Method and device for determining abnormal hardware

By performing sliding window segmentation and normalization on the time series data of server hardware, and combining graph convolutional network and temporal convolutional network models, the problem of low accuracy in server hardware fault detection in existing technologies is solved, and efficient fault detection and prediction are achieved.

CN120743597APending Publication Date: 2025-10-03CHINA CONSTRUCTION BANK
View PDF 0 Cites 0 Cited by

Patent Information

Application Number
CN202510811243.1
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-06-17
Publication Date
2025-10-03

AI Technical Summary

Technical Problem

In the prior art, when fault detection is performed on a large number of server hardware, the accuracy of the detection results is low.

Method used

By obtaining the server's time series data matrix, splitting the data using a sliding window and performing normalization, we use pre-trained graph convolutional network and time convolutional network models to build models and identify abnormal hardware in the server.

Benefits of technology

It improves the accuracy of hardware fault detection for multiple servers, realizes accurate detection and prediction of server hardware faults, and improves the fault detection accuracy and real-time performance of the data center.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN120743597A_ABST
    Figure CN120743597A_ABST
Patent Text Reader

Abstract

The embodiment of the invention provides a method and a device for determining abnormal hardware. The method comprises the following steps: acquiring N time sequence data matrixes of N servers; segmenting each time sequence data matrix based on a sliding window to obtain N fragment data matrixes; and determining abnormal hardware in each service based on the N fragment data matrixes. Through the server hardware fault detection method and device, the problem that the accuracy of the detection result is low when fault detection is carried out on a large number of server hardware in the prior art is solved, and then the effect of improving the fault detection accuracy of the server hardware is achieved.
Need to check novelty before this filing date? Find Prior Art

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communications, and in particular, to a method and apparatus for determining abnormal hardware. Background Art

[0002] As data centers continue to expand and server hardware becomes more complex, server hardware fault detection has become a critical technology for ensuring data center reliability and efficiency. Due to the large number of hardware components in a server, the amount of data generated during operation is substantial. Current hardware fault detection methods can only detect a small amount of hardware. If a large number of hardware components are tested, the accuracy of the detection results will be low due to the large amount of data.

[0003] There is currently no effective solution to the above problems. Summary of the Invention

[0004] The embodiments of the present invention provide a method and apparatus to at least solve the problem in the related art of performing fault detection on a large number of server hardware and having a low detection accuracy rate.

[0005] According to one embodiment of the present invention, a method for determining abnormal hardware is provided, comprising: obtaining N time series data matrices of N servers, wherein the time series data matrices include M time series data corresponding to M hardware indicator dimensions, where N is an integer; segmenting each time series data matrix based on a sliding window to obtain N fragment data matrices, wherein the fragment data matrix includes M groups of fragment data corresponding to the M hardware indicator dimensions, and a group of fragment data includes multiple fragment data after segmenting the corresponding time series data; and determining abnormal hardware in each of the services based on the N fragment data matrices.

[0006] In an exemplary embodiment, the method further includes: when the size of the sliding window is W, the sliding windows obtained by two adjacent splits partially overlap, and the two sets of fragment data obtained by two adjacent splits are partially identical; wherein W is greater than 1 bit and k is an integer.

[0007] In an exemplary embodiment, abnormal hardware in each of the services is determined based on the N fragment data matrices, including: standardizing each group of fragment data in each of the fragment data matrices to obtain N standardized fragment data matrices, wherein the standardized fragment data matrices include M groups of standardized fragment data corresponding to the M hardware indicator dimensions, a group of the standardized fragment data includes multiple standardized fragment data, and the annotated fragment data is obtained after the corresponding fragment data is standardized; determining the N standardized fragment data matrices as N inputs of the target network model to obtain N groups of output results of the target network model, wherein each group of the output results includes M parameter values, and each of the parameter values ​​is used to represent the abnormal probability of the corresponding hardware indicator of the corresponding server.

[0008] In an exemplary embodiment, the fragment data of each dimension in each group of the fragment data matrix is ​​standardized, including: standardizing the kth group of fragment data of the jth hardware indicator dimension in the ith fragment data matrix through the following steps, where i, j, and k are integers: determining the mean and standard deviation of the kth group of fragment data; and standardizing each data in the kth group of fragment data according to the mean and standard deviation.

[0009] In an exemplary embodiment, each data in the kth group of fragment data is standardized by the mean and standard deviation, including: standardizing the Sth data in the kth group of fragment data by the following steps, where S is an integer: determining the difference between the Sth data and the mean as a target difference; and determining the ratio of the target difference to the standard deviation as the standardized data of the Sth data.

