Intelligent method and device for system performance prediction and anomaly detection

Abstract

The embodiment of the application provides an intelligent method and device for system performance prediction and anomaly detection, aiming at the complexity and variability of system data, a deep learning method is used to enable the model to more comprehensively capture the complex patterns and time dependence of the data. This method effectively improves the accuracy of system performance prediction through multi-layer analysis and multi-angle feature extraction. And through feature selection and data enhancement technology, the model has good adaptability when facing different sizes and different properties of data. This robustness reduces the sensitivity of the model to data noise and anomalies, ensuring that the prediction results remain stable and reliable in various operating environments. This method can improve the monitoring ability of complex data and realize intelligent monitoring and optimization of system performance.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, and particularly relates to an intelligent method and device for system performance prediction and anomaly detection. BACKGROUND

[0002] In modern information systems, real-time monitoring of system performance and timely detection of anomalies are crucial for maintaining system stability. Traditional monitoring methods usually rely on fixed thresholds and simple statistical methods, which are difficult to cope with complex and changing system environments. Therefore, it is of great theoretical significance and application value to introduce deep learning and time series analysis techniques to realize performance prediction and anomaly detection through historical data analysis.

[0003] Existing technical solutions mainly include the following three types: threshold-based monitoring system, statistical analysis method, and rule-based anomaly detection.

[0004] 1. Threshold-based monitoring system

[0005] Fixed threshold monitoring is one of the most commonly used methods in traditional IT systems. This solution sets one or more fixed thresholds for each monitoring indicator (such as CPU usage, memory occupancy, network latency, etc.). When any indicator exceeds its threshold, the system triggers an alarm to alert the operation and maintenance personnel to check and handle it. This method is simple to implement, easy to deploy and understand. System alarm rules can be adjusted according to experience and historical data, which meets the monitoring needs of some simple and stable environments, but lacks flexibility, has serious false positives and false negatives, and has high maintenance costs.

[0006] 2. Statistical analysis-based anomaly detection

[0007] This solution detects and identifies abnormal behavior in data by applying simple statistical methods. The core technologies include mean value, standard deviation analysis, time sliding window technology, etc. These methods attempt to determine whether there is an abnormal situation in the current by using historical baseline and statistical distribution. Compared with fixed thresholds, statistical analysis can capture some subtle changes that are not easily detected, and through simple calculations, it can quickly detect and is suitable for some stable indicators, but has limited precision and sensitivity, and is difficult to cope with multi-dimensional data, and has poor adaptability to environmental changes.

[0008] 3. Rule-based anomaly pattern recognition

[0009] This scheme relies on experience accumulation and manually defined rule base to identify abnormal conditions of the system. The rules are usually formulated based on historical fault data and experienced professionals, and can effectively identify specific fault types. Rules are effective when applied to specific and known problems, and can quickly identify preset abnormal patterns. For familiar faults of the operation and maintenance team, the rule method is highly efficient, but there are difficulties in updating and maintaining rules, limited coverage, and easy rule conflicts.

[0010] In summary, the three existing technical solutions have their own advantages, but they have obvious shortcomings in dealing with complexity, variability and unknown pattern recognition. This creates a strong demand for the development and introduction of new technologies to improve the robustness and intelligence level of the system. SUMMARY

[0011] To solve the problems in the prior art, the present application provides an intelligent method and device for system performance prediction and anomaly detection to improve the monitoring capability of complex data and realize intelligent monitoring and optimization of system performance.

[0012] To solve at least one of the above problems, the present application provides the following technical solutions:

[0013] In a first aspect, the present application provides an intelligent method for system performance prediction and anomaly detection, comprising:

[0014] Obtain the time series of the system, and decompose the time series into trend component, seasonal component and residual component; input the trend component and the seasonal component into a first ARIMA model to generate trend component prediction value and seasonal component prediction value;

[0015] Calculate the difference between the trend component prediction value and the actual value, and the difference between the seasonal component prediction value and the actual value, respectively, to obtain the initial residual of the trend component prediction value and the initial residual of the seasonal component prediction value; input the two initial residuals into an LSTM model to generate a predicted residual;

[0016] Input the time series into a second ARIMA model to generate a first prediction value; add the first prediction value and the predicted residual to obtain a second prediction value; perform feature interaction on the second prediction value, the first prediction value, the initial residual and the predicted residual, and use a regularization algorithm and an LSTM layer to optimize and obtain target interaction features;

[0017] Integrate the target interaction features, the initial residual and the predicted residual into a feature data set, and perform standardization processing on it; input the standardized feature data set into a prediction model to generate a target prediction value; determine whether the system performance is abnormal according to the comparison result of the target prediction value and a preset threshold.

[0018] Further, the training method of the first ARIMA model comprises:

[0019] Obtaining time series from system monitoring and generating input-output pairs using a sliding window;

[0020] Checking the stationarity of the time series using ADF test; if the stationarity of the time series is lower than a preset value, eliminating the trend component by first-order difference;

[0021] Building an ARIMA initialization model, inputting the time series and model parameters p, d, q, training the model using the fit() method, and obtaining the fitting result;

[0022] Analyzing the model residuals and adjusting the model parameters according to the model residuals until the model residuals meet white noise.

[0023] Further, the step of analyzing the model residuals and adjusting the model parameters according to the model residuals until the model residuals meet white noise comprises:

[0024] Drawing the autocorrelation function ACF graph of the model residuals; if all lag autocorrelation values in the autocorrelation function ACF graph are within the confidence interval, it is determined that the model residuals are white noise; if the autocorrelation values of the lag period exceed the confidence interval, the model parameters are adjusted until all autocorrelation values of the lag period are within the confidence interval;

[0025] Further comprising normality verification, the method of which is: checking the degree of approximation of the model residuals to normal distribution by QQ plot; if the points of the model residuals are close to the 45-degree line of the QQ plot, it indicates that the model residuals meet the normal distribution; if the points of the model residuals deviate or bend from the 45-degree line of the QQ plot by more than a preset value, the model parameters are adjusted until all the points of the model residuals are close to the 45-degree line of the QQ plot;

[0026] Further comprising randomness verification, the method of which is: using Ljung-Box test to statistically evaluate whether the autocorrelation under multiple lags is significantly zero; if the p-value of the test is greater than a preset value, it is determined that the model residuals are independent random sequences; if the p-value of the test is less than a preset value, the model parameters are adjusted until the p-value of the test is greater than a preset value.

[0027] Further, the LSTM model is built using multi-layer LSTM stacking, and the LSTM is a bidirectional LSTM, and each layer of LSTM is provided with multiple units.

