Database cluster anomaly detection method, device and electronic equipment

Abstract

The application provides a database cluster anomaly detection method and device and electronic equipment, which can be applied to the field of electric digital data processing. The method comprises the following steps: in response to an anomaly detection request for a database cluster in a target time window, unsupervised classification is performed on running state data in the target time window to obtain a first load level classification result, wherein the running state data represents state data of the database cluster in the running process; supervised classification is performed on business attribute data of the target time window to obtain a second load level classification result, wherein the business attribute data represents the degree of periodic influence of the target time window on business transaction categories and frequency; and a detection result is determined according to the first load level classification result and the second load level classification result.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing, and more specifically to a method, apparatus, and electronic device for detecting database cluster anomalies. Background Technology

[0002] As the operational load of databases and database clusters becomes increasingly complex, and business operations vary significantly at different times, the operational load also changes more and more, making it easier to generate false alarms and making it more difficult to detect abnormal operational load states of databases / database clusters.

[0003] Existing classification and anomaly detection methods typically determine whether anomalies are based on comparing single indicator data with thresholds, or by classifying resource usage to determine whether anomalies are present. They do not analyze and classify operational loads from the perspective of business characteristics. Therefore, they cannot understand the impact of changes in business characteristics over time on operational loads, thus reducing the accuracy of load anomaly detection. Summary of the Invention

[0004] In view of the above problems, the present invention provides a database cluster anomaly detection method, apparatus and electronic device.

[0005] According to a first aspect of the present invention, a database cluster anomaly detection method is provided, comprising: responding to an anomaly detection request for a database cluster within a target time window, performing unsupervised classification on operational status data within the target time window to obtain a first load level classification result, wherein the operational status data characterizes the status data of the database cluster during operation; performing supervised classification on business attribute data within the target time window to obtain a second load level classification result, wherein the business attribute data characterizes the degree to which the target time window has a periodic impact on business transaction categories and frequencies; and determining a detection result based on the first load level classification result and the second load level classification result.

[0006] Optionally, the database cluster includes multiple database nodes; wherein, in response to an anomaly detection request for the database cluster within a target time window, unsupervised classification is performed on the runtime status data within the target time window to obtain a first load level classification result, including: scene identification of the anomaly detection request to obtain a target detection scene; based on the scene mapping relationship, obtaining at least one runtime status data corresponding to the target detection scene within the target time window from multiple database nodes, wherein the scene mapping relationship represents the correspondence between the detection scene and the runtime status data; merging the at least one runtime status data to obtain merged data; and performing unsupervised classification on the merged data to obtain the first load level classification result.

[0007] Optionally, obtaining at least one runtime status data corresponding to the target detection scenario within the target time window includes: when the target detection scenario is a runtime load detection scenario, obtaining runtime status data includes at least one of the following: average number of database connections, number of insert operations, number of update operations, number of delete operations, number of exact queries, number of fuzzy queries, and number of transactions controlling user access; when the target detection scenario is a permission security detection scenario, obtaining runtime status data includes at least one of the following: number of network addresses accessed, number of successful logins, number of unlocked users, number of failed logins, and number of locked users.

[0008] Optionally, the merged data includes the number of merged insertion operations; wherein, merging at least one running status data to obtain merged data includes: summing the number of insertion operations obtained from multiple database nodes to obtain the number of merged insertion operations.

[0009] Optionally, the business attribute data includes at least one of the following: maintenance period attribute data, batch processing period attribute data, holiday period attribute data, promotion period attribute data, attribute data of the first period, attribute data of the second period, and attribute data of the third period, wherein the business transaction frequency of the first period is greater than that of the second period, and the business transaction frequency of the second period is greater than that of the third period.

[0010] Optionally, the attribute data for the second time period is determined based on the following operations: statistical processing is performed on the login business sub-attribute data, the initial business sub-attribute data of the day, the normal business sub-attribute data, and the daily settlement business sub-attribute data to obtain the attribute data for the second time period.

[0011] Optionally, the second load level classification result is obtained through supervised classification based on a decision tree model. The training of the decision tree model is determined by the following operations: obtaining training samples, which include sample business attribute data and sample operation status data corresponding to multiple sample time windows; performing unsupervised classification on the sample operation status data for each of the multiple sample time windows to obtain the first load level classification result corresponding to each of the multiple sample time windows, wherein the first load level classification result represents the load level pseudo-label of the sample business attribute data within the sample time window; and training an initial decision tree model based on the sample business attribute data and the first load level classification result corresponding to each of the multiple sample time windows to obtain the decision tree model.

[0012] Optionally, the detection result is determined based on the first load level classification result and the second load level classification result, including: if the first load level classification result and the second load level classification result are the same, a normal detection result is obtained; if the first load level classification result and the second load level classification result are different, an abnormal detection result is obtained, triggering a system warning.

[0013] A second aspect of the present invention provides a database cluster anomaly detection device, comprising: a first classification module, configured to, in response to an anomaly detection request for a database cluster within a target time window, perform unsupervised classification on operational status data within the target time window to obtain a first load level classification result, wherein the operational status data characterizes the status data of the database cluster during operation; a second classification module, configured to, supervisedly classify business attribute data within the target time window to obtain a second load level classification result, wherein the business attribute data characterizes the degree to which the target time window has a periodic impact on the business transaction category and frequency; and a detection module, configured to, determine a detection result based on the first load level classification result and the second load level classification result.

[0014] A third aspect of the present invention provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the aforementioned database cluster anomaly detection method.

