Data center machine room operation and maintenance anomaly detection method based on deep learning

Abstract

The invention provides a data center machine room operation and maintenance anomaly detection method based on deep learning, and the method comprises the steps: employing a long-short-term memory network to analyze a time sequence for a low-dimensional feature set, capturing a subtle mode in a low-dimensional dynamic feature, and obtaining a behavior mode sequence; extracting a data packet structure and time delay change from the abnormal candidate set, carrying out secondary screening by adopting an isolated forest algorithm, and determining a hidden abnormal behavior set; according to the abnormal mode set, analyzing the real-time data stream by adopting a sliding window mechanism, judging whether the abnormal mode continuously appears or not, and obtaining an abnormal continuity score; according to a final anomaly detection result, updating parameters of the behavior benchmark model, and optimizing the model by adopting an online learning mechanism to obtain an updated behavior benchmark model; and for the updated behavior reference model, circularly executing real-time data flow analysis, and continuously capturing a subtle mode to obtain continuous anomaly detection output.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method for detecting anomalies in data center computer room operation and maintenance based on deep learning. Background Art

[0002] Problem background: Data center operations and maintenance are key areas for ensuring the functioning of a modern information society. Their stability and security are directly linked to business continuity and data integrity. With the rapid development of cloud computing and big data, data centers face increasingly complex cyberattacks and system failures, making anomaly detection technology a key component in maintaining stable data center operations. Traditional detection methods primarily rely on rule matching and threshold monitoring. While effective for addressing overt failures, they often struggle with subtle anomalies. These methods are often unable to capture subtle and deliberately hidden changes in communication protocols. In one example, carefully designed low-frequency attacks or abnormal patterns disguised as normal behavior can make potential threats difficult to detect in a timely manner.

[0003] The core challenge in communication protocol anomaly detection lies in identifying subtle, carefully masked anomalous behaviors. Communication protocol data streams are high-dimensional and dynamic, and anomalous patterns are often hidden within massive amounts of data, manifesting as minute time delays or subtle changes in packet structure. These changes are often designed to closely resemble normal behavior, making them difficult to distinguish through conventional analytical methods. Furthermore, due to the hidden nature of anomalous patterns, detection systems must dynamically establish a baseline model of protocol behavior without relying on predefined rules. Building this baseline model relies on in-depth analysis of massive amounts of communication data, but the high dimensionality and real-time nature of this data require the system to strike a balance between computational efficiency and detection accuracy. Identifying hidden anomalies requires capturing subtle patterns in the data, and the accuracy of this pattern capture directly impacts the system's ability to detect anomalies.

[0004] Therefore, how to deeply analyze communication protocol data streams, dynamically build behavioral benchmark models, and accurately capture subtle abnormal patterns has become a key issue in data center room operation and maintenance anomaly detection. Summary of the Invention

[0005] The present invention provides a method for detecting anomalies in data center computer room operation and maintenance based on deep learning, which mainly includes: Real-time data streams are acquired from communication protocol data. Preprocessing extracts packet structure and time delay variation features, and principal component analysis is used for dimensionality reduction to obtain a low-dimensional feature set. Long-short-term memory networks are used to analyze time series within the low-dimensional feature set, capturing subtle patterns in low-dimensional dynamic characteristics and generating a behavioral pattern sequence. Based on the behavioral pattern sequence, an adaptive behavioral baseline model is constructed. If the deviation between new data and the model exceeds a preset threshold, it is identified as a potential anomaly, resulting in a candidate anomaly set. Packet structure and time delay variation are extracted from the candidate anomaly set, and the isolation forest algorithm is used for secondary screening to determine a hidden abnormal behavior set. For the hidden abnormal behavior set, the similarity between each abnormal pattern and the behavioral baseline model is calculated. If the similarity is below a preset threshold, it is identified as an abnormal pattern, resulting in a set of abnormal patterns. Based on the abnormal pattern set, a sliding window mechanism is used to analyze the real-time data stream to determine whether the abnormal pattern persists, resulting in an anomaly persistence score. For the anomaly persistence score, a weighted average method is used to combine the weights of packet structure and time delay variation. If the score exceeds a preset threshold, the anomaly is confirmed, resulting in the final anomaly detection result.

[0006] The technical solution provided by the embodiment of the present invention may have the following beneficial effects: First, this invention deeply analyzes communication protocol data streams, using long short-term memory (LSTM) networks to capture subtle patterns in the data and construct an adaptive behavioral baseline model. Compared to traditional methods, this method can more accurately identify hidden abnormal behaviors, effectively addressing the inadequacy of traditional methods in detecting complex and hidden anomalies, significantly improving the accuracy and reliability of anomaly detection in data center operations and maintenance.

[0007] Secondly, the present invention uses principal component analysis (PCA) to perform dimensionality reduction processing on high-dimensional features, which can effectively reduce data dimensions, reduce data complexity, and improve data processing efficiency. At the same time, it retains key information in the data, highlights the main features, and makes subsequent analysis and detection more efficient and accurate, solving the problem of difficulty in processing high-dimensional data.

[0008] Finally, the present invention constructs an adaptive behavior benchmark model that can reflect normal behavior patterns through time series analysis and clustering algorithms. The model can be dynamically updated as new data is continuously added, and can adapt to changes in the operation and maintenance data of the data center computer room. It effectively solves the problem that fixed thresholds and rules in traditional methods are difficult to adapt to dynamic changes in data, and improves the adaptability and accuracy of anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 A flowchart of a method for detecting anomalies in a data center computer room operation and maintenance based on deep learning is provided in an embodiment of the present invention.