[0028] In the LSTM model, the number of units is determined using Optuna for automated hyperparameter optimization; each LSTM layer contains 64 to 256 units;

[0029] In the LSTM model, a Dropout layer is added after each LSTM, and the Dropout rate of the Dropout layer is set to 0.2-0.5;

[0030] In the LSTM model, a plurality of fully connected layers are added after all LSTMs; LSTM layers are used to extract features of initial residual errors of trend component prediction values / initial residual errors of seasonal component prediction values, and the fully connected layers are used to construct a mapping of the features to the output of the LSTM; each of the fully connected layers contains 32 to 128 neurons, and batch normalization is used to process data before and after the fully connected layers;

[0031] In the LSTM model, an attention layer is added after the LSTM and before the fully connected layer; for each time step, the attention layer uses a separate neural network layer to calculate the weight score of its output, and performs dot multiplication on the output of the LSTM and the calculated weight score to generate a weighted output for each time step, and then adds the weighted outputs to form the output of the attention layer.

[0032] Further, the training method of the LSTM model includes: obtaining a time series from system monitoring, standardizing the time series using Z-score, and generating input-output pairs using a sliding window;

[0033] The mean square error (MSE) is used as the loss function of the LSTM model, the gradient descent optimizer is selected as Adam, the learning rate is set to 0.001, and the learning rate adjustment strategy is used during training, and the batch size is selected as 32 to 64;

[0034] The training method of the LSTM model further includes: deploying the LSTM model in a containerized environment; the method of deploying the LSTM model in a containerized environment includes:

[0035] The trained LSTM model is saved in a portable format using the tf.saved_model module of TensorFlow;

[0036] The LSTM model is encapsulated into an API service, a monitoring tool is integrated to monitor the performance of the model and the health status of the system, and logging is set for debugging;

[0037] creating a Docker container, deploying model files and API services into the Docker container, and configuring multiple services through Docker Compose; the services include API services, monitoring tools, and databases;

[0038] requesting the LSTM model for prediction using API endpoints, and monitoring performance indicators of the API services using a designated web interface;

[0039] the Docker container uses CI / CD tools for automated deployment and updates.

[0040] Further, after the step of inputting the two initial residual errors into the LSTM model to generate a predicted residual error, the method further comprises:

[0041] randomly sampling from historical data of the trend component and the seasonal component through bootstrap sampling, and using the samples as input to train multiple groups of the ARIMA model and the LSTM model;

[0042] aggregating the predicted values of the multiple groups of the ARIMA model and the LSTM model using a weighted voting system to generate the predicted residual error; the weights of the weighted voting system are adjusted according to the performance evaluation results of the ARIMA model and the LSTM model.

[0043] Further, the step of feature interaction between the second predicted value and the first predicted value, the initial residual error, and the predicted residual error, and obtaining target interaction features using a regularization algorithm and an LSTM layer optimization comprises:

[0044] generating polynomial interaction features using Polynomial Features;

[0045] selecting first interaction features with information exceeding a preset value from the interaction features using a joint Lasso algorithm;

[0046] further optimizing the first interaction features using an LSTM layer to make them have time series information and dynamic change rules, and obtaining the target interaction features;

[0047] The step of determining whether the system performance is abnormal according to the comparison result of the target predicted value and the preset threshold comprises:

[0048] calculating a first difference between historical target predicted values and actual values; constructing an error distribution graph according to the first difference, and setting at least one percentile as an abnormal threshold;

[0049] calculating a second difference between the new target prediction value and the actual value, comparing the second difference with the abnormal threshold value: if the second difference is greater than the abnormal threshold value, determining that the system performance is abnormal; if the second difference is less than the abnormal threshold value, determining that the system performance is normal.

[0050] In a second aspect, the present application provides an intelligent device for system performance prediction and anomaly detection, comprising:

[0051] a first prediction module, configured to obtain a time series of a system, and decompose the time series into a trend component, a seasonal component and a residual component; input the trend component and the seasonal component into a first ARIMA model to generate a trend component prediction value and a seasonal component prediction value;

[0052] a second prediction module, configured to calculate a difference between the trend component prediction value and an actual value, and a difference between the seasonal component prediction value and an actual value, to obtain an initial residual of the trend component prediction value and an initial residual of the seasonal component prediction value; input the two initial residuals into an LSTM model to generate a prediction residual;

[0053] a feature interaction module, configured to input the time series into a second ARIMA model to generate a first prediction value; add the first prediction value and the prediction residual to obtain a second prediction value; perform feature interaction on the second prediction value, the first prediction value, the initial residual and the prediction residual, and use a regularization algorithm and an LSTM layer to optimize to obtain a target interaction feature;

[0054] a result output module, configured to integrate the target interaction feature, the initial residual and the prediction residual into a feature data set, and perform standardization processing on the feature data set; input the feature data set after the standardization processing into a prediction model to generate a target prediction value; and determine whether the system performance is abnormal according to a comparison result of the target prediction value and a preset threshold value.

[0055] In a third aspect, the present application provides an electronic device, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the steps of the intelligent method for system performance prediction and anomaly detection.

[0056] In a fourth aspect, the present application provides a computer readable storage medium, having a computer program stored thereon, wherein the computer program is executable by a processor to implement the steps of the intelligent method for system performance prediction and anomaly detection.

[0057] In a fifth aspect, the present application provides a computer program product, comprising a computer program / instruction, wherein the computer program / instruction is executable by a processor to implement the steps of the intelligent method for system performance prediction and anomaly detection.

[0058] From the above technical solutions, the application provides an intelligent method and device for system performance prediction and anomaly detection. In view of the complexity and variability of system data, the method of deep learning is adopted to enable the model to more comprehensively capture the complex patterns and time dependencies of the data. This method effectively improves the accuracy of system performance prediction through multi-layer analysis and multi-angle feature extraction, and performs particularly well when dealing with time series data with nonlinear and variable characteristics.

[0059] Moreover, through feature selection and data enhancement techniques, the model has good adaptability when facing data of different scales and different properties. This robustness reduces the sensitivity of the model to data noise and anomalies, ensuring that the prediction results remain stable and reliable in various operating environments. At the same time, through reasonable parameter setting and model structure design, the scheme not only optimizes the execution efficiency, but also shows good scalability when dealing with real-time data and large-scale multi-dimensional data. This enables the scheme to be quickly deployed and put into use in actual business, supporting the continuous optimization and upgrading of the system. BRIEF DESCRIPTION OF DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, a brief introduction to the drawings needed in the embodiment or prior art description will be given below. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0061] Figure 1 The flowchart of the intelligent method for system performance prediction and anomaly detection in the embodiments of the present application;

[0062] Figure 2 The structural diagram of the intelligent device for system performance prediction and anomaly detection in the embodiments of the present application;

[0063] Figure 3 The structural diagram of the electronic device in the embodiments of the present application.

[0064] Reference signs:

[0065] Electronic device 9600, central processor 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage part 9142, data storage part 9143, driver program storage part 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0066] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0067] The acquisition, storage, use, processing and the like of data in the technical solutions of the present application comply with relevant provisions of national laws and regulations.

[0068] In view of the problems in the prior art, the present application provides an intelligent system performance prediction and anomaly detection method and device. In view of the complexity and variability of system data, the method uses deep learning to enable the model to more comprehensively capture the complex patterns and time dependencies of the data. This method effectively improves the accuracy of system performance prediction through multi-layer analysis and multi-angle feature extraction, especially when dealing with non-linear and variable time series data.