[0015] The database cluster anomaly detection method, apparatus, and electronic device provided by this invention introduce business attribute data, classify the business attribute data to obtain a second load level classification result, and detect load anomalies by comparing the first load level classification result and the second load level classification result within a target time window. This ensures the accuracy of anomaly detection even when business attribute data causes significant load variations, solving the technical problem of inaccurate anomaly detection due to large load variations in the database operating across different time windows caused by business characteristics. Furthermore, by performing unsupervised learning on operational status data, automatic classification is achieved, reducing maintenance workload. Supervised classification of business attribute data allows for insights into the impact of various business attribute data on operational load through decision paths. Attached Figure Description

[0016] The above and other objects, features and advantages of the present invention will become clearer from the following description of embodiments of the invention with reference to the accompanying drawings.

[0017] Figure 1 The following is an application scenario of the database cluster anomaly detection method and apparatus according to an embodiment of the present invention.

[0018] Figure 2A flowchart of a database cluster anomaly detection method according to an embodiment of the present invention is shown.

[0019] Figure 3 A schematic diagram of an anomaly detection process according to an embodiment of the present invention is shown.

[0020] Figure 4 A structural block diagram of a database cluster anomaly detection device according to an embodiment of the present invention is shown.

[0021] Figure 5 A block diagram of an electronic device suitable for implementing a database cluster anomaly detection method according to an embodiment of the present invention is shown. Detailed Implementation

[0022] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the invention. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the invention for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0024] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0025] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0026] In the process of realizing this invention, it was found that there are two main types of existing classification and anomaly detection methods. One type is rule-based classification and anomaly detection, such as: when a certain value is within a certain range, it is a state; when a certain value is greater than a specified threshold, an alarm is triggered. The other type is machine learning-based classification and anomaly detection, which is usually based on time series anomaly detection and is generally classified according to resource usage rather than the operating load.

[0027] In this scenario, the existing anomaly detection methods have the following main problems: (1) Rule-based classification and anomaly detection cannot be dynamically adjusted according to the operating environment. Setting the threshold too small can easily lead to false alarms, while setting it too large can easily lead to false alarms. It is also difficult to make comprehensive judgments on more items and requires manual operation and maintenance, which is also a large workload. (2) Machine learning-based classification and anomaly detection: usually based on time series detection of isolated points or supervised learning based on running data items, neither of which considers the correlation with business characteristics. In fact, the database running load is highly correlated with business characteristics. For example, during the maintenance period window, the running load may drop by 50% (two databases are load balanced, and one database is maintained) or drop to 100% (service is terminated during maintenance). Usually, the load is much smaller at night than during the day, but there may be batch processing business at a certain time window at night, and the load may be larger, but the load type is different. Therefore, traditional machine learning-based anomaly detection is quite inaccurate for scenarios where the business changes greatly in different time windows. (3) The above anomaly detection methods all require manual participation, which is a large maintenance workload. (4) The above anomaly detection methods are all performed on a single database. Even for a single database cluster, if multiple computing service nodes do not provide a unified interface, it is impossible to monitor all nodes. For example, when the system uses multiple databases with sharding and table partitioning to implement data storage and access, it is impossible to logically unify these databases into a single database for processing. Therefore, none of the above methods analyze the operational load classification and perform anomaly detection from the perspective of business characteristics, and thus cannot understand the impact of business characteristics on operational load.

[0028] In view of this, the present invention provides a database cluster anomaly detection method, apparatus, and electronic device. The method includes: responding to an anomaly detection request for a database cluster within a target time window, performing unsupervised classification on operational status data within the target time window to obtain a first load level classification result, wherein the operational status data characterizes the status data of the database cluster during operation; performing supervised classification on business attribute data within the target time window to obtain a second load level classification result, wherein the business attribute data characterizes the degree to which the target time window has a periodic impact on business transaction categories and frequencies; and determining a detection result based on the first load level classification result and the second load level classification result.

[0029] In the technical solution of this invention, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0030] Figure 1 The following is an application scenario of the database cluster anomaly detection method and apparatus according to an embodiment of the present invention.

[0031] like Figure 1 As shown, the business system architecture 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0032] Users can interact with server 105 via network 104 using at least one of the first terminal device 101, second terminal device 102, and third terminal device 103 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, second terminal device 102, and third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0033] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0034] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). A database cluster is deployed on server 105, which includes multiple server nodes that can analyze and process received user requests and other data, and feed back the processing results (such as web pages, information, or data obtained or generated based on user requests) to the terminal devices.

[0035] It should be noted that the database cluster anomaly detection method provided in this embodiment of the invention can generally be executed by server 105. Correspondingly, the database cluster anomaly detection device provided in this embodiment of the invention can generally be located in server 105. The database cluster anomaly detection method provided in this embodiment of the invention can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the database cluster anomaly detection device provided in this embodiment of the invention can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0036] Alternatively, the database cluster anomaly detection method provided in this embodiment of the invention can also be executed by the first terminal device 101, the second terminal device 102, or the third terminal device 103, or by other terminal devices different from the first terminal device 101, the second terminal device 102, or the third terminal device 103. Correspondingly, the database cluster anomaly detection device provided in this embodiment of the invention can also be disposed in the first terminal device 101, the second terminal device 102, or the third terminal device 103, or in other terminal devices different from the first terminal device 101, the second terminal device 102, or the third terminal device 103.

[0037] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0038] It should be noted that the sequence numbers of the operations in the following methods are for descriptive purposes only and should not be considered as indicating the execution order of the operations. Unless explicitly stated otherwise, the method does not need to be executed in the exact order shown.