[0010] Figure 2A flowchart of a method for detecting anomalies in data center computer room operation and maintenance based on deep learning is provided as another embodiment of the present invention.

[0011] Figure 3 A flowchart of a method for detecting anomalies in a data center computer room operation and maintenance based on deep learning is provided as another embodiment of the present invention. DETAILED DESCRIPTION

[0012] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0013] like Figure 1 As shown, an embodiment of the present invention provides a method for detecting anomalies in a data center computer room operation and maintenance based on deep learning, which may specifically include the following steps: S101. Acquire real-time data stream from communication protocol data, extract data packet structure and time delay variation characteristics through preprocessing, and use principal component analysis to reduce dimension to obtain a low-dimensional feature set.

[0014] Real-time data streams are acquired from communication protocol data, and the original data packets are parsed using a data stream capture tool to obtain a data packet sequence. The data packet sequence is parsed through preprocessing, and the data packet structure and time delay features are extracted to obtain a structured feature set. If the dimension of the structured feature set is higher than the preset threshold, principal component analysis is used to reduce the dimension of the feature set to obtain a low-dimensional feature set. Based on the low-dimensional feature set, the delay change trend of the time delay feature is calculated to obtain a delay change sequence. Cluster analysis is performed on the delay change sequence to determine the abnormal pattern of the delay change trend and obtain an abnormal pattern set. If there is a pattern in the abnormal pattern set that matches the preset abnormal template, the feature subset of the matching pattern is extracted to obtain an abnormal feature subset. The abnormal feature subset is compared and analyzed with the low-dimensional feature set to determine the source of the abnormal feature and obtain the abnormal source distribution.

[0015] The main steps of principal component analysis (PCA) dimensionality reduction include: Input: structured feature set X m×n (m samples, n features), the preset principal component analysis dimensionality reduction threshold k.

[0016] Standardization: Standardize X to get X ∗ For each feature j, the normalization formula can be: , where μ j and σ jare the mean and standard deviation of feature j, respectively.

[0017] Calculate the covariance matrix: Find X ∗ The covariance matrix C of , whose elements satisfy: .

[0018] Eigenvalue decomposition: Perform eigenvalue decomposition on C to obtain eigenvalues: λ1≥λ2≥…≥λ n and the corresponding eigenvectors v1,v2,…,v n .

[0019] Select principal components: Take the first k eigenvectors to form the projection matrix V=[v1,v2,…,v k ].

[0020] Dimensionality reduction: Calculate X ∗ V, get the feature set X after dimensionality reduction reduced .

[0021] In data center operations and maintenance, communication protocol data contains numerous features, such as source IP address, destination IP address, port number, protocol type, payload size, time delay, and other information. This increased data dimensionality leads to enormous data storage requirements. PCA reduces the number of features by projecting the original high-dimensional data into a low-dimensional space. For example, the original data may have 100 dimensions. After PCA dimensionality reduction, only 10-20 principal components may be retained to explain the majority of the data variance, significantly reducing data storage space.

[0022] Specifically, to obtain real-time data streams from communication protocol data, a protocol analysis tool such as Wireshark can be used to capture TCP / IP packets on a network interface. Assume that 1,000 packets are captured, each containing a source IP address, destination IP address, timestamp, and payload size, with the payload size ranging from 64 to 1,500 bytes. The captured data stream is stored in PCAP format, with timestamp accuracy at the microsecond level (in one embodiment, 2025-05-13 19:09:23.123456). During preprocessing, the PCAP file is parsed to extract the packet structure. Each packet is read using the Python Scapy library, extracting fields such as the source IP address 192.168.1.10, the destination IP address 10.0.0.5, the timestamp, and the 512-byte payload size. The time delay between adjacent packets is calculated, with delay values ranging from 0.1 to 10 milliseconds. This yields a feature matrix X with dimensions of 1,000 × 4 (source IP address encoding, destination IP address encoding, payload size, and time delay). To analyze the characteristics of time delay variations, statistical features of delay were calculated, such as a mean of 0.5 milliseconds and a standard deviation of 0.2 milliseconds. The Fourier transform of the time series was generated to extract periodic variation features with a dominant frequency of 50 Hz. The matrix X was then expanded to 1000×6. Dimensionality reduction was performed using principal component analysis (PCA) using the sklearn.decomposition.PCA library. The standardized matrix X (mean 0, variance 1) was input, the covariance matrix was calculated, and the first two principal components were extracted, with a cumulative contribution of 85%. The output was a low-dimensional feature set Y with dimensions of 1000×2. The first principal component had a correlation of 0.9 with load size, and the second principal component had a correlation of 0.7 with time delay. Eigenvalue decomposition was used during the analysis process to ensure that the dimensionality reduction retained key information. The low-dimensional features Y can be used for subsequent operations, such as network anomaly detection, to detect time delay anomalies (points exceeding the mean ±2 standard deviations, which account for approximately 5%), forming a complete logical chain from data capture to feature extraction.

[0023] S102. For low-dimensional feature sets, a long short-term memory network is used to analyze time series, capture subtle patterns in low-dimensional dynamic characteristics, and obtain a behavioral pattern sequence.