[0069] Moreover, through feature selection and data enhancement techniques, the model has good adaptability when facing different scales and different properties of data. This robustness reduces the sensitivity of the model to data noise and anomalies, ensuring that the prediction results remain stable and reliable in a variety of operating environments. At the same time, through reasonable parameter setting and model structure design, the scheme not only optimizes the execution efficiency, but also shows good scalability when dealing with real-time data and large-scale multi-dimensional data. This enables the scheme to be quickly deployed and put into use in actual business, supporting the continuous optimization and upgrading of the system.

[0070] In order to improve the monitoring capability of complex data and achieve accurate prediction and monitoring of system performance, the present application provides an embodiment of an intelligent system performance prediction and anomaly detection method, as shown in Figure 1 , which specifically includes the following content:

[0071] Step S101: Acquire the time series of the system, and decompose the time series into trend component, seasonal component and residual component; input the trend component and the seasonal component into a first ARIMA model to generate trend component prediction value and seasonal component prediction value.

[0072] In this embodiment, the time series data of the system includes CPU usage, memory, and network traffic logs, and can also include disk usage percentage, disk read / write speed, and read / write request frequency to reflect disk usage; process quantity, memory usage of each process, service response time, and non-response frequency to reflect processes and services; query response time, query execution frequency, and query error frequency to reflect database indicators; CPU context switching frequency, system call quantity, and read / write execution rate to reflect operating system resources; response time, transaction processing quantity, and application program or API error number to reflect application performance indicators; network delay time, network packet loss quantity, TCP link quantity, and firewall packet quantity to reflect network security; startup, shutdown, crash, and driver error frequency, hard disk SMART state, temperature monitoring, fan speed, and alarm and notification quantity sent by the monitoring system to reflect system events and warning conditions, and the like. Exemplarily, a monitoring platform such as Datadog or New Relic can be selected to monitor the system.

[0073] In this embodiment, an ARIMA model (autoregressive integrated moving average model) is used as a time series model to effectively process time series data and capture dynamic change trends of the data.

[0074] Optionally, the STL (Seasonal-Trend decomposition using LOESS, Seasonal-Trend decomposition using LOESS) is used to decompose the time series of the system into trend components, seasonal components, and residual components, thereby reducing the input dimension of the model, simplifying the model structure, reducing the operation cost, and reducing the risk of overfitting. Meanwhile, the trend component and the seasonal component are selected as the input of the first ARIMA model, and the residual component is discarded. By focusing only on the trend component and the seasonal component, the first ARIMA model can focus on obvious patterns and cycles, rather than trying to explain complex short-term or random fluctuations, which can improve the stability of the model and make it easier to interpret.

[0075] Optionally, the training method of the first ARIMA model includes:

[0076] Data preparation: Obtain time series from system monitoring and understand data characteristics by drawing time series graphs; use sliding window technology to segment process time series data, determine window size and sliding step, and generate input-output pairs to better extract local time characteristics;

[0077] Data stationarity processing: use ADF (Augmented Dickey-Fuller) test to check the stationarity of the time series; if the stationarity of the time series is lower than the preset value, eliminate the trend component by first-order difference to realize data stationarity, and process the non-stationary variance by logarithmic transformation, power transformation and other methods;

[0078] Select ARIMA parameters: use the difference number d to determine the stationarity of the data, draw the autocorrelation function ACF and partial autocorrelation function PACF graph, and observe the lag order to determine p and q;

[0079] Model construction and training: construct a statsmodels.tsa.arima.model.ARIMA initialization model, input the time series and model parameters p, d, q, train the model using the fit() method, and obtain the fitting result;

[0080] Model diagnosis: analyze the model residual, and adjust the model parameters according to the model residual until the model residual meets the white noise;

[0081] Prediction and evaluation: use the trained ARIMA model to make future step prediction, calculate the error index of the prediction, evaluate the prediction performance of the model and check its accuracy, and make necessary model adjustments according to the evaluation result.

[0082] Further optionally, the step of analyzing the model residual and adjusting the model parameters according to the model residual until the model residual meets the white noise comprises:

[0083] Draw the autocorrelation function ACF graph of the model residual, check whether there is significant lag autocorrelation in the residual sequence, and if there is no significant autocorrelation, it means that the model has fully captured the data characteristics and the residual is white noise. Specifically, if all lag autocorrelation values in the autocorrelation function ACF graph are within the confidence interval, it is determined that the model residual is white noise; if the autocorrelation value at the lag period exceeds the confidence interval, adjust the model parameters until all lag autocorrelation values are within the confidence interval;

[0084] It also includes normality verification, and the method of the normality verification is: check the degree of approximation of the model residual to the normal distribution by QQ graph; if the points of the model residual are close to the 45-degree line of the QQ graph, it means that the model residual meets the normal distribution; if the points of the model residual deviate or curve compared to the 45-degree line of the QQ graph by more than a preset value, adjust the model parameters until all the points of the model residual are close to the 45-degree line of the QQ graph;

[0085] The randomness verification method is as follows: using Ljung-Box test to statistically evaluate whether the autocorrelation under multiple lags is significantly zero; if the p value of the test is greater than a preset value, it is determined that the model residual is an independent random sequence; if the p value of the test is less than the preset value, the model parameters are adjusted until the p value of the test is greater than the preset value.

[0086] Optionally, the training method of the first ARIMA model further comprises:

[0087] Data set division: divide the time series data into training set and test set, use the training set to build the model, and use the test set to evaluate the prediction performance of the model;

[0088] Calculate the prediction error: make prediction on the test data set, calculate the mean square error and the mean absolute error, which are used to quantify the error between the true value and the predicted value;

[0089] Visualization of prediction results: draw a comparison chart of predicted value and actual observation value, and the predicted value should follow the actual value without systematic deviation on the chart.

[0090] Step S102: calculate the difference between the trend component prediction value and the actual value and the difference between the seasonal component prediction value and the actual value respectively, obtain the initial residual of the trend component prediction value and the initial residual of the seasonal component prediction value; input the two initial residuals into the LSTM model to generate the prediction residual.

[0091] In this embodiment, when building the system performance prediction and anomaly detection model based on deep learning, LSTM (Long Short Term Memory) is used as the core component. This model is particularly suitable for time series data and can capture long-term dependencies.

[0092] Optionally, the LSTM model is built using multi-layer LSTM stacking, and the LSTM is bidirectional LSTM, which is used to capture the forward and reverse features of the input sequence. Dropout regularization technology is applied after each LSTM layer, and the Dropout rate is controlled between 0.2-0.5 to prevent overfitting. Optuna is used for automatic hyperparameter optimization to determine the optimal number of units, each layer containing 64 to 256 units to better extract features. For example, a multi-layer LSTM model can be built using 3 layers of stacking, each layer having 128 units.