[0010] In an exemplary embodiment, the target network model includes a graph convolutional network and a temporal convolutional network, and the target network model is a pre-trained model.

[0011] According to another embodiment of the present invention, there is provided an apparatus for determining abnormal hardware, comprising: an acquisition module for acquiring N time series data matrices of N servers, wherein the time series data matrices include M time series data corresponding to M hardware indicator dimensions, and N is an integer; a segmentation module for segmenting each time series data matrix based on a sliding window to obtain N fragment data matrices, wherein the fragment data matrix includes M groups of fragment data corresponding to the M hardware indicator dimensions, and a group of fragment data includes multiple fragment data after segmenting the corresponding time series data; and a determination module for determining abnormal hardware in each of the services based on the N fragment data matrices.

[0012] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0013] According to another embodiment of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any one of the above method embodiments.

[0014] According to yet another embodiment of the present invention, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0015] Through the present invention, N time series data matrices of N servers are obtained, and the time series data matrices include M time series data corresponding to M hardware indicator dimensions, where N is an integer; each time series data matrix is ​​segmented based on a sliding window to obtain N fragment data matrices, and the fragment data matrices include M groups of fragment data corresponding to the M hardware indicator dimensions, and a group of fragment data includes multiple fragment data after segmenting the corresponding time series data; based on the N fragment data matrices, abnormal hardware in each of the services is determined. The purpose of fault detection of multiple server hardware is achieved. Therefore, the problem of low accuracy of detection results for fault detection of a large number of server hardware in the related art can be solved, thereby achieving the effect of improving the accuracy of server hardware fault detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of an application scenario of a method for determining abnormal hardware according to an embodiment of the present invention;

[0017] Figure 2 is a flowchart of a method for determining abnormal hardware according to an embodiment of the present invention;

[0018] Figure 3 is a structural diagram of a server hardware anomaly detection module according to an embodiment of the present invention;

[0019] Figure 4 is a schematic diagram of an overall process according to an embodiment of the present invention;

[0020] Figure 5 4 is a structural block diagram of a device for determining abnormal hardware according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with embodiments.

[0022] Explanation of terms:

[0023] Server: A high-performance computing device installed in a data center that provides computing resources (such as processors, memory, storage, and networking) to users or applications. It typically comes in rack-mount or blade-mount designs and can be modularly installed in data center cabinets to meet the needs of massively parallel computing and high availability.

[0024] Anomaly detection: Identifying data that is different from normal data and has a significant difference from expected behavior. There are three types of anomalies or outliers. First, point anomalies refer to a small number of individual instances that are abnormal, while the majority of individual instances are normal. Second, conditional anomalies, also known as contextual anomalies, refer to individual instances that are abnormal in a specific situation and normal in other situations. Third, collective anomalies refer to a collection of related data instances that is abnormal relative to the entire data set, but not for a single value. There are two possibilities for collective anomalies: they occur in an unpredictable order (ordered, such as gaps in the heart rate on an electrocardiogram); the combination of values ​​is unpredictable (disordered, such as buying a large number of expensive items).

[0025] Graph Convolutional Network (GCN): A deep learning model specifically designed to process graph-structured data. By performing convolution operations on graphs, it extracts and utilizes the characteristic information in the graph structure, thus meeting the needs of various graph learning tasks such as clustering, classification, prediction, segmentation, and generation.

[0026] Temporal Convolutional Network (TCN): A deep neural network architecture suitable for time series and sequence modeling. The core idea is to model long-range dependencies of input sequences through causal convolution and dilated convolution while maintaining efficient parallelism.

[0027] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0028] Figure 1 FIG. 1 is a schematic diagram of an application scenario of a method for determining abnormal hardware according to an embodiment of the present invention. Figure 1 As shown, it includes a computer terminal 301, a server 102 and an intranet switch 103. The method embodiment provided in the embodiment of the present application can be Figure 1 Computer terminal shown.

[0029] In this embodiment, a method for determining abnormal hardware running on the above-mentioned computer terminal is provided. Figure 2 is a flow chart according to an embodiment of the present invention, such as Figure 2 As shown, the process includes the following steps:

[0030] Step S202: Obtain N time series data matrices of N servers, wherein the time series data matrices include M time series data corresponding to M hardware indicator dimensions, where N is an integer;

[0031] The time series data matrix includes hardware indicator dimensions such as central processing unit (CPU) usage and CPU temperature as shown in Table 1 below. The corresponding operating data of the hardware indicator dimensions can be obtained through the corresponding channels.