[0024] Time series data is obtained from the low-dimensional feature set through a preset data interface, and the data is normalized using a standard processing method to obtain the processed time series data. The processed time series data is trained using a long short-term memory network, and hidden layer units are set to capture time dependencies and generate intermediate feature representations containing dynamic characteristics. Based on the intermediate feature representation, the attention mechanism is applied to weight the low-dimensional dynamic characteristics, extract the subtle patterns of key time steps, and obtain the weighted feature vector. Specifically, assuming the input sequence is {x1, x2, ..., x t}, where x tis the feature vector of the tth time step. The attention mechanism usually calculates an attention score e t , to measure the importance of each time step: ; Among them, f can be various forms of functions, such as dot product, addition or feedforward neural network, etc., h t-1 is the hidden state output by the Long Short-Term Memory (LSTM) model. In this embodiment of the present invention, additive attention is used as an example to illustrate: ; Among them, v a is a learnable weight vector, W a 、U a is the weight matrix, b a is the bias term, ┬ represents the transpose operation of a vector or matrix, and tanh is the hyperbolic tangent function. Then, the attention score e t Normalized to the attention weight α t ; Finally, the input feature is multiplied by the attention weight to obtain the weighted feature vector: .

[0025] When analyzing time series data from data center operations, the data may contain numerous features, but not all of them are useful for anomaly detection. Attention mechanisms can automatically learn and highlight subtle patterns at critical time steps, more accurately capturing subtle changes that may lead to anomalies. For example, small changes in packet structure or latency at a specific time point may indicate potential anomalous behavior, and the attention mechanism can identify and enhance these key features. Furthermore, the attention mechanism can reduce the interference of irrelevant information. In data center operations data, normal behavior patterns may dominate, while anomalous behavior manifests as only localized, subtle changes. The attention mechanism focuses on areas that may contain anomalous information, reducing the interference of normal behavior data on anomaly detection, thereby improving detection accuracy. Finally, by assigning different weights to each time step, the attention mechanism identifies which time step features are most critical for anomaly detection. This helps operators understand how the model makes anomaly detection decisions. For example, if the attention mechanism assigns a higher weight to a particular time point, operators can focus on the data features at that time point and analyze whether they correspond to actual anomalies, thereby better understanding the basis for the model's decisions.

[0026] If the dimension of the weighted feature vector exceeds a preset threshold, principal component analysis is used to reduce its dimensionality and obtain a reduced feature vector. A preset classifier is used to perform pattern recognition on the reduced feature vector to generate a preliminary behavioral pattern sequence. After obtaining the preliminary behavioral pattern sequence, a sliding window method is used to detect outliers in the sequence. If an outlier is detected, the sequence is smoothed using interpolation to obtain a smoothed behavioral pattern sequence. Based on the smoothed behavioral pattern sequence, clustering methods are used to group the sequences and determine the final behavioral pattern sequence.

[0027] Specifically, in a low-dimensional feature set, consider a time series dataset containing 10 features, each with 100 time steps. First, the data is normalized to a scale between 0 and 1 using a standardization method to ensure consistent scale across features. Next, a long short-term memory (LSTM) model is constructed, consisting of two LSTM layers, each with 50 hidden units and using the ReLU activation function. The model's input shape is (100, 10), representing 100 time steps and 10 features. The Adam optimizer is used with a learning rate of 0.001, and the mean squared error (MSE) is used as the loss function during training. During training, the batch size is set to 32, and the number of training epochs is set to 50. After training, the trained model is used to predict the test set, generating a sequence of behavioral patterns. To capture subtle patterns in low-dimensional dynamics, other embodiments can further perform cluster analysis on the prediction results. The K-means algorithm is used to classify the behavioral pattern sequences into five categories. The clustering effect is evaluated using the silhouette coefficient, which reaches 0.75, indicating that the clustering results have good discrimination. Finally, the clustering results are displayed using a visualization tool to more intuitively understand the differences between different behavioral patterns.

[0028] S103. Based on the behavior pattern sequence, an adaptive behavior benchmark model is constructed. If the deviation between the new data and the model exceeds a preset threshold, it is judged as a potential anomaly and an anomaly candidate set is obtained.

[0029] An initial adaptive behavior benchmark model is constructed using a sequence of behavioral patterns. Time series analysis methods are used to extract sequence features to obtain a benchmark model. Deviations are calculated based on the new data and the benchmark model. In one embodiment, the mean square error method can be used to quantify the deviation value to obtain a deviation result. If the deviation result exceeds a preset threshold, the new data is marked as a potential anomaly to obtain a potential anomaly set. For the potential anomaly set, a cluster analysis method is used to group similar anomalies to obtain an anomaly candidate set. The adaptive behavior benchmark model is updated by comparing the anomaly candidate set with historical data to obtain an updated model. The deviation value of the new data is recalculated based on the updated model, and a new deviation result is obtained using the mean square error method. If the new deviation result still exceeds the preset threshold, the anomaly candidate is confirmed to be an anomaly to obtain a final anomaly set.

[0030] Specifically, when building an adaptive behavioral benchmark model, we first need to collect historical behavioral pattern data. In one embodiment, this includes user login time, operation frequency, access path, and so on. Assume that 1,000 historical data points have been collected, each containing 10 features. This data is clustered using the K-means clustering algorithm, with the number of clusters set to 5. The distance between a data point and the cluster center is calculated using the Euclidean distance to obtain the category label for each data point. Next, we build a benchmark model based on the clustering results, and calculate the center point of each category as the benchmark value.

[0031] In one embodiment, the center points of category 1 are [0.5, 0.7, 0.3, 0.8, 0.6, 0.4, 0.9, 0.2, 0.1, 0.5]. When new data arrives, its distance to the center points of each category is calculated using the Mahalanobis distance metric with a threshold of 2.0. If the minimum distance between the new data and all category centers exceeds 2.0, it is considered a potential anomaly.

[0032] In one example, the new data [0.6, 0.8, 0.4, 0.9, 0.7, 0.5, 1.0, 0.3, 0.2, 0.6] has a Mahalanobis distance of 2.5 with the center of class 1, exceeding the threshold. Therefore, it is added to the anomaly candidate set. This allows the baseline model to be dynamically updated and new data to be continuously monitored for anomalies.