[0039] Figure 2 A flowchart of a database cluster anomaly detection method according to an embodiment of the present invention is shown.

[0040] like Figure 2 As shown, the database cluster anomaly detection method includes operations S210 to S230.

[0041] In operation S210, in response to an anomaly detection request for the database cluster within a target time window, unsupervised classification is performed on the runtime status data within the target time window to obtain the first load level classification result.

[0042] Optionally, a database cluster may include multiple database deployments, which can be 1 to N centralized databases and 0 to N database clusters, where N is a positive integer.

[0043] Optionally, the database cluster includes multiple database nodes, each storing real-time data generated based on business transactions.

[0044] Optionally, runtime status data represents the status data of the database cluster during operation. The server periodically reads the runtime data of each data item from the database cluster and performs statistical analysis according to time windows to obtain runtime status data.

[0045] Optionally, the database cluster can be configured with commonly used data items, and it also supports configuring or adding custom data items according to actual needs.

[0046] For example, data items include application login items, login failure items, and query items, while runtime status data includes the number of application logins, the number of login failures, and the number of queries.

[0047] Optionally, the target time window is the time window to be detected. For example, if the detection is to be performed on the state of the database cluster between 8:00 and 9:00, then the target time window is 8:00 to 9:00.

[0048] Optionally, the number of time windows per day refers to how many time windows are set per day. The default setting is 24, which means the time window is 1 hour.

[0049] Optionally, in response to an anomaly detection request for the database cluster within a target time window, the server can perform unsupervised classification of the runtime status data within the target time window based on an unsupervised classification algorithm to obtain the first load level classification result.

[0050] For example, unsupervised classification algorithms can be clustering algorithms, such as SimpleKMeans (SKMeans). Algorithm parameters include the number of categories, which are set according to the load categories in different time windows of actual business operations. The training parameters are adjusted based on the accuracy of the actual training results. Setting the number of categories to 8 considers the following 8 possible load categories: normal business period load category, low-peak / special period load category, peak / special period load category, business processing period load category, maintenance period load category, normal load category on promotional days, peak load category on promotional days, and holiday load category. Among these, the business processing time load category represents the load category corresponding to the batch processing time window.

[0051] Optionally, the number of load categories can be set according to the actual situation. Furthermore, in practice, after machine learning based on a large number of training samples, the number of load categories obtained is not limited to these 8 categories. In addition, the load categories obtained from classification based on machine learning algorithms and training data may not necessarily correspond one-to-one with the aforementioned 8 load categories, which is within the normal range.

[0052] Optionally, the first load level classification result includes the business load category corresponding to the target time window. For example, performing unsupervised classification on the operating status data between 8:00 and 9:00 results in the first load level classification result being the off-peak special period load category.

[0053] In operation S220, supervised classification is performed on the business attribute data of the target time window to obtain the second load level classification result.

[0054] Optionally, business attribute data characterizes the degree to which the target time window has a periodic impact on the business transaction category and frequency.

[0055] Optionally, there may be special business during a certain period, such as batch processing business during the time window of 24:00-1:00, while there will be no batch processing business during normal trading hours during the day; during maintenance periods, such as Saturday 24:00, there may be shutdown maintenance business or flow restriction operation business.

[0056] For example, business attribute data can include date attributes, time window sorting attributes, weekday attributes, holiday attributes, promotion day attributes, time period transaction frequency attributes, maintenance time period attributes, etc. Among them, the time window sorting attribute indicates which time window the target time window is in within a day, and the time period transaction frequency attribute indicates whether the time period corresponding to the target time window is a peak transaction period, an off-peak transaction period, or a normal transaction period.

[0057] Optionally, a supervised classification algorithm can be used to perform supervised classification on the business attribute data of the target time window to obtain the second load level classification result.

[0058] For example, a supervised classification algorithm can be a decision tree algorithm.

[0059] Optionally, the second load level classification result represents the business load category corresponding to the target time window. For example, supervised classification of business attribute data within 9:00-10:00 results in a second load level classification result that represents the normal business period load category.

[0060] In operation S230, the detection result is determined based on the first load level classification result and the second load level classification result.

[0061] Optionally, if the first load level classification result and the second load level classification result are the same, the detection result is considered to be a normal load state.

[0062] Optionally, if the first load level classification result and the second load level classification result are different, the detection result is an abnormal load state, and an early warning is triggered.

[0063] Optionally, business attribute data and the operational load changes of the database cluster across different time windows show a high correlation. For example, during a promotional day window, frequent transaction activity may cause the operational load to increase by 50%; during a maintenance period window, the operational load may decrease by 50% or even to 100% (service is terminated during maintenance). However, these situations are normal during promotional day and maintenance period windows; but they are abnormal during normal business hours. Therefore, introducing business attribute data allows for anomaly detection and verification of database load from both operational status and business attribute data perspectives, improving the accuracy of detection.

[0064] For example, if the amount of running status data is large, the first load level classification result is the peak load category of promotional days; if the second load level classification result is the load category of normal business hours, then the database cluster is in an abnormal load state; if the second load level classification result is the peak load category of promotional days, then the database cluster is in a normal load state.

[0065] Optionally, by introducing business attribute data, a second load level classification result is obtained by classifying this data. Load anomalies are detected by comparing the first and second load level classification results within a target time window. This ensures accurate anomaly detection even when business attribute data causes significant load fluctuations, resolving the technical problem of inaccurate anomaly detection due to large load variations in the database across different time windows caused by business characteristics. Furthermore, unsupervised learning is used to classify runtime status data, achieving automatic classification and reducing operational workload. Supervised classification of business attribute data allows for insights into the impact of various business attribute data on runtime load through decision paths.