[0032] Table 1

[0033]

[0034]

[0035] For each server, the operating data of the above hardware indicator dimensions are obtained in chronological order. A time series data matrix corresponds to one server, and each dimension of time series data corresponds to the operating data of one of the above hardware indicator dimensions.

[0036] Step S204: Segment each time series data matrix based on a sliding window to obtain N segment data matrices, wherein the segment data matrices include M groups of segment data corresponding to the M hardware indicator dimensions, and a group of segment data includes multiple segment data obtained by segmenting the corresponding time series data;

[0037] Wherein, when the size of the sliding window is W, the sliding windows obtained by two adjacent splits partially overlap, and the two sets of fragment data obtained by two adjacent splits are partially identical; wherein, W is greater than 1 bit, and k is an integer.

[0038] Each time series data is divided into multiple fragment data to obtain a corresponding set of fragment data. The time series data is split according to the overlap of the acquisition time. A sliding window of size W is set, where W is greater than 1 bit. The overlapping part of two consecutive windows is W / 2, that is, half of the fragment data obtained by splitting two adjacent windows are the same.

[0039] Step S206: determining abnormal hardware in each of the services based on the N fragment data matrices.

[0040] Specifically, each group of fragment data in each of the fragment data matrices is standardized to obtain N standardized fragment data matrices, wherein the standardized fragment data matrices include M groups of standardized fragment data corresponding to the M hardware indicator dimensions, a group of the standardized fragment data includes multiple standardized fragment data, and the annotated fragment data is obtained after the corresponding fragment data is standardized;

[0041] The N standardized fragment data matrices are determined as N inputs of the target network model to obtain N groups of output results of the target network model, wherein each group of the output results includes M parameter values, and each parameter value is used to represent the abnormal probability of the corresponding hardware indicator of the corresponding server.

[0042] In an exemplary embodiment, normalizing the fragment data of each dimension in each group of the fragment data matrix includes:

[0043] The k-th group of fragment data of the j-th hardware indicator dimension in the i-th fragment data matrix is ​​normalized by the following steps, where i, j, and k are integers:

[0044] Determining the mean and standard deviation of the kth group of fragment data;

[0045] Each data in the kth group of segment data is standardized using the mean and standard deviation.

[0046] For example, the Sth data in the kth group of fragment data is standardized by the following steps, where S is an integer: the difference between the Sth data and the mean is determined as the target difference; and the ratio of the target difference to the standard deviation is determined as the standardized data of the Sth data.

[0047] The fragment data within the time window of each hardware indicator dimension is standardized, and the conversion function is:

[0048]

[0049] Among them, x * is the standardized data, x is the original data (for example, the Sth data), μ is the mean of the kth group of segment data, and σ is the standard deviation of the kth group of segment data.

[0050] like Figure 3The following diagram shows the structure of the server hardware anomaly detection module. N standardized segment data matrices serve as the N inputs to the target network model. These N standardized segment data matrices correspond to the server time series X1, X2, and Xu in the figure. The GCN module fuses the data from each server's hardware metric dimensions. Each server is first represented as a server node. The feature vector for each server consists of M sets of segment data corresponding to the server's M hardware metric dimensions within a sliding time window.

[0051] The spatial relationships between server nodes (such as racks, TORs, network links, etc.) form an undirected adjacency matrix A. If there is a direct dependency or communication relationship between servers, then A ij =1, otherwise 0. Nodes can receive information from more distant neighbors, enabling complex spatial dependency modeling. The spatial relationship modeling of server metrics is effective. After passing through multiple layers of GCN, the representation of server nodes not only includes their own hardware metric dimensions, but also incorporates the hardware metric dimensions of neighboring nodes (for example, if an increase in the CPU usage of server A leads to an increase in the load of server B, GCN can capture this cross-node metric correlation).

[0052] The node feature representation output by the last layer of GCN contains information about the hardware indicator dimensions of this node, and also incorporates the spatial dependency information of topological neighbors. It serves as the input of the TCN module to further model temporal dynamic characteristics. The output features of the GCN module (with integrated spatial relationships) are arranged in chronological order. Multiple residual blocks are stacked (with increasing expansion rates for each layer, such as 1, 2, 4, 8, etc.), where the lower layers capture short-term change features; the higher layers capture long-term dependency features. By expanding convolution and stacking layers, dependency modeling of ultra-long time spans is achieved. Output temporal feature H TCN =TCN(Z), which is the hidden state of each time step, representing the spatial + temporal features at that moment.