[0033] S104: Extract the data packet structure and time delay variation from the abnormal candidate set, perform secondary screening using the isolation forest algorithm, and determine the hidden abnormal behavior set.

[0034] Packet structural features and time delay variation features are extracted from the anomaly candidate set. These features are normalized using a preprocessing method to obtain a standardized feature set. If the distribution of packet structural features in the standardized feature set deviates from the preset threshold, the features are subjected to dimensionality reduction to obtain a reduced-dimensionality feature set. The reduced-dimensionality feature set is then subjected to anomaly detection using the isolation forest algorithm to obtain anomaly scores and determine a preliminary set of anomaly points. Based on the time delay variation features of the preliminary anomaly point set, a clustering algorithm is used to group the anomalies to obtain abnormal behavior clusters. If the number of abnormal behavior clusters falls below the preset threshold, a time series analysis of the time delay variation features of each cluster is performed to determine hidden abnormal behavior.

[0035] In one embodiment, the ARIMA model is used to analyze hidden abnormal behavior. Specifically, Input: Time series of time-delay variation features of each cluster {y1,y2,…,y t Establishing an ARIMA model: Performing a difference operation on the time series to make it stationary, determining the ARIMA model parameters p (number of autoregressive terms), d (number of differencing operations), and q (number of moving average terms). Model fitting and forecasting: Fitting the ARIMA model to historical data and forecasting future values. Calculating residuals: Comparing the residuals between the actual and predicted values. If the residuals exceed a certain confidence interval, it is determined that hidden anomalies exist at that moment. The ARIMA model is highly effective in capturing trends, seasonality, and cyclical characteristics in time series data. In data center maintenance, time delay variations may exhibit patterns over time. For example, latency may increase during specific time periods due to peak network traffic. By fitting historical data, the ARIMA model can accurately extract these patterns, providing a powerful basis for anomaly detection. Furthermore, the ARIMA model parameters p, d, and q can be flexibly adjusted based on the specific characteristics of the time series. To account for the varying time delay variations in different data center maintenance scenarios, the model parameters can be adjusted to better fit the actual data, improving the model's accuracy and applicability. Furthermore, the size of the residual can also reflect the severity of the anomaly to a certain extent. A larger residual means a greater deviation between the actual value and the predicted value, which may indicate a more serious anomaly. This helps operations personnel take appropriate measures based on the severity of the anomaly and rationally allocate resources for troubleshooting and resolution.

[0036] By correlating the structural features and delay variation features of hidden abnormal behaviors, a set of hidden abnormal behaviors is determined. Based on the set of hidden abnormal behaviors, the behavior set is verified using a rule matching method to obtain the final abnormal behavior set.

[0037] Specifically, in the abnormal candidate set, the structural information of each data packet is first extracted through the data packet parsing tool, including fields such as source IP, destination IP, port number, protocol type, etc., and the timestamp of each data packet is recorded.

[0038] In one embodiment, 200 packets with a source IP address of 192.168.1.1 and 300 packets with a destination port of 80 were extracted from 1,000 packets. Next, the time delay variation of these packets was calculated, assuming that within 1 second, the average packet delay was 0.05 seconds with a standard deviation of 0.01 seconds. This data was then subjected to a secondary screening using the isolation forest algorithm. The isolation forest algorithm detects outliers by constructing multiple binary trees, with each tree randomly selecting features for segmentation. Because outliers are distributed differently from normal points, they are isolated at shallower nodes.

[0039] In one embodiment, the number of trees in the isolation forest is set to 100, the number of samples in each tree is set to 256, and the anomaly score of each data point is calculated, and data points with anomaly scores greater than 0.6 are screened out to ultimately determine the set of hidden abnormal behaviors.

[0040] In one embodiment, 50 abnormal data packets are screened out from 1,000 data packets. The source IP and destination ports of these data packets are significantly different from those of normal data packets, and the time delay changes are also beyond the normal range. They are determined to be a set of hidden abnormal behaviors.

[0041] S105. For the hidden abnormal behavior set, calculate the similarity between each abnormal pattern and the behavior benchmark model. If the similarity is lower than a preset threshold, it is determined to be an abnormal pattern, and an abnormal pattern set is obtained.

[0042] Through data preprocessing, behavioral data is extracted from hidden abnormal behaviors to obtain a pattern feature set. A principal component analysis algorithm is used to reduce the dimensionality of the pattern feature set to obtain a low-dimensional feature set. Based on the low-dimensional feature set and the behavioral baseline model, a similarity measure is calculated for each abnormal pattern to obtain a similarity set. If the value in the similarity set is lower than a preset threshold, the corresponding pattern is determined to be abnormal, and a preliminary abnormal pattern set is obtained. For the preliminary abnormal pattern set, the time series features of its behavioral data are obtained to obtain a time series feature set. Using the isolation forest algorithm, abnormal patterns are detected from the time series feature set to obtain a refined abnormal pattern set. Based on the refined abnormal pattern set, the deviations between its pattern features and the behavioral baseline model are extracted to obtain an abnormal pattern deviation set.