[0066] Optionally, the database cluster includes multiple database nodes; wherein, in response to an anomaly detection request for the database cluster within a target time window, unsupervised classification is performed on the runtime status data within the target time window to obtain a first load level classification result, including: scene identification of the anomaly detection request to obtain a target detection scene; based on the scene mapping relationship, obtaining at least one runtime status data corresponding to the target detection scene within the target time window from multiple database nodes, wherein the scene mapping relationship represents the correspondence between the detection scene and the runtime status data; merging the at least one runtime status data to obtain merged data; and performing unsupervised classification on the merged data to obtain the first load level classification result.

[0067] Optionally, scene recognition includes the identification of business category scenes, data security detection scenes, etc.

[0068] Optionally, the anomaly detection request can be subjected to scene identification to obtain the target detection scene, which can be a high-frequency trading business detection scene.

[0069] Optionally, in response to an anomaly detection request, if the server determines that the target detection scenario is a high-frequency trading business detection scenario, it will obtain the running status data associated with the high-frequency trading business detection scenario within the target time window from multiple database nodes based on the scenario mapping relationship.

[0070] Optionally, the database cluster stores multiple data items, establishing a scene mapping relationship between the detection scene and the data items. By performing statistical analysis on the data items within the time window, runtime status data is obtained, thus establishing the scene mapping relationship between the detection scene and the runtime status data.

[0071] For example, the system retrieves the running status data A1 of data item A and B1 of data item B, which are associated with the high-frequency trading business detection scenario within the target time window, from the first database node; and retrieves the running status data A2 of data item A and B2 of data item B, which are associated with the high-frequency trading business detection scenario within the target time window, from the second database node. The system then merges the running status data A1 and A2 of data item A to obtain the merged data for data item A; similarly, it merges the running status data B1 and B2 of data item B to obtain the merged data for data item B.

[0072] Optionally, an unsupervised classification algorithm can be used to perform unsupervised classification on the merged data to obtain the first load level classification result of the database cluster in the target time window.

[0073] Optionally, operational status data is collected and statistically analyzed within time windows to form an operational status dataset. An unsupervised classification algorithm is then used to train the dataset to obtain the classification results for each operational status data point. Furthermore, collecting and analyzing data based on time windows can effectively segment the operational data features for specific windows. The segmentation rules for time windows can be customized and can be effectively combined with business attribute data. For example, 24 time windows can be set per day, with one time window per hour, thereby effectively obtaining hourly operational status data to determine whether the hourly operational status is abnormal. This automatic operation without manual intervention improves classification efficiency.

[0074] Optionally, obtaining at least one runtime status data corresponding to the target detection scenario within the target time window includes: when the target detection scenario is a runtime load detection scenario, obtaining at least one of the following: average number of database connections, number of insert operations, number of update operations, number of delete operations, number of exact queries, number of fuzzy queries, and number of transactions controlling user access; when the target detection scenario is a permission security detection scenario, obtaining runtime status data includes at least one of the following: number of network addresses accessed, number of successful logins, number of unlocked users, number of failed logins, and number of locked users.

[0075] Optionally, data items can be configured in the database cluster according to the actual needs of the scenario, or data items can be added to obtain data items corresponding to the scenario for statistical analysis and to obtain runtime status data. When adding a new data item, the collection method needs to be specified.

[0076] Optionally, the runtime load detection scenario is the scenario of detecting abnormal runtime load of the database cluster.

[0077] Optionally, the average number of database connections is the average number of times the database cluster is connected within the target time window.

[0078] Optionally, the number of insert operations is the number of times data insert operations are performed in the database cluster within the target time window.

[0079] Optionally, the update operation count is the number of times data update operations are performed in the database cluster within the target time window.

[0080] Optionally, the number of deletion operations is the number of times data deletion operations are performed in the database cluster within the target time window.

[0081] Optionally, the number of user access transactions can be controlled to the number of Data Definition Language (DDL) operations or Data Control Language (DCL) operations performed in the database cluster within a target time window.

[0082] For example, if at least one of the following operational status data—such as the average number of database connections, the number of insert operations, the number of update operations, the number of delete operations, and the number of user access control transactions—is greater than a first preset threshold, the probability that the first load level classification result corresponding to this target time window belongs to the peak special period load category or the promotion day peak load category is relatively high.

[0083] For example, if the total number of operational status data such as the average number of database connections, insert operations, update operations, delete operations, and the number of user access control transactions is less than the second preset threshold, the probability that the first load level classification result corresponding to this target time window belongs to the low-peak special period load category is relatively high. The first preset threshold is much higher than the second preset threshold.

[0084] Optionally, the permission security detection scenario is to detect security anomalies in the access permissions of the database cluster.

[0085] Optionally, the number of successful logins is the number of times a database cluster is successfully logged in within the target time window.

[0086] Optionally, when the target detection scenario is a permission security detection scenario, the obtained runtime status data may also include the number of applications associated with the database cluster, the number of user accesses, etc.

[0087] Optionally, the runtime status data can be flexibly set and adjusted according to the actual scenario to more accurately profile the required runtime status for anomaly detection, rather than detecting only one scenario category or overly broad detection. It also provides flexible extensions to detect user-defined runtime scenarios.

[0088] Optionally, the merged data includes the number of merged insertion operations; wherein, merging at least one running status data to obtain merged data includes: summing the number of insertion operations obtained from multiple database nodes to obtain the number of merged insertion operations.