[0053] The spatiotemporal features output by GCN and TCN are combined and fused to comprehensively characterize server anomaly patterns in both spatial and temporal dimensions. A fully connected network (FC) and softmax / sigmoid output layers are used to classify and score anomaly and non-anomalous states, generating anomaly data. Each sliding window allows for rapid inference and, combined with historical window results, dynamically adjusts anomaly detection strategies to meet the real-time needs of data centers.

[0054] Optionally, the execution entity of the above steps can be a background processor, or other devices with similar processing capabilities, or a machine that integrates at least an image acquisition device and a data processing device, wherein the image acquisition device may include a graphics acquisition module such as a camera, and the data processing device may include a computer, a mobile phone and other terminals, but is not limited to this.

[0055] like Figure 4 The figure shows the overall process diagram, which includes the following steps:

[0056] Step 1: Collect hardware monitoring information generated by the server;

[0057] Step 2: normalize the data and obtain the spatial topology information of the server device;

[0058] Step 3: By combining Graph Convolutional Networks (GCN) and Temporal Convolutional Networks (TCN), we model the spatial and temporal information of server hardware data and build a server hardware anomaly detection module.

[0059] Step 4: Perform fault detection on the server hardware through the hardware anomaly detection module.

[0060] The spatiotemporal modeling approach based on graph convolutional networks (GCN) and temporal convolutional networks (TCN) leverages spatiotemporal dependencies. GCN models the spatial topology of servers and extracts spatial features of nodes, while TCN models the temporal variations of server performance metrics and extracts time series features. By leveraging the spatial topology and temporal dynamics of servers, this approach comprehensively captures the multidimensional characteristics of server hardware failures.

[0061] This application proposes a method for detecting server hardware anomalies based on spatiotemporal relationships. This method, centered around joint spatiotemporal modeling, leverages GCN to capture spatial dependencies between servers and combines it with TCN to extract temporal dynamics, providing a comprehensive, efficient, and intelligent approach to server hardware fault detection. This innovative approach is reflected in its spatiotemporal modeling framework, heterogeneous data fusion, and fault prediction capabilities. It significantly improves the accuracy and real-time performance of data center fault detection and promotes the further development of intelligent operations and maintenance technologies.

[0062] This application proposes a server hardware anomaly detection method based on spatiotemporal relationships, through which server hardware failures in data centers can be accurately detected and predicted in advance. The spatial associations between servers are modeled using graph convolutional networks (GCNs), capturing the topological structure and logical dependencies between servers. At the same time, the temporal dynamic characteristics of server hardware performance indicators are analyzed in combination with temporal convolutional networks (TCNs), comprehensively extracting the spatial and temporal features of hardware anomalies. Through this method, not only can the node where the fault occurs be accurately located, but also the fault propagation path can be identified, and the possible fault trend can be predicted in advance, providing strong technical support for the proactive operation and maintenance and fault handling of data centers.

[0063] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0064] In this embodiment, a device for determining abnormal hardware is also provided. This device is used to implement the above-mentioned embodiments and preferred embodiments, and the details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0065] Figure 5 is a structural block diagram of a device for determining abnormal hardware according to an embodiment of the present invention. Figure 5 As shown, the device includes:

[0066] An acquisition module 52 is configured to acquire N time series data matrices of N servers, wherein the time series data matrices include M time series data corresponding to M hardware indicator dimensions, where N is an integer;

[0067] A segmentation module 54 is configured to segment each time series data matrix based on a sliding window to obtain N segment data matrices, wherein the segment data matrices include M groups of segment data corresponding to the M hardware indicator dimensions, and a group of segment data includes multiple segment data obtained by segmenting the corresponding time series data;

[0068] The determination module 56 is configured to determine abnormal hardware in each of the services based on the N fragment data matrices.

[0069] In an exemplary embodiment, the above-mentioned device is also used to, when the size of the sliding window is W, partially overlap the sliding windows obtained by two adjacent splits, and partially identify the two sets of fragment data obtained by two adjacent splits; wherein W is greater than 1 bit and k is an integer.