[0043] Specifically, for a set of hidden abnormal behaviors, we first constructed a behavioral baseline model. We extracted 1,000 normal user behavior records from historical data. Each record contained three features: login time, operation frequency, and number of pages visited. These features were normalized to the interval [0, 1]. The feature mean vector M was calculated as [0.5, 0.2, 0.3]. The normal behaviors were clustered using the K-means clustering algorithm (K=3), resulting in three cluster centers: C1=[0.4, 0.15, 0.25], C2=[0.55, 0.25, 0.35], and C3=[0.45, 0.2, 0.3]. The mean of these clusters was taken as the baseline model, B=[0.47, 0.2, 0.3]. For a set of hidden abnormal behaviors, assuming it contained 500 records to be detected, we similarly extracted three features from each record and normalized them. In one example, a record A=[0.1, 0.8, 0.9]. Calculate the similarity between A and the baseline model B using the cosine similarity formula: cosθ=(A·B) / (||A||·||B||). Calculate A·B=0.1×0.47+0.8×0.2+0.9×0.3=0.477, ||A||=√(0.1²+0.8²+0.9²)=1.204, ||B||=√(0.47²+0.2²+0.3²)=0.592, cosθ=0.477 / (1.204×0.592)=0.669. Set the similarity threshold to 0.8. Since 0.669<0.8, A is determined to be an abnormal pattern. Repeat this process for 500 records one by one to obtain a set of records with a similarity lower than 0.8. In one embodiment, the set of abnormal patterns contains 100 records. To ensure logical rigor, we further analyzed the characteristic distribution of abnormal patterns and calculated the characteristic mean of the abnormal set [0.15, 0.75, 0.85]. Compared with the baseline model, we found that the operation frequency and number of pages were significantly higher. We speculated that this may be an automated script attack. Related businesses can trigger real-time alarms and notify the security system to intercept.

[0044] S106. Based on the abnormal pattern set, a sliding window mechanism is used to analyze the real-time data stream to determine whether the abnormal pattern continues to appear, and obtain an abnormal persistence score.

[0045] Real-time data streams are acquired and pattern matching is performed against a pre-established anomaly pattern set to identify the initial anomaly event. If an initial anomaly event is detected, a sliding window mechanism is used to partition the time window, obtaining a data subset within the time window. For the data subset within the time window, the frequency of occurrence of the anomaly pattern is calculated to obtain a frequency distribution characteristic. The frequency distribution characteristic is compared with a preset anomaly detection threshold to determine whether the anomaly pattern persists. If the anomaly pattern persists, an anomaly persistence score is determined based on a scoring formula that combines the frequency and duration of the anomaly pattern. Using the persistence score, the pattern weights in the anomaly pattern set are updated to obtain an optimized anomaly pattern set. Using the optimized anomaly pattern set, the real-time data stream is reanalyzed to identify the next round of anomalies. The above steps form a logically closed loop, with the outputs and inputs of the previous and subsequent steps tightly connected. All steps revolve around the goal of anomaly persistence scoring and are based on attributes such as the anomaly pattern set, the sliding window mechanism, and the real-time data stream. Unrelated attributes such as the data flow rate are avoided to ensure a close connection between the technical processes.

[0046] Specifically, in real-time data stream analysis, a sliding window mechanism is first employed, with a window size of 100 data points and a sliding step of 10 data points to ensure the continuity and coverage of the data stream. The data within each window is analyzed in the frequency domain using a fast Fourier transform (FFT), extracting the primary frequency components and matching them against a predefined set of anomaly patterns.

[0047] In one embodiment, when an abnormal pattern with a frequency of 50Hz is detected within a window, the system records the number of occurrences and duration of the anomaly. Next, the system calculates the frequency of the abnormal pattern in consecutive windows and uses a weighted average algorithm, assigning higher weights to the most recent window, to calculate an anomaly persistence score. Assuming that the abnormal pattern appears 3, 4, 5, 6, and 7 times in five consecutive windows, with weights of 0.1, 0.2, 0.3, 0.4, and 0.5, respectively, the anomaly persistence score is (3 × 0.1 + 4 × 0.2 + 5 × 0.3 + 6 × 0.4 + 7 × 0.5) / (0.1 + 0.2 + 0.3 + 0.4 + 0.5) = 5.5. Finally, based on the scoring results, the system determines whether the abnormal pattern persists and triggers appropriate early warning mechanisms to ensure timely response and resolution of potential issues.

[0048] S107. For the abnormal persistence score, a weighted average method is used to fuse the weights of the data packet structure and the time delay change. If the score exceeds a preset threshold, the abnormality is confirmed and the final abnormality detection result is obtained.

[0049] A data acquisition module is used to obtain packet structure and time delay variation information from network traffic, extract structural features and delay variation features, and obtain an initial feature set. The structural features and delay variation features in the initial feature set are fused using a preset weighted averaging method, and the weighted feature vector is calculated to obtain an anomaly persistence score. If the anomaly persistence score exceeds the preset threshold, it is determined to be an anomaly, an anomaly label is generated, and a preliminary anomaly detection result is obtained. Based on the preliminary anomaly detection results, the anomaly labels are clustered using the K-Means algorithm to divide the anomaly types and obtain a classified anomaly type set. Representative features of each type are extracted from the classified anomaly type set, and a decision tree algorithm is used to construct an anomaly type classification model to obtain an anomaly type prediction model. The anomaly type prediction model is used to perform real-time analysis on the newly collected network traffic data, generate anomaly type labels, and obtain the final anomaly detection result. After obtaining the final anomaly detection result, the result is stored in a preset database, and the anomaly detection log is updated to obtain an anomaly detection record.

[0050] Specifically, for the anomaly persistence score, a weighted average method is used to integrate the weights of packet structure and time delay variation. The specific implementation method is as follows: First, network data streams are collected. Assuming that 1000 packets are captured per second, packet structure features (such as packet length and protocol type) and time delay features (such as the time interval between packets) are extracted.