[0089] Optionally, for each data item in the database cluster, statistical analysis is performed on the stored data corresponding to the data item obtained from multiple database nodes based on the target time window to obtain the running status data of the data item corresponding to each of the multiple database nodes, thereby merging the multiple running status data to obtain merged data.

[0090] For example, for the data item: insertion operation, the number of insertions corresponding to the insertion operation between 9:00 and 10:00 is obtained from three database nodes and statistically analyzed to obtain the number of insertion operations corresponding to each of the three database nodes. Then, the number of insertion operations of each of the three database nodes is summed to obtain the number of insertion operations merged.

[0091] For example, for the data item "Login Successful Operation", the number of successful logins corresponding to the login successful operation between 9:00 and 10:00 is obtained from three database nodes and statistically analyzed to obtain the number of successful logins for each of the three database nodes. Then, the number of successful logins for each of the three database nodes is summed to obtain the total number of successful login operations.

[0092] For example, for the data item: database connection operation, the number of database connection operations corresponding to the database connection operation between 9:00 and 10:00 is obtained from three database nodes and statistically analyzed to obtain the number of database connection operations corresponding to each of the three database nodes. Then, the number of database connection operations of each of the three database nodes is averaged to obtain the average number of database connection operations.

[0093] Optionally, the database cluster is a cluster of multiple database nodes. The server periodically collects the running status data corresponding to the same data item from multiple database nodes according to time windows, and merges them to obtain merged data. When training an unsupervised machine learning model, the system periodically uses the historical merged data from historical time windows as the training dataset to periodically classify and train the unsupervised machine learning model.

[0094] Optionally, the data collection supports the configuration of multiple database nodes. The running status data corresponding to the same data item collected from multiple database nodes can be merged into a single logical database node to ensure unified detection of the database cluster or database, which is beneficial for evaluating the scenario in which the system uses the database cluster / database.

[0095] Optionally, the business attribute data includes at least one of the following: maintenance period attribute data, batch processing period attribute data, holiday period attribute data, promotion period attribute data, attribute data of the first period, attribute data of the second period, and attribute data of the third period, wherein the business transaction frequency of the first period is greater than that of the second period, and the business transaction frequency of the second period is greater than that of the third period.

[0096] Optionally, the maintenance time period attribute data indicates whether the database cluster is under maintenance during the target time window. For example, the online maintenance period is from 23:00 to 24:00 every Saturday, and the offline maintenance is performed on the last weekend of each month, or a specific date, time period, and maintenance type can be specified.

[0097] Optionally, the batch processing time period attribute data indicates whether the target time window is within the batch transaction processing time period.

[0098] Optionally, the holiday period attribute data indicates whether the date attribute of the target time window is a statutory holiday.

[0099] Optionally, the promotion period attribute data indicates whether the date attribute of the target time window is a promotion day or whether the target time window is a promotion period.

[0100] Optionally, the first time period can be the target time window, which is the peak trading period of the day.

[0101] Optionally, the second time period can be the target time window, which is the normal trading period of the day.

[0102] Optionally, the third time period can be the target time window, which is the off-peak trading period of the day.

[0103] Optionally, business attribute data can also include date attribute data, weekday attribute data, and custom time period attribute data. For example, custom time period attribute data can be the nighttime batch processing business time period, or it can be set to any custom attribute type, such as: 22:00-23:00 time period, where custom time period attribute data represents the daily report generation business time period type; 23:00-24:00, where custom time period attribute data represents the data synchronization business time period type.

[0104] Optionally, each attribute data can be represented by a mask. For example, if the attribute data of festival period is 1, it represents the Mid-Autumn Festival. If the attribute data of festival period is 1, it represents the National Day. If 9:00-10:00 on xx / xx / xx is both the Mid-Autumn Festival and the National Day, then the attribute data of festival period is represented by 1+2=3.

[0105] Optionally, the server periodically collects business attribute data according to time windows. When training a supervised machine learning model, the system periodically uses the business attribute data corresponding to historical time windows as the training dataset to periodically classify and train the supervised machine learning model.

[0106] Optionally, business attribute data such as maintenance time period attribute data, batch processing time period attribute data, holiday time period attribute data, and promotional time period attribute data can be configured for each time window. This reduces storage space, computational dimensions, and computational load, while also handling multiple overlapping issues. In addition, classification based on rich business attribute data can determine whether the load is abnormal, avoiding false alarms when the load changes significantly in each time window due to business characteristics.

[0107] Optionally, the attribute data for the second time period is determined based on the following operations: statistical processing is performed on the login business sub-attribute data, the initial business sub-attribute data of the day, the normal business sub-attribute data, and the daily settlement business sub-attribute data to obtain the attribute data for the second time period.

[0108] Optionally, the second time period can be divided into login business period, initial business period of the day, normal business period, and daily settlement business period.

[0109] Optionally, a time window can represent multiple time period types simultaneously. The time period type represents the business type that typically has a high transaction frequency within this time period or a custom-configured business type.

[0110] For example, the 8:00-9:00 time period can simultaneously represent the login business period, the daily business period, and the normal business period; the 10:00-11:00, 13:00-14:00, 14:00-15:00, and 15:00-16:00 time periods represent the normal business period; and the 17:00-18:00 time period can simultaneously represent the daily settlement business period and the normal business period.

[0111] Optionally, a login service sub-attribute data of 1 indicates a login service period, and a login service sub-attribute data of 0 indicates a non-login service period.