[0093] Optionally, in this LSTM model, multiple fully connected layers are added after all LSTMs; the LSTM layers are used to extract features from the initial residuals of the trend component predictions / the initial residuals of the seasonal component predictions, and the fully connected layers are used to construct the mapping of the features to the output of the LSTM; each fully connected layer contains 32 to 128 neurons, and batch normalization is used before and after the fully connected layers to stabilize and accelerate the training process.

[0094] Optionally, in this LSTM model, an attention layer is added after the LSTM and before the fully connected layer so that the model can focus on important features at specific time points. For each time step, the attention layer uses a separate neural network layer to calculate the weight score of its output, and performs a dot product operation on the output of the LSTM and the calculated weight score to generate a weighted output for each time step. These weighted outputs are then summed to form the output of the attention layer. After the model is trained, the attention weights can be analyzed to understand which input features or time points the model focuses on, and the model architecture can be further optimized accordingly.

[0095] Optionally, the training method for this LSTM model includes: obtaining time series data from system monitoring, independently calculating the mean μ and standard deviation σ for each input feature using Z-score, and applying the formula z=(x-μ) / σ to eliminate dimensional differences for each input x.

[0096] Optionally, this LSTM model uses a sliding window technique to generate input-output pairs. The window size determines the length of each data segment. Larger windows can capture more time dependencies and long-term information, while smaller windows are more sensitive to short-term changes. Since the performance data has a significant daily periodicity, we set the window size to 96 (one data point every 15 minutes) and the window step size to 20. The sliding window technique is used to slice the time series to obtain sufficient training samples.

[0097] Optionally, during the training of this LSTM model, the mean squared error (MSE) is used as the loss function, the gradient descent optimizer is Adam for its fitness and efficiency, the learning rate is set to 0.001, and a learning rate adjustment strategy is used during training. The batch size is selected from 32 to 64 to balance training efficiency and memory consumption.

[0098] Optionally, during the training of this LSTM model, the training dataset is traversed several times, and the learning rate is adjusted in each traversal. For example, by gradually decreasing the learning rate, the model can perform more detailed optimizations as it approaches convergence, improving stability and final performance. Then, the training and validation losses and other performance metrics are recorded, and the hyperparameters are adjusted based on the evaluation results.

[0099] Through the above design, the LSTM model has good generalization ability while ensuring good fitting ability, and can adapt to complex system performance prediction and anomaly detection tasks.

[0100] Optionally, the LSTM model can be deployed in a containerized environment to support dynamic updating and real-time prediction. The method of deploying the LSTM model in a containerized environment includes: using the tf.saved_model module of TensorFlow to save the trained LSTM model in a portable format; encapsulating the LSTM model into an API service, integrating a monitoring tool to monitor model performance and system health status, and setting up logging for debugging; creating a Docker container, deploying model files and API services into the Docker container, and configuring multiple services through Docker Compose; the services include API services, monitoring tools, and databases; using API endpoints to request the LSTM model for prediction, and using a specified web interface to monitor the performance indicators of the API service; the Docker container uses CI / CD tools for automated deployment and updating, ensuring that after code or model updates, the container can be automatically rebuilt and released.

[0101] Optionally, after the step of inputting the two initial residuals, i.e., the initial residual of the trend component prediction value and the initial residual of the seasonal component prediction value, into the LSTM model to generate a prediction residual, the method further includes:

[0102] Randomly sample from the historical data of the trend component and the seasonal component through bootstrap sampling, and use the samples as input to train multiple groups of ARIMA models and LSTM models; use a weighted voting system to aggregate the prediction values of the multiple groups of ARIMA models and LSTM models to generate a prediction residual; the weights of the weighted voting system are adjusted according to the performance evaluation results of the ARIMA models and the LSTM models. This design can effectively use bootstrap method to train multiple time series models, and enhance the accuracy and robustness of prediction by combining the prediction results of multiple models.

[0103] Step S103: inputting the time series into a second ARIMA model to generate a first prediction value; adding the first prediction value and the prediction residual to obtain a second prediction value; and performing feature interaction on the second prediction value, the first prediction value, the initial residual, and the prediction residual, and using a regularization algorithm and an LSTM layer to optimize and obtain target interaction features.

[0104] Optionally, the step of generating polynomial interaction features using Polynomial Features; selecting first interaction features with information exceeding a preset value from the interaction features using a joint Lasso algorithm; and further optimizing the first interaction features using an LSTM layer to make them have time series information and dynamic change rules to obtain target interaction features.

[0105] Optionally, in the step of generating polynomial interaction features using Polynomial Features, the first predicted value y provided by the second ARIMA model and the predicted residual e adjusted by the LSTM model are used to generate an adjusted second predicted value: y^adjusted=y^ARIMA+e^LSTM. The adjusted second predicted value and the features output by each model are used to generate polynomial interactions. For simple quadratic interactions, the following features are constructed: square of itself: square of (y^ARIMA), square of (e^LSTM), square of (y^adjusted), square of the initial residual (e’^LSTM) of the trend component predicted value, square of the initial residual (e”^LSTM) of the seasonal component predicted value; cross terms: y^ARIMA×e^LSTM, y^ARIMA×y^adjusted, e^LSTM×y^adjusted, y^ARIMA×e’^LSTM, y^adjusted×e’^LSTM, y^ARIMA×e”^LSTM, y^adjusted×e”^LSTM, e’^LSTM×e”^LSTM.

[0106] Optionally, in the step of selecting first interaction features with information exceeding a preset value from the interaction features using a joint Lasso algorithm, Lasso calculates the coefficients of each interaction feature through lasso.coef_. Interaction features with larger absolute values of coefficients are more important in the model. We can filter out interaction features with coefficients greater than a preset threshold (such as 0.1) according to the threshold. The strength of Lasso regularization can be controlled by the regularization parameter alpha. A larger value will increase the penalty on feature coefficients, thereby compressing more feature coefficients to zero.

[0107] Optionally, the first interaction feature is further optimized using an LSTM layer to have time series information and dynamic change rules, and in the step of obtaining the target interaction feature, the first interaction feature is first converted into data suitable for the input format of the LSTM layer, i.e., the first interaction feature is organized into batches, and the time step and the number of features in each batch are specified to make it conform to the shape of the required input data of the LSTM layer. For example, the first interaction feature can be reshaped into a three-dimensional array, and the time step is set to 1 to meet this requirement. Then, a simple LSTM model is constructed, including an LSTM layer and an output layer. The number of neurons in the LSTM layer is set to 50, and the activation function is ReLU. The output layer is a fully connected layer that outputs a continuous prediction value; finally, the mean square error (MSE) is used as the loss function for model training, and prediction is performed on the test set. According to the prediction result, the hyperparameters of the simple LSTM model are optimized to obtain better model performance. In this step, the first interaction feature is learned and optimized through the LSTM network, emphasizing the influence of important information in the input interaction feature, while weakening or ignoring the influence of unimportant or redundant features, thereby improving the prediction ability of the prediction model.

