reduction cost value is less than or equal to a predetermined cost threshold, performing anomaly analysis based on the dimensionality reduction data corresponding to the multiple virtual machines respectively, and obtaining anomaly identification results corresponding to the multiple virtual machines respectively.

[0132] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0133] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0136] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0137] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0138] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0139] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0140] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0141] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for identifying anomalies of a virtual machine, characterized in that: include: Obtaining the running status data of multiple virtual machines; Performing dimensionality reduction processing on the running status data of the multiple virtual machines respectively to determine the dimensionality reduction data corresponding to the multiple virtual machines respectively; Determine dimensionality reduction cost values ​​generated by reducing the dimension of the operating status data of the multiple virtual machines to the reduced dimension data; When the dimension reduction cost is less than or equal to a predetermined cost threshold, anomaly analysis is performed based on the dimension reduction data respectively corresponding to the multiple virtual machines to obtain anomaly identification results respectively corresponding to the multiple virtual machines.

2. The method according to claim 1, characterized in that The multiple virtual machines share a virtualization layer, the virtualization layer is used to allocate virtualization resources to the virtual machines, and the obtaining of the operation status data of the multiple virtual machines includes: Establishing communication interaction with the virtualization layer; A non-invasive data extraction module is used to obtain the operating status data of the multiple virtual machines through the virtualization layer.

3. The method according to claim 1, characterized in that The determining of dimension reduction cost values ​​generated by reducing the dimension of the running status data of the plurality of virtual machines to the reduced dimension data respectively includes: According to the pre-allocated tasks respectively corresponding to the multiple virtual machines, the multiple virtual machines are divided to determine similar sets respectively corresponding to the multiple virtual machines, wherein the similar sets include a predetermined number of virtual machines having the same pre-allocated tasks as the corresponding virtual machines; Based on the operation status data and similarity sets respectively corresponding to the multiple virtual machines, a Gaussian distribution probability model is used to determine first distribution probabilities respectively corresponding to the multiple virtual machines; Based on the dimension reduction data and similarity sets respectively corresponding to the multiple virtual machines, a continuous probability distribution model is used to determine second distribution probabilities respectively corresponding to the multiple virtual machines; According to the difference between the first distribution probabilities respectively corresponding to the multiple virtual machines and the corresponding second distribution probabilities, the dimensionality reduction cost values ​​respectively generated by the multiple virtual machines are determined.

4. The method according to claim 3, characterized in that The method further comprises: If there is a first virtual machine among the multiple virtual machines whose dimensionality reduction cost value is greater than the predetermined cost threshold, adjusting the dimensionality reduction data corresponding to the first virtual machine to obtain adjusted dimensionality reduction data; Determining an adjusted second distribution probability of the first virtual machine based on the adjusted dimensionality reduction data; Determining an adjusted dimensionality reduction cost based on a difference between a first distribution probability corresponding to the first virtual machine and an adjusted second distribution probability; Until the adjusted dimensionality reduction cost value is less than or equal to the predetermined cost threshold, an anomaly analysis is performed based on the adjusted dimensionality reduction data corresponding to the first virtual machine to obtain an anomaly identification result corresponding to the first virtual machine.

5. The method according to claim 3, characterized in that: The determining, based on the operation status data and similarity sets respectively corresponding to the plurality of virtual machines, respectively corresponding to the plurality of virtual machines by using a Gaussian distribution probability model, respectively corresponding to the plurality of virtual machines, comprises: For each virtual machine of the plurality of virtual machines, based on the running state data corresponding to each virtual machine and the running state data corresponding to other virtual machines included in the similarity set corresponding to each virtual machine, a cosine similarity function is used to determine a similarity sequence of each virtual machine; The similarity sequences of the multiple virtual machines are input into the Gaussian distribution probability model for processing to determine first distribution probabilities corresponding to the multiple virtual machines respectively.

6. The method according to claim 1, characterized in that The performing anomaly analysis based on the dimension reduction data respectively corresponding to the multiple virtual machines to obtain anomaly identification results respectively corresponding to the multiple virtual machines includes: Determine local densities corresponding to the multiple virtual machines based on the dimension reduction data corresponding to the multiple virtual machines, wherein the local density represents the density of the distance between the corresponding virtual machine and the adjacent virtual machines; Marking virtual machines whose corresponding local density is greater than a preset density among the multiple virtual machines to obtain a second virtual machine and k neighboring virtual machines corresponding to the second virtual machine, where k is a positive integer and the k neighboring virtual machines are k virtual machines that are closest to the corresponding second virtual machine; Determine local outlier factors corresponding to the k neighboring virtual machines respectively, wherein the local outlier factors represent the degree of deviation of the corresponding neighboring virtual machine from other neighboring virtual machines in the k neighboring virtual machines; In the case that a local outlier factor exists in the k neighboring virtual machines and is greater than a preset factor threshold, it is determined that the abnormality identification results respectively corresponding to the k neighboring virtual machines and the corresponding second virtual machine are in an abnormal state.

7. The method according to claim 6, characterized in that The determining, based on the dimension reduction data respectively corresponding to the plurality of virtual machines, the local densities respectively corresponding to the plurality of virtual machines comprises: Determine, based on the dimensionality reduction data respectively corresponding to the multiple virtual machines, a distance between each virtual machine in the multiple virtual machines and other virtual machines in the multiple virtual machines; Determine k neighboring virtual machines corresponding to each virtual machine based on the distance between each virtual machine and the other virtual machines; Based on the average value of the distances of the k nearest neighbor virtual machines corresponding to each virtual machine, the local densities corresponding to the multiple virtual machines are obtained.

8. A virtual machine abnormality identification device, characterized in that: include: A data acquisition module, used to acquire the running status data of multiple virtual machines; A dimension reduction module, used to perform dimension reduction processing on the running status data of the multiple virtual machines respectively, and determine the dimension reduction data corresponding to the multiple virtual machines respectively; A cost value determination module, used to determine the dimension reduction cost values ​​generated by reducing the dimension of the operating status data of the plurality of virtual machines to the reduced dimension data; The anomaly analysis module is used to perform anomaly analysis based on the dimensionality reduction data corresponding to the multiple virtual machines respectively when the dimensionality reduction cost value is less than or equal to a predetermined cost threshold, so as to obtain anomaly identification results corresponding to the multiple virtual machines respectively.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method for identifying anomalies of a virtual machine as described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: One or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the virtual machine exception identification method described in any one of claims 1 to 7.

Images