[0112] Optionally, a sub-attribute data value of 1 for the initial business of the day represents the initial business period of the day, while a sub-attribute data value of 0 for the initial business of the day represents a non-initial business period of the day.

[0113] Optionally, a normal business sub-attribute data value of 1 represents a normal business period, and a normal business sub-attribute data value of 0 represents an abnormal business period.

[0114] Optionally, a sub-attribute data value of 1 for daily settlement business indicates a daily settlement business period, while a sub-attribute data value of 0 for daily settlement business indicates a non-daily settlement business period.

[0115] For example, the 8:00-9:00 time period can simultaneously represent the login business period, the daily business period, and the normal business period. Therefore, the attribute data for the 8:00-9:00 time period is 1110. Supervised classification is then performed based on the attribute data 1110 for the second time period (8:00-9:00), resulting in the second load level classification result for the second time period (8:00-9:00) being the normal business period load category.

[0116] Optionally, the second load level classification result is obtained through supervised classification based on a decision tree model. The training of the decision tree model is determined by the following operations: obtaining training samples, which include sample business attribute data and sample operation status data corresponding to multiple sample time windows; performing unsupervised classification on the sample operation status data for each of the multiple sample time windows to obtain the first load level classification result corresponding to each of the multiple sample time windows, wherein the first load level classification result represents the load level pseudo-label of the sample business attribute data within the sample time window; and training an initial decision tree model based on the sample business attribute data and the first load level classification result corresponding to each of the multiple sample time windows to obtain the decision tree model.

[0117] Optionally, the sample time window can be a historical time window. The system will periodically acquire sample business attribute data and sample operational status data corresponding to the historical time window. The sample business attribute data represents the degree to which the sample time window has a periodic impact on the business transaction category and frequency, while the sample operational status data represents the status data of the database cluster during each sample time window. Each sample time window is configured to be 1 hour.

[0118] Optionally, for each sample time window, unsupervised classification is performed on the sample running status data to obtain the first load level classification result of the sample corresponding to each sample time window.

[0119] Optionally, the classification result of the first load level of the sample predicted by unsupervised classification can be used as the pseudo label of the load level corresponding to the sample time window. This can be combined with the sample business attribute data to train the initial decision tree model. The parameters of the initial decision tree model can then be adjusted to obtain the decision tree model.

[0120] For example, if the sample time window is 10:00-11:00, and the first load level classification result is the normal business period load category, then the normal business period load category will be used as the pseudo-label for the load level in the sample time window of 10:00-11:00.

[0121] Optionally, the initial decision tree model can be constructed based on the improved decision tree algorithm (J48 Decision TreeAlgorithm).

[0122] Optionally, the initial decision tree model is used to process the sample business attribute data corresponding to each of the multiple sample time windows to obtain the sample second load level classification result. The verification success rate is calculated based on the second load level classification result and the sample first load level classification result used as the load level pseudo-label. The model parameters are adjusted and optimized based on the verification success rate to obtain the trained initial decision tree model.

[0123] Optionally, the classification of business attribute data may employ a supervised machine learning model, which may include, but is not limited to, decision tree models.

[0124] Optionally, the classification of business attribute data employs a supervised machine learning model. During the training process, the first load level classification result of samples within a time window is used as a pseudo-label for the load level. This first load level classification result is applied to the business attribute data as a classification attribute, avoiding manual maintenance of the classification and thus achieving automated operation, reducing operational workload. The second load level classification result is inferred from the business attribute data within the supervised machine learning time window. The supervised machine learning model uses a decision tree model, which clearly shows the decision path, facilitating operational analysis. The load level classification results macroscopically reveal the current operational status of the database cluster. By observing the decision-making process, the impact of various business attribute data on the database load can be understood.

[0125] Optionally, the detection result is determined based on the first load level classification result and the second load level classification result, including: if the first load level classification result and the second load level classification result are the same, a normal detection result is obtained; if the first load level classification result and the second load level classification result are different, an abnormal detection result is obtained, triggering a system warning.

[0126] Optionally, the first load level classification result is compared with the second load level classification result. If the first load level classification result and the second load level classification result are the same, a normal detection result is obtained. The normal detection result means that the database cluster is in a normal load state after comparison and verification from both business attributes and running status.

[0127] Optionally, if the first load level classification result is different from the second load level classification result, an anomaly detection result is obtained, triggering a system warning.

[0128] Optionally, the anomaly detection result represents a comparison and verification from both business attributes and operational status to determine that the database cluster is in an abnormal load state.

[0129] For example, the first load level classification result is the peak special period load category, and the second load level classification result is the normal business period load category, that is, a high load abnormality occurred during normal business periods.

[0130] Optionally, the first load level classification results, the second load level classification results, and the detection results can be stored in a database cluster for subsequent analysis. For anomaly detection results, vulnerabilities can also be manually patched.

[0131] Optionally, by using both unsupervised and supervised machine learning models to predict load level classification results and then performing matching comparisons, time windows of similar business attribute data and abnormalities in operational status data can be effectively identified. The model can then be corrected and periodically trained, ensuring a mechanism for continuously improving the accuracy of anomaly detection.

[0132] Figure 3 A schematic diagram of an anomaly detection process according to an embodiment of the present invention is shown.

[0133] like Figure 3 As shown, the database cluster includes database nodes Node1, Node2, and Node3. Operational status data is collected from Node1, Node2, and Node3 according to time windows, and the data is then merged. An unsupervised learning model is used to classify the operational status data, yielding a first load level classification result. The business feature library can be customized with business attribute data, which is collected and saved according to time windows. This business attribute data is then input into a supervised learning model for classification, yielding a second load level classification result. The first and second load level classification results are compared to obtain the detection result. Finally, the operational status data, business attribute data, first load level classification result, second load level classification result, and detection result are saved to the database.