[0108] In this embodiment, the nonlinear relationship between the original time series data is captured through feature interaction, the complex patterns that cannot be expressed in the original data are learned, and the regularization technique (such as Lasso) is used to select the most informative interaction features, which can further help control the model complexity and avoid overfitting.

[0109] Step S104: integrate the target interaction feature, the initial residual error, and the prediction residual error into a feature data set, and perform standardization processing; input the standardized feature data set into the prediction model to generate a target prediction value; and determine whether the system performance is abnormal according to the comparison result of the target prediction value and the preset threshold.

[0110] Optionally, the gradient boosting machine is used as the prediction model in this embodiment, and only the target interaction feature, the initial residual error, and the prediction residual error generated in the previous steps are used for prediction to ensure that overfitting is avoided, the model has good generalization ability, and the performance of the model is further improved by using the residual error and the interaction feature. This prediction method combines the simplicity of the model with the powerful prediction ability of the gradient boosting machine, and can effectively improve the prediction accuracy and efficiency of complex time series data.

[0111] Optionally, the step of determining whether the system performance is abnormal according to the comparison result of the target prediction value and the preset threshold value comprises: calculating a first difference value between the historical target prediction value and the actual value; constructing an error distribution graph according to the first difference value, and setting at least one percentile (such as 95% and / or 99%) as an abnormal threshold value; calculating a second difference value between the new target prediction value and the actual value, and comparing the size of the second difference value with the abnormal threshold value: if the second difference value is greater than the abnormal threshold value, it is determined that the system performance is abnormal; if the second difference value is less than the abnormal threshold value, it is determined that the system performance is normal.

[0112] As can be seen from the above description, the intelligent system performance prediction and anomaly detection method provided by the embodiments of the present application can capture complex patterns and time dependencies of data more comprehensively by using deep learning methods, aiming at the complexity and variability of system data. This method effectively improves the accuracy of system performance prediction through multi-layer analysis and multi-angle feature extraction, especially when dealing with time series data with nonlinear and variable characteristics.

[0113] Moreover, through feature selection and data enhancement techniques, the model has good adaptability when facing different scales and different properties of data. This robustness reduces the sensitivity of the model to data noise and anomalies, ensuring that the prediction results remain stable and reliable in various operating environments. At the same time, through reasonable parameter setting and model structure design, the scheme not only optimizes the execution efficiency, but also shows good scalability when dealing with real-time data and large-scale multi-dimensional data. This makes the scheme can be quickly deployed and play a role in actual business, supporting the continuous optimization and upgrading of the system.

[0114] In order to improve the monitoring ability of complex data and realize accurate prediction and monitoring of system performance, the present application provides an embodiment of a system performance prediction and anomaly detection intelligent device for implementing all or part of the contents of the intelligent system performance prediction and anomaly detection method, as shown in Figure 2 , the system performance prediction and anomaly detection intelligent device specifically comprises the following contents:

[0115] The first prediction module 10 is used for obtaining time series of a system, and decomposing the time series into a trend component, a seasonal component and a residual component; the trend component and the seasonal component are input into a first ARIMA model to generate a trend component prediction value and a seasonal component prediction value;

[0116] The second prediction module 20 is configured to calculate the difference between the trend component prediction value and the actual value and the difference between the seasonal component prediction value and the actual value respectively, to obtain the initial residual of the trend component prediction value and the initial residual of the seasonal component prediction value; and input the two initial residuals into the LSTM model to generate a prediction residual.

[0117] The feature interaction module 30 is configured to input the time series into a second ARIMA model to generate a first prediction value; add the first prediction value to the prediction residual to obtain a second prediction value; perform feature interaction on the second prediction value, the first prediction value, the initial residual and the prediction residual, and use a regularization algorithm and an LSTM layer to optimize to obtain target interaction features.

[0118] The result output module 40 is configured to integrate the target interaction features, the initial residual and the prediction residual into a feature data set, and perform standardization processing on the feature data set; input the feature data set after the standardization processing into a prediction model to generate a target prediction value; and determine whether the system performance is abnormal according to the comparison result of the target prediction value and a preset threshold.

[0119] As can be seen from the above description, the intelligent device for system performance prediction and anomaly detection provided by the embodiments of the present application can capture complex patterns and time dependencies of data more comprehensively by using a deep learning method in view of the complexity and variability of system data. This method effectively improves the accuracy of system performance prediction through multi-layer analysis and multi-angle feature extraction, and performs particularly well when dealing with time series data with nonlinear and variable characteristics.

[0120] Moreover, through feature selection and data enhancement techniques, the model has good adaptability when facing data of different scales and different properties. This robustness reduces the sensitivity of the model to data noise and anomalies, ensuring that the prediction results remain stable and reliable in various operating environments. At the same time, through reasonable parameter setting and model structure design, the scheme not only optimizes the execution efficiency, but also shows good scalability when dealing with real-time data and large-scale multi-dimensional data. This enables the scheme to be quickly deployed and put into use in actual business, supporting the continuous optimization and upgrading of the system.

[0121] From the hardware level, in order to improve the monitoring capability of complex data and realize accurate prediction and monitoring of system performance, the present application provides an embodiment of an electronic device for implementing all or part of the contents of the intelligent method for system performance prediction and anomaly detection, which specifically includes the following contents:

[0122] The processor, the memory, the communications interface, and the bus; wherein the processor, the memory, the communications interface complete the communication between each other through the bus; the communications interface is used for realizing the information transmission between the intelligent device of system performance prediction and anomaly detection, the core business system, the user terminal, and the related database and other related equipment; the logic controller can be a desktop computer, a tablet computer, a mobile terminal and the like, and the embodiment is not limited thereto. In the embodiment, the logic controller can refer to the embodiments of the intelligent method of system performance prediction and anomaly detection, and the embodiments of the intelligent device of system performance prediction and anomaly detection, the contents of which are incorporated herein, and the repeated parts will not be described herein.

[0123] It can be understood that the user terminal can include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, and the like. The smart wearable device can include smart glasses, a smart watch, a smart bracelet, and the like.

[0124] In actual application, part of the intelligent method of system performance prediction and anomaly detection can be executed on the electronic device as described above, or all operations can be completed in the client device. Specifically, the selection can be made according to the processing capability of the client device and the limitation of the user usage scenario, and the like. The present application is not limited thereto. If all operations are completed in the client device, the client device can further include a processor.

[0125] The client device described above can have a communication module (i.e., a communication unit) and can be communicatively connected with a remote server to realize the data transmission with the server. The server can include a server of the task scheduling center side, and the server of the intermediate platform can also be included in other implementation scenarios, such as the server of the third-party server platform communicatively connected with the server of the task scheduling center. The server can include a single computer device, a server cluster composed of multiple servers, or a server structure of a distributed device.