[0051] In one example, in a data stream, the average packet length is 500 bytes with a standard deviation of 50 bytes; the average time delay is 0.02 seconds with a standard deviation of 0.005 seconds. Next, an anomaly score for the packet structure is calculated using a statistical anomaly detection algorithm. Packets exceeding the mean ±2 times the standard deviation are considered abnormal. The percentage of abnormal packets is calculated. Assuming 50 out of 1000 packets are longer than 550 or less than 450 bytes, the abnormal percentage is 5%. For time delay, the delay change rate is calculated using the formula |current delay - average delay| / average delay. If the rate of change is greater than 0.25 (i.e., 0.005 / 0.02), it is marked as abnormal. Assuming 100 packets meet this condition, the abnormal percentage is 10%. The two anomaly scores are then combined using a weighted average method, with a weight of 0.6 for packet structure and 0.4 for time delay. The resulting composite score is: 0.6 × 5% + 0.4 × 10% = 7%. A threshold of 6% is set; since 7% > 6%, an abnormality is confirmed. Finally, by comparing the comprehensive score with the threshold, the system outputs anomaly detection results, records the timestamp and characteristics of the abnormal data flow, and stores them in a database for subsequent network security analysis, such as linking with intrusion detection systems to confirm whether it is a DDoS attack. This process is implemented through automated scripts with rigorous logic and clear numerical calculations, ensuring efficient and accurate anomaly detection.

[0052] See Figure 2As shown, in one embodiment, as a further improvement, the data center computer room operation and maintenance anomaly detection method may further include: S108. Update the parameters of the behavior benchmark model according to the final anomaly detection result, and optimize the model using an online learning mechanism to obtain an updated behavior benchmark model.

[0053] Abnormal data features are extracted from the anomaly detection results. A feature extraction process is used to determine the deviation characteristics between the abnormal data and normal data, resulting in a deviation feature set. Using this deviation feature set, an online learning mechanism is used to iteratively calculate the behavioral baseline model, update the model parameters, and obtain a provisional updated model. If the performance indicators of the provisional updated model fall below a preset threshold, new data is obtained from the training data input and, in combination with a real-time feedback adjustment strategy, the model is iteratively recalculated to obtain an adjusted model. Based on the adjusted model, a parameter adjustment strategy is used to optimize the model weight distribution and determine the final model parameters to obtain the optimized model. Updated behavioral pattern features are extracted from the optimized model, and data stream processing techniques are used to update the behavioral baseline model in real time to obtain the updated model. Using the updated model, a real-time data stream is obtained and, in combination with the feature extraction process, the model is judged to determine whether it is adapted to the current data distribution, resulting in an adaptability assessment result. If the adaptability assessment result indicates that the model deviation exceeds a preset threshold, an online learning mechanism is used in combination with a real-time feedback adjustment strategy to re-update the model parameters to obtain the final updated model.

[0054] Specifically, in the anomaly detection stage, by collecting the user behavior data stream in real time, the Local Outlier Factor (LOF) algorithm based on density is used to calculate the local outlier factor of each data point. The threshold is set to 1.5. When the LOF value of a certain login behavior reaches 2.3, an anomaly flag is triggered. For the detected abnormal behaviors, the online gradient descent algorithm is used to update the behavior benchmark model. The learning rate is set to 0.01, and the weight decay coefficient λ is taken as 0.001. The model parameter w is iteratively optimized as w = w - η(∇L(w) + λw), where the loss function L uses the Huber loss, and the δ parameter is set to 1.2 to balance the influence of outliers. During the parameter update process, the mean μ and standard deviation σ of the last 1000 normal behavior samples are retained through a sliding window mechanism. When the new data point x satisfies μ - 2σ < x < μ + 3σ, it is included in the training set. For the feature engineering link, PCA dimensionality reduction is used to retain 85% of the variance contribution rate, and the original 23-dimensional features are compressed into 8-dimensional principal components. The model performance is evaluated using the dynamic AUC metric. When the window period is 50 batches, the AUC value increases from 0.82 to 0.89, proving that the parameter update is effective. At the same time, a feature importance ranking mechanism is established, and it is found that the weight of the "operation interval standard deviation" feature increases from 0.15 to 0.22, reflecting the increased contribution of this indicator to anomaly recognition. Throughout the process, a double-check mechanism is adopted. When the loss function decrease rate of three consecutive parameter updates is less than 1%, the early stopping strategy is automatically triggered.

[0055] Please refer to Figure 3 As shown, in one embodiment, as a further improvement, the data center computer room operation and maintenance anomaly detection method may further include: S109. For the updated behavior benchmark model, continuously perform real-time data stream analysis in a loop to continuously capture subtle patterns and obtain continuous anomaly detection outputs.

[0056] Obtain the real-time data stream, parse the data through streaming processing technology to obtain a structured data sequence. If the structured data sequence meets the preset integrity conditions, perform pattern matching based on the behavior benchmark model to determine the initial matching pattern. Use the sliding window technology to process the initial matching pattern to capture weak patterns and obtain the pattern feature vector. If the deviation between the pattern feature vector and the behavior benchmark model exceeds the preset threshold, perform anomaly detection through the Isolation Forest algorithm to judge the anomaly points. For the anomaly points, combine the time series context and generate an anomaly identification sequence through dynamic analysis. According to the anomaly identification sequence, update the behavior benchmark model to obtain an optimized benchmark model. Through the optimized benchmark model, generate a continuous anomaly output sequence.