[0134] Based on the above-described database cluster anomaly detection method, this invention also provides a database cluster anomaly detection device. The following will be combined with... Figure 4 The device is described in detail.

[0135] Figure 4 A structural block diagram of a database cluster anomaly detection device according to an embodiment of the present invention is shown.

[0136] like Figure 4 As shown, the database cluster anomaly detection device 400 of this embodiment includes a first classification module 410, a second classification module 420, and a detection module 430.

[0137] The first classification module 410 is used to respond to an anomaly detection request for the database cluster within a target time window, and to perform unsupervised classification on the operational status data within the target time window to obtain a first load level classification result. The operational status data represents the status data of the database cluster during operation. In one embodiment, the first classification module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0138] The second classification module 420 is used to perform supervised classification of the business attribute data of the target time window to obtain the second load level classification result. The business attribute data characterizes the degree to which the target time window has a periodic impact on the business transaction category and frequency. In one embodiment, the second classification module 420 can be used to execute the operation S220 described above, which will not be repeated here.

[0139] The detection module 430 is used to determine the detection result based on the first load level classification result and the second load level classification result. In one embodiment, the detection module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0140] Optionally, the first classification module 410 includes a first classification submodule, a second classification submodule, a third classification submodule, and a fourth classification submodule.

[0141] The first classification submodule is used to perform scene recognition on anomaly detection requests to obtain the target detection scene.

[0142] The second classification submodule is used to obtain at least one running status data corresponding to the target detection scene within the target time window from multiple database nodes based on the scene mapping relationship. The scene mapping relationship represents the correspondence between the detection scene and the running status data.

[0143] The third classification submodule is used to merge at least one running status data to obtain merged data.

[0144] The fourth classification submodule is used to perform unsupervised classification on the merged data to obtain the first load level classification result.

[0145] Optionally, the second classification submodule includes a first classification unit and a second classification unit.

[0146] The first classification unit is used when the target detection scenario is a running load detection scenario, and the running status data includes at least one of the following: average number of database connections, number of insert operations, number of update operations, number of delete operations, number of exact queries, number of fuzzy queries, and number of user access transactions.

[0147] The second classification unit is used to obtain runtime status data, including at least one of the following, when the target detection scenario is a permission security detection scenario: number of accessed network addresses, number of successful logins, number of unlocked users, number of failed logins, and number of locked users, when the target detection scenario is a permission security detection scenario.

[0148] Optionally, the third classification submodule includes a third classification unit.

[0149] The third classification unit is used to sum the number of insertion operations obtained from multiple database nodes to obtain the merged number of insertion operations.

[0150] Optionally, the second classification module 420 includes an acquisition submodule, a obtaining submodule, and a training submodule.

[0151] The acquisition submodule is used to acquire training samples, which include sample business attribute data and sample running status data corresponding to multiple sample time windows.

[0152] The submodule is used to perform unsupervised classification of sample running status data for each of the multiple sample time windows, and obtain the first load level classification result of the sample corresponding to each of the multiple sample time windows. The first load level classification result of the sample represents the load level pseudo label of the sample business attribute data within the sample time window.

[0153] The training submodule is used to train an initial decision tree model based on the sample business attribute data corresponding to each of the multiple sample time windows and the classification results of the first load level of the samples, and to obtain the decision tree model.

[0154] Optionally, the detection module 430 includes a first detection submodule and a second detection submodule.

[0155] The first detection submodule is used to obtain a normal detection result when the first load level classification result is the same as the second load level classification result.

[0156] The second detection submodule is used to obtain an anomaly detection result and trigger a system warning when the first load level classification result is different from the second load level classification result.

[0157] Optionally, any plurality of modules among the first classification module 410, the second classification module 420, and the detection module 430 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least a portion of the functionality of one or more of these modules may be combined with at least a portion of the functionality of other modules and implemented in one module. Optionally, at least one of the first classification module 410, the second classification module 420, and the detection module 430 may be at least partially implemented as a hardware circuit, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging the circuit, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the first classification module 410, the second classification module 420, and the detection module 430 may be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0158] Figure 5 A block diagram of an electronic device suitable for implementing a database cluster anomaly detection method according to an embodiment of the present invention is shown.

[0159] Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0160] like Figure 5 As shown, a computer electronic device 500 according to an embodiment of the present invention includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present invention.

[0161] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 executes various operations of the method flow according to embodiments of the present invention by executing programs in ROM 502 and / or RAM 503. It should be noted that programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also execute various operations of the method flow according to embodiments of the present invention by executing programs stored in one or more memories.

[0162] Optionally, the electronic device 500 may also include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may also include one or more of the following components connected to the input / output (I / O) interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0163] Optionally, the method flow according to embodiments of the present invention can be implemented as a computer software program. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of embodiments of the present invention. Optionally, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0164] The present invention also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the database cluster anomaly detection method according to embodiments of the present invention.

[0165] Optionally, the computer-readable storage medium can be a non-volatile computer-readable storage medium. Examples include, but are not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this invention, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0166] For example, optionally, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.

[0167] Embodiments of the present invention also include a computer program product comprising a computer program containing program code for performing the methods provided in the embodiments of the present invention. When the computer program product is run on an electronic device, the program code is used to enable the electronic device to implement the database cluster anomaly detection method provided in the embodiments of the present invention.