[0126] Figure 3 A schematic block diagram of the system configuration of the electronic device 9600 of the embodiment of the present application is shown in FIG. 9. As shown in FIG. 9, the electronic device 9600 can include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that the structure shown in FIG. 9 is exemplary; other types of structures can also be used to supplement or replace the structure to realize the telecommunication function or other functions. Figure 3 Figure 3 The structure shown in FIG. 9 is exemplary; other types of structures can also be used to supplement or replace the structure to realize the telecommunication function or other functions. ​

[0127] In an embodiment, the intelligent method of system performance prediction and anomaly detection can be integrated into the central processor 9100. The central processor 9100 can be configured to control as follows:

[0128] Step S101: Obtain the time series of the system, and decompose the time series into a trend component, a seasonal component and a residual component; input the trend component and the seasonal component into a first ARIMA model to generate a trend component predicted value and a seasonal component predicted value;

[0129] Step S102: Calculate the difference between the trend component predicted value and the actual value, and the difference between the seasonal component predicted value and the actual value, respectively, to obtain an initial residual of the trend component predicted value and an initial residual of the seasonal component predicted value; input the two initial residuals into an LSTM model to generate a predicted residual;

[0130] Step S103: Input the time series into a second ARIMA model to generate a first predicted value; add the first predicted value to the predicted residual to obtain a second predicted value; perform feature interaction on the second predicted value, the first predicted value, the initial residual and the predicted residual, and use a regularization algorithm and an LSTM layer to optimize to obtain a target interaction feature;

[0131] Step S104: Integrate the target interaction feature, the initial residual and the predicted residual into a feature data set, and perform standardization processing thereon; input the standardized feature data set into a prediction model to generate a target predicted value; determine whether the system performance is abnormal according to the comparison result of the target predicted value and a preset threshold.

[0132] As can be seen from the above description, the electronic device provided by the embodiments of the present application can, in view of the complexity and variability of system data, use a deep learning method to enable the model to more comprehensively capture the complex patterns and time dependencies of the data. This method effectively improves the accuracy of system performance prediction through multi-layer analysis and multi-angle feature extraction, and performs particularly well when dealing with time series data with nonlinear and variable characteristics.

[0133] Moreover, through feature selection and data enhancement techniques, the model has good adaptability when facing data of different scales and different properties. This robustness reduces the sensitivity of the model to data noise and anomalies, ensuring that the prediction results remain stable and reliable in various operating environments. At the same time, through reasonable parameter setting and model structure design, the scheme not only optimizes the execution efficiency, but also shows good scalability when dealing with real-time data and large-scale multi-dimensional data. This enables the scheme to be quickly deployed and put into use in actual business, supporting the continuous optimization and upgrading of the system.

[0134] In another embodiment, the system performance prediction and anomaly detection intelligent device can be configured separately from the central processor 9100, for example, the system performance prediction and anomaly detection intelligent device can be configured as a chip connected with the central processor 9100, and the functions of the system performance prediction and anomaly detection intelligent method are realized through the control of the central processor.

[0135] As shown in Figure 3 , the electronic device 9600 can also include a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily include all the components shown in Figure 3 ; in addition, the electronic device 9600 can also include components not shown in Figure 3 , which can be referred to prior art.

[0136] As shown in Figure 3 , the central processor 9100, also sometimes referred to as a controller or operating control, can include a microprocessor or other processor device and / or logic device, which receives input and controls the operation of the various components of the electronic device 9600.

[0137] The memory 9140, for example, can be one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, or other suitable device. Information related to failure can be stored, in addition to programs for executing related information. The central processor 9100 can execute the program stored in the memory 9140 to achieve information storage or processing, etc.

[0138] The input unit 9120 provides input to the central processor 9100. The input unit 9120 is, for example, a key or touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and text. The display can be, for example, an LCD display, but is not limited thereto.

[0139] The memory 9140 can be a solid state memory such as a read only memory (ROM), a random access memory (RAM), a SIM card, or the like. It can also be a memory that retains information even when power is off, can be selectively erased, and is provided with more data, an example of which is sometimes referred to as an EPROM or the like. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 can include an application / function storage 9142 for storing application programs and function programs or for storing a flow for executing an operation of the electronic device 9600 by the central processing unit 9100.

[0140] The memory 9140 can also include a data storage 9143 for storing data such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. A driver storage 9144 of the memory 9140 can include various drivers of the electronic device for a communication function and / or for performing other functions of the electronic device such as a messaging application, an address book application, and the like.

[0141] The communication module 9110 is a transmitter / receiver that transmits and receives signals via an antenna 9111. The communication module 9110 (transmitter / receiver) is coupled to the central processing unit 9100 to provide input signals and receive output signals, which can be the same as in the case of a conventional mobile communication terminal.

[0142] Based on different communication technologies, a plurality of communication modules 9110 such as a cellular network module, a Bluetooth module, and / or a wireless local area network module, and the like can be provided in the same electronic device. The communication module 9110 (transmitter / receiver) is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby implementing a conventional telecommunication function. The audio processor 9130 can include any suitable buffer, decoder, amplifier, and the like. In addition, the audio processor 9130 is also coupled to the central processing unit 9100, thereby enabling recording on the local by the microphone 9132 and enabling playing of a sound stored on the local by the speaker 9131.

[0143] The embodiments of the present application also provide a computer readable storage medium capable of realizing all steps of the intelligent method for system performance prediction and anomaly detection with the execution subject being a server or a client in the above embodiments, and the computer readable storage medium stores a computer program, and the computer program realizes all steps of the intelligent method for system performance prediction and anomaly detection with the execution subject being a server or a client in the above embodiments when executed by a processor, for example, the processor realizes the following steps when executing the computer program:

[0144] Step S101: Obtain a time series of a system, and decompose the time series into a trend component, a seasonal component and a residual component; input the trend component and the seasonal component into a first ARIMA model to generate a trend component predicted value and a seasonal component predicted value;

[0145] Step S102: Calculate the difference between the trend component predicted value and an actual value and the difference between the seasonal component predicted value and the actual value respectively to obtain an initial residual of the trend component predicted value and an initial residual of the seasonal component predicted value; input the two initial residuals into an LSTM model to generate a predicted residual;

[0146] Step S103: Input the time series into a second ARIMA model to generate a first predicted value; add the first predicted value and the predicted residual to obtain a second predicted value; perform feature interaction on the second predicted value, the first predicted value, the initial residual and the predicted residual, and obtain target interaction features by using a regularization algorithm and an LSTM layer optimization;

[0147] Step S104: Integrate the target interaction features, the initial residual and the predicted residual into a feature data set, and perform standardization processing on the feature data set; input the feature data set after the standardization processing into a prediction model to generate a target predicted value; and determine whether the system performance is abnormal according to the comparison result of the target predicted value and a preset threshold.

[0148] As can be seen from the above description, the computer readable storage medium provided by the embodiments of the present application can make the model more comprehensively capture the complex patterns and time dependencies of the data by using the deep learning method in view of the complexity and variability of system data. This method effectively improves the accuracy of system performance prediction through multi-layer analysis and multi-angle feature extraction, and performs particularly well when processing time series data with nonlinear and variable characteristics.