[0057] Specifically, in real-time data stream analysis, a sliding window mechanism is used to collect data streams at one-second intervals, with a window size of 1000 records. The raw data is then denoised using the Kalman filter algorithm, with filter parameters set to Q=0.01 and R=0.1. The preprocessed data is then fed into an LSTM-based time series prediction model. This model consists of three hidden layers, each with 128 neurons, using the tanh activation function. Training is performed using the Adam optimizer with a learning rate of 0.001. The model updates its weights online every five minutes. The residual between the predicted and actual values is calculated, and an anomaly alert is triggered when the residual exceeds three standard deviations. Detected anomalies are analyzed for patterns using the DBSCAN clustering algorithm, with a neighborhood radius of eps=0.5 and a minimum sample size of min_samples=10. Similar anomalies are clustered into events. Furthermore, the proportion of anomalies within the sliding window is calculated. A critical alert is triggered when the proportion exceeds 15% within 10 seconds. All detection results are pushed in real time via a Kafka message queue. The message format is serialized using Protocol Buffers and includes fields such as timestamp, anomaly score, and cluster label. The system generates hourly statistical reports, including metrics such as the number of anomalies, type distribution, and trend changes, and stores them in Elasticsearch for visualization.

[0058] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A data center computer room operation and maintenance anomaly detection method based on deep learning, characterized in that: The method comprises: Real-time data streams are acquired from communication protocol data. Preprocessing extracts packet structure and time delay variation features, and principal component analysis is used for dimensionality reduction to obtain a low-dimensional feature set. Long-short-term memory networks are used to analyze time series within the low-dimensional feature set, capturing subtle patterns in low-dimensional dynamic characteristics and generating a behavioral pattern sequence. Based on the behavioral pattern sequence, an adaptive behavioral baseline model is constructed. If the deviation between new data and the model exceeds a preset threshold, it is identified as a potential anomaly, resulting in a candidate anomaly set. Packet structure and time delay variation are extracted from the candidate anomaly set, and the isolation forest algorithm is used for secondary screening to determine a hidden abnormal behavior set. For the hidden abnormal behavior set, the similarity between each abnormal pattern and the behavioral baseline model is calculated. If the similarity is below a preset threshold, it is identified as an abnormal pattern, resulting in a set of abnormal patterns. Based on the abnormal pattern set, a sliding window mechanism is used to analyze the real-time data stream to determine whether the abnormal pattern persists, resulting in an anomaly persistence score. For the anomaly persistence score, a weighted average method is used to combine the weights of packet structure and time delay variation. If the score exceeds a preset threshold, the anomaly is confirmed, resulting in the final anomaly detection result.

2. A method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 1, characterized in that: The real-time data stream is obtained from the communication protocol data, the data packet structure and time delay variation characteristics are extracted through preprocessing, and the principal component analysis is used for dimensionality reduction to obtain a low-dimensional feature set, including: Obtain real-time data streams from communication protocol data, use data stream capture tools to parse raw data packets, and obtain data packet sequences; By preprocessing and parsing the data packet sequence, the data packet structure and time delay features are extracted to obtain a structured feature set; If the dimension of the structured feature set is higher than the preset threshold, principal component analysis is used to reduce the dimension of the feature set to obtain a low-dimensional feature set; According to the low-dimensional feature set, the delay change trend of the time delay feature is calculated to obtain the delay change sequence; By performing cluster analysis on the delay change sequence, the abnormal pattern of the delay change trend is determined and the abnormal pattern set is obtained; If there is a pattern matching the preset abnormal template in the abnormal pattern set, the feature subset of the matching pattern is extracted to obtain the abnormal feature subset; The abnormal feature subset is compared with the low-dimensional feature set to determine the source of the abnormal features and obtain the abnormal source distribution.

3. The method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 1, characterized in that: The long short-term memory network is used to analyze the time series for the low-dimensional feature set, capture the subtle patterns in the low-dimensional dynamic characteristics, and obtain the behavior pattern sequence, including: Obtain time series data from a low-dimensional feature set through a preset data interface, normalize the data using a standardization processing method, and obtain processed time series data; The processed time series data is trained using a long short-term memory network, with hidden layer units set to capture temporal dependencies and generate intermediate feature representations containing dynamic characteristics. Based on the intermediate feature representation, the attention mechanism is applied to weight the low-dimensional dynamic features, extracting the subtle patterns of key time steps and obtaining the weighted feature vector; If the dimension of the weighted feature vector exceeds the preset threshold, the principal component analysis method is used to reduce the dimension and obtain the reduced dimension feature vector; Perform pattern recognition on the feature vector after dimensionality reduction through a preset classifier to generate a preliminary behavior pattern sequence; Obtain a preliminary behavior pattern sequence, use a sliding window method to detect abnormal points in the sequence, and if an abnormal point is detected, smooth it through interpolation to obtain a smoothed behavior pattern sequence; According to the smoothed behavior pattern sequence, the clustering method is applied to group the sequence and determine the final behavior pattern sequence.

4. The method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 1, characterized in that: According to the behavior pattern sequence, an adaptive behavior benchmark model is constructed. If the deviation between the new data and the model exceeds a preset threshold, it is judged as a potential anomaly, and an anomaly candidate set is obtained, including: The initial adaptive behavior benchmark model is constructed through the behavior pattern sequence, and the sequence features are extracted using the time series analysis method to obtain the benchmark model; Calculate the deviation between the new data and the benchmark model, use the mean square error method to quantify the deviation value, and obtain the deviation result; If the deviation result exceeds the preset threshold, the new data is marked as a potential anomaly and a potential anomaly set is obtained; For the potential anomaly set, cluster analysis method is used to group similar anomalies to obtain the anomaly candidate set; By comparing the abnormal candidate set with historical data, the adaptive behavior baseline model is updated to obtain an updated model; Recalculate the deviation value of the new data according to the updated model and use the mean square error method to obtain the new deviation result; If the new deviation result still exceeds the preset threshold, the anomaly candidate is confirmed as an anomaly, and the final anomaly set is obtained.