[0070] In an exemplary embodiment, the above-mentioned device is also used to perform standardization processing on each group of fragment data in each of the fragment data matrices to obtain N standardized fragment data matrices, wherein the standardized fragment data matrices include M groups of standardized fragment data corresponding to the M hardware indicator dimensions, and a group of the standardized fragment data includes multiple standardized fragment data, and the annotated fragment data is obtained after the corresponding fragment data is standardized; the N standardized fragment data matrices are determined as N inputs of the target network model to obtain N groups of output results of the target network model, wherein each group of the output results includes M parameter values, and each of the parameter values ​​is used to represent the abnormal probability of the corresponding hardware indicator of the corresponding server.

[0071] In an exemplary embodiment, the above-mentioned device is also used to standardize the kth group of fragment data of the jth hardware indicator dimension in the i-th fragment data matrix through the following steps, where i, j, and k are integers: determining the mean and standard deviation of the kth group of fragment data; and standardizing each data in the kth group of fragment data through the mean and standard deviation.

[0072] In an exemplary embodiment, the above-mentioned device is also used to standardize the S-th data in the k-th group of fragment data through the following steps, where S is an integer: determining the difference between the S-th data and the mean as the target difference; and determining the ratio of the target difference to the standard deviation as the standardized data of the S-th data.

[0073] In an exemplary embodiment, the target network model includes a graph convolutional network and a temporal convolutional network, and the target network model is a pre-trained model.

[0074] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0075] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0076] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0077] An embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0078] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0079] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0080] An embodiment of the present invention further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the method described in each embodiment of the present application.

[0081] Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be implemented using a general-purpose computing device, can be centralized on a single computing device, or can be distributed across a network of multiple computing devices. They can be implemented using program code executable by the computing device, and thus, can be stored in a storage device and executed by the computing device. In some cases, the steps shown or described herein can be performed in a different order than that shown, or can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0082] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A method for determining abnormal hardware, characterized in that: include: Obtain N time series data matrices of N servers, wherein the time series data matrices include M time series data corresponding to M hardware indicator dimensions, and N is an integer; Splitting each time series data matrix based on a sliding window to obtain N segment data matrices, wherein the segment data matrices include M groups of segment data corresponding to the M hardware indicator dimensions, and a group of segment data includes multiple segment data obtained by segmenting the corresponding time series data; Abnormal hardware in each of the services is determined based on the N fragment data matrices.

2. The method according to claim 1, characterized in that The method further comprises: When the size of the sliding window is W, the sliding windows obtained by two adjacent splits partially overlap, and the two sets of segment data obtained by two adjacent splits partially share the same content. Wherein, W is greater than 1 bit, and k is an integer.

3. The method according to claim 1 or 2, characterized in that Determining abnormal hardware in each of the services based on the N fragment data matrices includes: performing standardization processing on each group of segment data in each segment data matrix to obtain N standardized segment data matrices, wherein the standardized segment data matrix includes M groups of standardized segment data corresponding to the M hardware indicator dimensions, a group of standardized segment data includes multiple standardized segment data, and the annotated segment data is obtained after the corresponding segment data are standardized; The N standardized fragment data matrices are determined as N inputs of the target network model to obtain N groups of output results of the target network model, wherein each group of the output results includes M parameter values, and each parameter value is used to represent the abnormal probability of the corresponding hardware indicator of the corresponding server.

4. The method according to claim 3, characterized in that The fragment data of each dimension in each group of the fragment data matrix is ​​standardized, including: The k-th group of fragment data of the j-th hardware indicator dimension in the i-th fragment data matrix is ​​normalized by the following steps, where i, j, and k are integers: Determining the mean and standard deviation of the kth group of fragment data; Each data in the kth group of segment data is standardized using the mean and standard deviation.

5. The method according to claim 4, characterized in that The step of standardizing each data in the kth group of segment data by using the mean and the standard deviation includes: The S-th data in the k-th group of segment data is normalized by the following steps, where S is an integer: Determine the difference between the Sth data and the mean as a target difference; The ratio of the target difference value to the standard deviation is determined as the standardized data of the Sth data.

6. The method according to claim 3, characterized in that The target network model includes a graph convolutional network and a temporal convolutional network, and the target network model is a pre-trained model.

7. A device for determining abnormal hardware, characterized in that: include: An acquisition module, configured to acquire N time series data matrices of N servers, wherein the time series data matrices include M time series data corresponding to M hardware indicator dimensions, where N is an integer; A segmentation module is used to segment each time series data matrix based on a sliding window to obtain N segment data matrices, wherein the segment data matrix includes M groups of segment data corresponding to the M hardware indicator dimensions, and a group of segment data includes multiple segment data after segmenting the corresponding time series data; A determination module is configured to determine abnormal hardware in each of the services based on the N fragment data matrices.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

9. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.