[0168] When the computer program is executed by the processor 501, it performs the functions defined in the system / apparatus of this embodiment of the invention. Optionally, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0169] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0170] Optionally, program code for executing the computer programs provided in the embodiments of the present invention can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0171] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions. Those skilled in the art will understand that the features described in the various embodiments of the present invention can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in the present invention. In particular, the features described in the various embodiments of the present invention can be combined and / or combined in various ways without departing from the spirit and teachings of the present invention. All such combinations and / or pairings fall within the scope of this invention.

[0172] The embodiments of the present invention have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of the invention. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the invention, and all such substitutions and modifications should fall within the scope of the invention.

Claims

1. A method for detecting database cluster anomalies, characterized in that, The database cluster includes multiple database nodes, and the method includes: In response to an anomaly detection request for the database cluster within a target time window, unsupervised classification is performed on the operational status data within the target time window to obtain the first load level classification result, including: The anomaly detection request is subjected to scene recognition to obtain the target detection scene; Based on the scene mapping relationship, at least one running status data corresponding to the target detection scene within the target time window is obtained from multiple database nodes, wherein the scene mapping relationship represents the correspondence between the detection scene and the running status data; At least one of the aforementioned operating status data is merged to obtain merged data; Unsupervised classification is performed on the merged data to obtain the first load level classification result, wherein the running status data represents the status data of the database cluster during operation; Supervised classification is performed on the business attribute data of the target time window to obtain the second load level classification result, wherein the business attribute data characterizes the degree to which the target time window has a periodic impact on the business transaction category and frequency; Based on the first load level classification result and the second load level classification result, the detection results are determined as follows: If the first load level classification result is the same as the second load level classification result, a normal detection result is obtained; If the first load level classification result is different from the second load level classification result, an anomaly detection result is obtained, triggering a system warning.

2. The method according to claim 1, characterized in that, Obtaining at least one running status data corresponding to the target detection scene within the target time window includes: When the target detection scenario is a runtime load detection scenario, the runtime status data obtained includes at least one of the following: average number of database connections, number of insert operations, number of update operations, number of delete operations, number of exact queries, number of fuzzy queries, and number of user access control transactions. When the target detection scenario is a permission security detection scenario, the obtained running status data includes at least one of the following: number of network addresses accessed, number of successful logins, number of unlocked users, number of failed logins, and number of locked users.

3. The method according to claim 2, characterized in that, The merged data includes the number of data merged during insertion operations; The step of merging at least one of the operating status data to obtain merged data includes: The number of insertion operations obtained from multiple database nodes is summed to obtain the merged number of insertion operations.

4. The method according to claim 1, characterized in that, The business attribute data includes at least one of the following: maintenance period attribute data, batch processing period attribute data, holiday period attribute data, promotion period attribute data, attribute data of the first period, attribute data of the second period, and attribute data of the third period. The business transaction frequency of the first period is greater than that of the second period, the business transaction frequency of the second period is greater than that of the third period, the first period represents the target time window as the peak transaction period of the day, the second period represents the target time window as the normal transaction period of the day, and the third period represents the target time window as the off-peak transaction period of the day.

5. The method according to claim 4, characterized in that, The attribute data for the second time period was determined based on the following operations: Statistical processing is performed on the login business sub-attribute data, the initial business sub-attribute data of the day, the normal business sub-attribute data, and the daily settlement business sub-attribute data to obtain the attribute data for the second time period.

6. The method according to claim 1, characterized in that, The second load level classification result is obtained through supervised classification based on a decision tree model, the training of which is determined based on the following operations: Acquire training samples, which include sample business attribute data and sample running status data corresponding to each of multiple sample time windows; For each of the multiple sample time windows, unsupervised classification is performed on the sample running status data to obtain the sample first load level classification result corresponding to each of the multiple sample time windows, wherein the sample first load level classification result represents the load level pseudo label of the sample business attribute data within the sample time window; Based on the sample business attribute data corresponding to each of the multiple sample time windows and the sample first load level classification results, an initial decision tree model is trained to obtain the decision tree model.

7. A database cluster anomaly detection device, characterized in that, The database cluster includes multiple database nodes, and the device includes: The first classification module is used to respond to an anomaly detection request for the database cluster within a target time window, perform unsupervised classification on the running status data within the target time window, and obtain a first load level classification result. The first classification module includes a first classification submodule, a second classification submodule, a third classification submodule, and a fourth classification submodule. The first classification submodule is used to perform scene recognition on the anomaly detection request to obtain the target detection scene; The second classification submodule is used to obtain at least one running status data corresponding to the target detection scene within the target time window from multiple database nodes based on the scene mapping relationship, wherein the scene mapping relationship represents the correspondence between the detection scene and the running status data; The third classification submodule is used to merge at least one of the aforementioned operating status data to obtain merged data; The fourth classification submodule is used to perform unsupervised classification on the merged data to obtain the first load level classification result, wherein the running status data represents the status data of the database cluster during operation; The second classification module is used to perform supervised classification on the business attribute data of the target time window to obtain the second load level classification result, wherein the business attribute data characterizes the degree to which the target time window has a periodic impact on the business transaction category and frequency; The detection module is used to determine the detection result based on the first load level classification result and the second load level classification result. The detection module includes a first detection submodule and a second detection submodule. The first detection submodule is used to obtain a normal detection result when the first load level classification result is the same as the second load level classification result; The second detection submodule is used to obtain an anomaly detection result and trigger a system warning when the first load level classification result is different from the second load level classification result.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors invoke the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

Images