[0149] Moreover, through feature selection and data enhancement techniques, the model has good adaptability when facing different sizes and different properties of data. This robustness reduces the sensitivity of the model to data noise and anomalies, ensuring that the prediction results remain stable and reliable in a variety of operating environments. At the same time, through reasonable parameter setting and model structure design, the scheme not only optimizes the execution efficiency, but also shows good scalability when dealing with real-time data and large-scale multi-dimensional data. This enables the scheme to be quickly deployed and put into use in actual business, supporting the continuous optimization and upgrading of the system.

[0150] Embodiments of the present application also provide a computer program product capable of implementing all steps of the intelligent system performance prediction and anomaly detection method in the above-mentioned embodiments, wherein the computer program / instructions are executed by a processor to implement the steps of the intelligent system performance prediction and anomaly detection method, for example, the computer program / instructions implement the following steps:

[0151] Step S101: Obtain the time series of the system, and decompose the time series into a trend component, a seasonal component, and a residual component; input the trend component and the seasonal component into a first ARIMA model to generate a trend component prediction value and a seasonal component prediction value;

[0152] Step S102: Calculate the difference between the trend component prediction value and the actual value, and the difference between the seasonal component prediction value and the actual value, respectively, to obtain an initial residual of the trend component prediction value and an initial residual of the seasonal component prediction value; input the two initial residuals into an LSTM model to generate a prediction residual;

[0153] Step S103: Input the time series into a second ARIMA model to generate a first prediction value; add the first prediction value and the prediction residual to obtain a second prediction value; perform feature interaction on the second prediction value, the first prediction value, the initial residual, and the prediction residual, and use a regularization algorithm and an LSTM layer to optimize and obtain a target interaction feature;

[0154] Step S104: Integrate the target interaction feature, the initial residual, and the prediction residual into a feature data set, and perform standardization processing thereon; input the standardized feature data set into a prediction model to generate a target prediction value; determine whether the system performance is abnormal according to the comparison result of the target prediction value and a preset threshold.

[0155] From the above description, the computer program product provided by the embodiment of the present application can make the model capture the complex mode and time dependence of data more comprehensively by using the deep learning method according to the complexity and variability of system data. This method effectively improves the accuracy of system performance prediction through multi-layer analysis and multi-angle feature extraction, and performs particularly well when dealing with time series data with nonlinear and variable characteristics.

[0156] Moreover, through feature selection and data enhancement techniques, the model has good adaptability when facing data of different scales and different properties. This robustness reduces the sensitivity of the model to data noise and anomalies, ensuring that the prediction results remain stable and reliable in various operating environments. At the same time, through reasonable parameter setting and model structure design, the scheme not only optimizes the execution efficiency, but also shows good scalability when dealing with real-time data and large-scale multi-dimensional data. This enables the scheme to be quickly deployed and put into use in actual business, supporting the continuous optimization and upgrading of the system.

[0157] Those skilled in the art will understand that the embodiments of the present application can be provided as a method, apparatus, or computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0158] The present application is described with reference to flowcharts and / or block diagrams of the method, device (apparatus), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The device that implements the functions specified in one or more flows and / or blocks. Figure 1 The device that implements the functions specified in one or more flows and / or blocks.

[0159] These computer program instructions can also be stored in a computer readable storage medium that can guide the computer or other programmable data processing apparatus to work in a specific way, so that the instructions stored in the computer readable storage medium produce a product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure 1 The device that implements the functions specified in one or more flows and / or blocks. Figure 1the function specified in the one or more blocks.

[0160] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operational steps are performed on the computer or other programmable data processing devices to generate computer-implemented processes, so that the instructions executed on the computer or other programmable data processing devices provide processes for implementing the flows Figure 1 the flow or flows and / or blocks Figure 1 the steps of the function specified in the one or more blocks.

[0161] The principles and implementation manners of the present application are described in the specific embodiments in the present application, and the above embodiment descriptions are only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will have changes, and the above descriptions should not be understood as limitations on the present application.