5. The method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 1, characterized in that: The method extracts the data packet structure and time delay changes from the abnormal candidate set, uses the isolation forest algorithm for secondary screening, and determines the hidden abnormal behavior set, including: Extracting data packet structure features and time delay variation features from the anomaly candidate set, and normalizing the features using a preprocessing method to obtain a standardized feature set; If the distribution of the structural features of the data packet in the standardized feature set deviates from the preset threshold, the feature is subjected to dimensionality reduction processing to obtain a reduced-dimensionality feature set; Use the isolation forest algorithm to perform anomaly detection on the reduced dimensionality feature set, obtain anomaly scores, and determine the preliminary anomaly point set; According to the time delay variation characteristics of the preliminary abnormal point set, the abnormal points are grouped using a clustering algorithm to obtain abnormal behavior clusters; If the number of abnormal behavior clusters is lower than the preset threshold, a time series analysis is performed on the time delay variation characteristics of each cluster to determine hidden abnormal behaviors; By correlating the structural features and delay variation features of hidden abnormal behaviors, the set of hidden abnormal behaviors is determined; According to the hidden abnormal behavior set, the rule matching method is used to verify the behavior set to obtain the final abnormal behavior set.

6. The method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 1, characterized in that: For the hidden abnormal behavior set, the similarity between each abnormal pattern and the behavior benchmark model is calculated. If the similarity is lower than a preset threshold, it is determined to be an abnormal pattern, and the abnormal pattern set is obtained, including: Through data preprocessing, behavioral data is extracted from hidden abnormal behaviors to obtain a set of pattern features; The principal component analysis algorithm is used to reduce the dimension of the pattern feature set to obtain a low-dimensional feature set; Based on the low-dimensional feature set and the behavioral benchmark model, the similarity measure of each abnormal pattern is calculated to obtain a similarity set; If the value in the similarity set is lower than the preset threshold, the corresponding pattern is determined to be abnormal, and a preliminary abnormal pattern set is obtained; For the preliminary abnormal pattern set, obtain the time series features of its behavior data to obtain a time series feature set; By using the isolation forest algorithm, abnormal patterns are detected from the time series feature set to obtain a refined abnormal pattern set; According to the refined abnormal pattern set, the deviation between its pattern features and the behavioral benchmark model is extracted to obtain the abnormal pattern deviation set.

7. The method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 1, characterized in that: The method uses a sliding window mechanism to analyze the real-time data stream based on the abnormal pattern set to determine whether the abnormal pattern persists and obtain an abnormal persistence score, including: Obtain real-time data streams and perform pattern matching using a pre-established set of abnormal patterns to identify initial abnormal events; If the initial abnormal event is detected, the sliding window mechanism is used to divide the time window and obtain the data subset within the time window; For the data subset within the time window, calculate the frequency of abnormal pattern occurrence and obtain the frequency distribution characteristics; By comparing the frequency distribution characteristics with the preset anomaly detection threshold, it is determined whether the abnormal pattern persists; If the abnormal pattern persists, the abnormal persistence score is obtained based on the scoring formula, combining the frequency and duration of the abnormal pattern; Adopting continuous scoring, the pattern weights in the abnormal pattern set are updated to obtain the optimized abnormal pattern set; Reanalyze the real-time data stream using the optimized set of abnormal patterns to identify the next round of abnormal events. The above steps form a logical closed loop, and the outputs and inputs of the upper and lower steps are closely connected. They all revolve around the goal of abnormal persistence scoring and are based on attributes such as abnormal pattern sets, sliding window mechanisms, and real-time data streams. They avoid irrelevant attributes such as data flow rate and ensure that the technical processes are strictly linked.

8. The method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 1, characterized in that: The abnormal persistence score adopts a weighted average method to fuse the weights of the data packet structure and the time delay change. If the score exceeds the preset threshold, the abnormality is confirmed and the final abnormality detection result is obtained, including: The data acquisition module is used to obtain the data packet structure and time delay variation information from the network traffic, extract the structural features and delay variation features, and obtain the initial feature set; The structural features and delayed change features in the initial feature set are fused using a preset weighted average method, and the weighted feature vector is calculated to obtain the abnormal persistence score. If the abnormal persistence score exceeds the preset threshold, it is determined to be abnormal, an abnormal mark is generated, and a preliminary abnormality detection result is obtained; Based on the preliminary anomaly detection results, the K-Means algorithm is used to perform cluster analysis on the anomaly markers, divide the anomaly types, and obtain the classified anomaly type set; Extract representative features of each type from the classified anomaly type set, use the decision tree algorithm to build an anomaly type classification model, and obtain an anomaly type prediction model; The anomaly type prediction model is used to analyze the newly collected network traffic data in real time, generate anomaly type labels, and obtain the final anomaly detection results; After obtaining the final anomaly detection result, the result is stored in the preset database, the anomaly detection log is updated, and the anomaly detection record is obtained.

9. The method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 1, characterized in that: The data center computer room operation and maintenance anomaly detection method further includes: updating the parameters of the behavior benchmark model according to the final anomaly detection result, and optimizing the model using an online learning mechanism to obtain an updated behavior benchmark model.

10. A method for detecting anomalies in data center computer room operation and maintenance based on deep learning according to claim 9, characterized in that: The data center computer room operation and maintenance anomaly detection method further includes: cyclically performing real-time data stream analysis on the updated behavioral benchmark model, continuously capturing subtle patterns, and obtaining continuous anomaly detection output.

Images