Claims

1. An intelligent method for system performance prediction and anomaly detection, characterized in that, The method comprises: obtaining the time series of the system, and decomposing the time series into a trend component, a seasonal component and a residual component; inputting the trend component and the seasonal component into a first ARIMA model to generate a trend component prediction value and a seasonal component prediction value; the time series data of the system comprises a CPU usage rate time series, a memory time series and a network traffic time series; respectively calculating the difference between the trend component prediction value and the actual value and the difference between the seasonal component prediction value and the actual value to obtain an initial residual of the trend component prediction value and an initial residual of the seasonal component prediction value; inputting the two initial residuals into an LSTM model to generate a prediction residual; inputting the time series into a second ARIMA model to generate a first prediction value; adding the first prediction value and the prediction residual to obtain a second prediction value; performing feature interaction on the second prediction value, the first prediction value, the initial residual and the prediction residual, and using a regularization algorithm and an LSTM layer to optimize and obtain target interaction features; the step of performing feature interaction on the second prediction value, the first prediction value, the initial residual and the prediction residual, and using a regularization algorithm and an LSTM layer to optimize and obtain target interaction features comprises: using Polynomial Features to generate polynomial interaction features; using a joint Lasso algorithm to select first interaction features with an information amount exceeding a preset value from the interaction features; using an LSTM layer to further optimize the first interaction features to make them have time series information and dynamic change rules, and obtaining the target interaction features; integrating the target interaction features, the initial residual and the prediction residual into a feature data set, and performing standardization processing on the feature data set; inputting the feature data set after standardization processing into a prediction model to generate a target prediction value; determining whether the system performance is abnormal according to the comparison result of the target prediction value and a preset threshold; the step of determining whether the system performance is abnormal according to the comparison result of the target prediction value and a preset threshold comprises: calculating a first difference value of a historical target prediction value and an actual value; constructing an error distribution graph according to the first difference value, and setting at least one percentile as an abnormal threshold; calculating a second difference value of a new target prediction value and an actual value, and comparing the second difference value and the abnormal threshold; if the second difference value is greater than the abnormal threshold, it is determined that the system performance is abnormal; if the second difference value is less than the abnormal threshold, it is determined that the system performance is normal. 2.The intelligent system performance prediction and anomaly detection method of claim 1, wherein, The training method of the first ARIMA model comprises: obtaining time series from system monitoring, and using a sliding window to generate input-output pairs; checking the stationarity of the time series using ADF test; if the stationarity of the time series is lower than a preset value, eliminating the trend component by first-order difference; constructing an ARIMA initialization model, inputting the time series and model parameters p, d, q, training the model using the fit() method to obtain a fitting result; analyzing the model residual, and adjusting the model parameters according to the model residual until the model residual meets white noise. 3.The intelligent system performance prediction and anomaly detection method of claim 2, wherein, The step of analyzing the model residual and adjusting the model parameters according to the model residual until the model residual conforms to white noise comprises: drawing an autocorrelation function (ACF) graph of the model residual; if all autocorrelation values at different lags in the ACF graph are within a confidence interval, it is determined that the model residual is white noise; if the autocorrelation values at different lags are outside the confidence interval, the model parameters are adjusted until all autocorrelation values at different lags are within the confidence interval; further comprising normality verification, the method of which is: checking the degree of approximation of the model residual to normal distribution through a QQ plot; if the points of the model residual are close to the 45-degree line of the QQ plot, it is indicated that the model residual conforms to normal distribution; if the points of the model residual deviate from or are curved compared to the 45-degree line of the QQ plot by more than a preset value, the model parameters are adjusted until all the points of the model residual are close to the 45-degree line of the QQ plot; further comprising randomness verification, the method of which is: using Ljung-Box test to statistically evaluate whether the autocorrelation at multiple lags is significantly zero; if the p-value of the test is greater than a preset value, it is determined that the model residual is an independent random sequence; if the p-value of the test is less than the preset value, the model parameters are adjusted until the p-value of the test is greater than the preset value. 4.The intelligent system performance prediction and anomaly detection method of claim 1, wherein, The LSTM model is built using a multi-layer LSTM stack, and the LSTM is a bidirectional LSTM, and each LSTM layer is provided with multiple units; In the LSTM model, the number of units is determined by using Optuna for automatic hyperparameter optimization; each LSTM layer contains 64 to 256 units; In the LSTM model, a Dropout layer is added after each LSTM layer, and the Dropout rate of the Dropout layer is set to 0.2-0.5; In the LSTM model, multiple fully connected layers are added after all LSTM layers; the LSTM layers are used to extract features of the initial residual of the trend component prediction value / the initial residual of the seasonal component prediction value, and the fully connected layers are used to construct a mapping of the features to the output of the LSTM; each fully connected layer contains 32 to 128 neurons, and the data before and after the fully connected layer is processed using batch normalization; In the LSTM model, an attention layer is added after the LSTM and before the fully connected layer; for each time step, the attention layer uses a separate neural network layer to calculate the weight score of its output, and performs dot multiplication on the output of the LSTM and the calculated weight score to generate the weighted output of each time step, and then adds these weighted outputs to form the output of the attention layer. 5.The intelligent system performance prediction and anomaly detection method of claim 1, wherein, The training method of the LSTM model comprises: obtaining a time series from system monitoring, normalizing the time series using Z-score, and generating input-output pairs using a sliding window; The mean square error (MSE) is used as the loss function of the LSTM model, the gradient descent optimizer is selected as Adam, the learning rate is set to 0.001, and the learning rate adjustment strategy is used during the training process, and the batch size is selected as 32 to 64; The training method of the LSTM model further comprises: deploying the LSTM model in a containerized environment; the method of deploying the LSTM model in the containerized environment comprises: The trained LSTM model is saved in a portable format using the tf.saved_model module of TensorFlow; The LSTM model is encapsulated into an API service, a monitoring tool is integrated to monitor the performance of the model and the health status of the system, and logging is set for debugging; A Docker container is created, the model file and the API service are deployed into the Docker container, and multiple services are configured through DockerCompose; the services include the API service, the monitoring tool and the database; The LSTM model is requested for prediction through an API endpoint, and the performance indicators of the API service are monitored through a specified web interface; The Docker container is automatically deployed and updated using a CI / CD tool. 6.The intelligent system performance prediction and anomaly detection method of claim 1, wherein, After the step of inputting two initial residuals into the LSTM model to generate a predicted residual, the method further comprises: Randomly sampling samples from the historical data of the trend component and the seasonal component through bootstrap sampling, and using the samples as input to train multiple groups of ARIMA models and LSTM models; The predicted values of the multiple groups of ARIMA models and LSTM models are aggregated to generate the predicted residual using a weighted voting system; the weights of the weighted voting system are adjusted according to the performance evaluation results of the ARIMA models and the LSTM models.

7. An intelligent device for system performance prediction and anomaly detection, characterized in that, The device comprises: A first prediction module configured to obtain a time series of a system, and decompose the time series into a trend component, a seasonal component and a residual component; input the trend component and the seasonal component into a first ARIMA model to generate a trend component predicted value and a seasonal component predicted value; the time series data of the system includes a CPU usage time series, a memory time series and a network traffic time series; A second prediction module configured to calculate the difference between the trend component predicted value and the seasonal component predicted value and the actual value respectively, to obtain an initial residual of the trend component predicted value and an initial residual of the seasonal component predicted value; input two initial residuals into an LSTM model to generate a predicted residual; A first prediction module configured to obtain a time series of a system, and decompose the time series into a trend component, a seasonal component and a residual component; input the trend component and the seasonal component into a first ARIMA model to generate a trend component predicted value and a seasonal component predicted value; the time series data of the system includes a CPU usage time series, a memory time series and a network traffic time series; A second prediction module configured to calculate the difference between the trend component predicted value and the seasonal component predicted value and the actual value respectively, to obtain an initial residual of the trend component predicted value and an initial residual of the seasonal component predicted value; input two initial residuals into an LSTM model to generate a predicted residual; The feature interaction module is configured to input a time series into a second ARIMA model to generate a first predicted value; add the first predicted value to the prediction residual to obtain a second predicted value; perform feature interaction on the second predicted value, the first predicted value, the initial residual, and the prediction residual, and use a regularization algorithm and an LSTM layer to optimize to obtain a target interaction feature; the step of performing feature interaction on the second predicted value, the first predicted value, the initial residual, and the prediction residual, and using a regularization algorithm and an LSTM layer to optimize to obtain a target interaction feature includes: using Polynomial Features to generate polynomial interaction features; using a joint Lasso algorithm to select first interaction features with an information amount exceeding a preset value from the interaction features; and using an LSTM layer to further optimize the first interaction features to make them have time series information and dynamic change rules, and obtaining the target interaction features; The result output module is configured to integrate the target interaction features, the initial residual, and the prediction residual into a feature data set, and perform standardization processing on the feature data set; input the feature data set after the standardization processing into a prediction model to generate a target predicted value; and determine whether the system performance is abnormal according to a comparison result of the target predicted value and a preset threshold; the step of determining whether the system performance is abnormal according to the comparison result of the target predicted value and the preset threshold includes: calculating a first difference value between a historical target predicted value and an actual value; constructing an error distribution graph according to the first difference value, and setting at least one percentile as an abnormal threshold; calculating a second difference value between a new target predicted value and the actual value, comparing the second difference value with the abnormal threshold; if the second difference value is greater than the abnormal threshold, determining that the system performance is abnormal; and if the second difference value is less than the abnormal threshold, determining that the system performance is normal.

8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the steps of the intelligent system performance prediction and anomaly detection method of any one of claims 1 to 6 when executing the program.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program implements the steps of the intelligent system performance prediction and anomaly detection method of any one of claims 1 to 6 when executed by the processor.

Images