A method and system for information system fault detection based on sparse autoencoder

Abstract

The application provides a kind of information system fault detection method and system based on sparse self-encoder, it is related to data processing technical field, method includes: the process variable data of acquisition information system in working process;Process variable data is cleaned up;Through sparse self-encoder, sparse reconstruction is carried out to the process variable data after cleaning;According to sparse reconstruction result, judge whether information system exists fault;If yes, enter next step;According to sparse reconstruction result, build about each process variable undirected graph;Using standard operation data and fault state data, the information flow of the path formed between each process variable in undirected graph is calculated;The causal relationship variation coefficient of the path formed between each process variable is calculated;Screen out the high-sensitive path of which causal relationship variation coefficient is greater than preset variation coefficient, and the information flow on high-sensitive path is normalized;Analysis normalized information flow, determine fault propagation path, track root cause component.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and particularly relates to an information system fault detection method and system based on a sparse autoencoder. BACKGROUND

[0002] Information systems can collect, store, process and transmit data, supporting the daily operation, decision-making and strategic execution of enterprises. Information systems provide real-time information support by processing large amounts of data, improving work efficiency and decision-making quality. However, as information systems become increasingly complex, system failures often result in data loss, service interruption and even economic losses. Therefore, timely and effective detection of information system failures is crucial.

[0003] Current methods mainly rely on rules or conditions set by experts to judge the health status of information systems, such as setting a normal range or threshold for each key process variable, and triggering an alarm if the process variable exceeds the pre-set threshold. However, rules rely too much on manual setting and are difficult to cope with complex and dynamic changes. If the failure is not obvious or occurs under the interaction of multiple variables within the system, the rule-driven method often results in false positives or false negatives. SUMMARY

[0004] In view of the above deficiencies of the prior art, the purpose of the embodiments of the present application is to provide an information system fault detection method based on a sparse autoencoder, which can solve the technical problems of the prior art that rules rely too much on manual setting and are difficult to cope with complex and dynamic changes. If the failure is not obvious or occurs under the interaction of multiple variables within the system, the rule-driven method often results in false positives or false negatives.

[0005] The first aspect of the embodiments of the present application proposes an information system fault detection method based on a sparse autoencoder, comprising:

[0006] S1: collecting process variable data of an information system during operation;

[0007] S2: data cleaning of the process variable data;

[0008] S3: sparse reconstruction of the cleaned process variable data by a sparse autoencoder;

[0009] S4: judging whether the information system has a fault according to the sparse reconstruction result; if yes, proceeding to the next step; otherwise, returning to S1 for continuous monitoring;

[0010] S5: constructing an undirected graph about each process variable according to the sparse reconstruction result;

[0011] S6: calculating information flow of paths formed between each process variable in the undirected graph by using standard operation data and fault state data;

[0012] S7: calculating a coefficient of variation of causality of paths formed between each process variable according to the information flow;

[0013] S8: screening a high-sensitive path with a coefficient of variation of causality greater than a preset coefficient of variation, and performing normalization processing on information flow on the high-sensitive path;

[0014] S9: analyzing the normalized information flow, determining a fault propagation path, and tracing a root cause component.

[0015] The second aspect of the embodiment of the present application provides an information system fault detection system based on a sparse autoencoder, comprising a processor and a memory.

[0016] The memory stores programs or instructions executable on the processor, and the programs or instructions are executed by the processor to implement the steps of the information system fault detection method based on the sparse autoencoder according to the first aspect.

[0017] The technical scheme provided by the embodiment of the present application has at least the following beneficial effects:

[0018] In the embodiment of the present application, the internal law of process variable data is automatically identified by the sparse autoencoder, and the health condition of the information system is intelligently detected. Meanwhile, when a fault exists, the information flow is calculated, the correlation between process variables can be found, the causality can be further deduced, the fault propagation path and the root cause can be identified, the tediousness and limitations of manual rule setting are avoided, more complex and dynamic changes can be coped with, and the information system fault detection accuracy is improved. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings are only for the purpose of illustrating specific embodiments and are not considered as limiting the present application. Throughout the drawings, the same reference signs indicate the same components. Obviously, the accompanying drawings described below are only some embodiments described in the embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of the drawings.

[0020] Figure 1 is a flowchart of an information system fault detection method based on a sparse autoencoder provided by the embodiment of the present application.

[0021] Figure 2 is a flowchart of an information system fault diagnosis provided by the embodiment of the present application.

[0022] Figure 3Fig. 1 is a structural schematic diagram of an information system fault detection system based on a sparse autoencoder according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make personnel in the art better understand the technical solutions in the embodiments of the present application, the technical solutions of the present application will be clearly and completely described below in conjunction with the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. It should be understood that these descriptions are only exemplary and are not used to limit the scope of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor should belong to the scope of protection of the present application.

[0024] The information system fault detection method based on a sparse autoencoder provided by the embodiments of the present application will be described in detail below in conjunction with the drawings, specific embodiments and application scenarios.

[0025] Fig. 2 shows a flowchart of an information system fault detection method based on a sparse autoencoder according to an embodiment of the present application. Figure 1

[0026] Fig. 3 shows a flowchart of an information system fault diagnosis method according to an embodiment of the present application. Figure 2

[0027] The information system fault detection method based on a sparse autoencoder provided by the embodiments of the present application can include the following steps:

[0028] S1: Collecting process variable data of an information system in a working process.

[0029] The main components of the information system include: hardware (CPU, computer equipment, network equipment, storage equipment, sensors, etc.), software (operating system, application program, database management system, etc.), network (local area network LAN, wide area network WAN, Internet, etc.).

[0030] ​​For example, the process variable data of CPU mainly includes CPU utilization, temperature, and load. The process variable data of memory mainly includes memory occupancy, available space, and cache hit rate. The process variable data of power supply mainly includes voltage ripple coefficient, power factor mutation value, and input current harmonic distortion rate. The process variable data of storage device mainly includes disk usage rate, IO read / write speed, and disk temperature. The process variable data of power supply mainly includes voltage, current, power consumption, and UPS status. The process variable data of application service mainly includes service survival status, response time, and error rate. The process variable data of operating system mainly includes system load, process number, thread number, and kernel alert. The process variable data of database mainly includes query delay, lock waiting number, and connection pool usage rate. The process variable data of container mainly includes container restart number and resource isolation rate. The process variable data of network bandwidth mainly includes real-time bandwidth utilization, uplink / downlink traffic. The process variable data of network delay mainly includes Ping delay, connection jitter, and time delay distribution. The process variable data of packet loss rate mainly includes TCP / UDP packet loss rate. The process variable data of interface status mainly includes network card enabled state and link state. The process variable data of network topology change mainly includes route change number and ARP broadcast frequency.

[0031] There are potential causal relationships among various process variable data of various components in the information system. For example, when the CPU utilization is too high, it may lead to a decrease in system processing capacity, which in turn affects the efficiency of memory usage. Disk read and write operations generate a large amount of data flow, which is transmitted through the network. If the disk read / write speed is too high, it may lead to excessive utilization of network bandwidth, which in turn affects the network communication performance of other systems. Voltage fluctuations in the power supply (such as changes in voltage ripple coefficient) may cause hardware instability, which in turn affects the performance and response time of application services running in the system. When the system load is too high, it may affect the performance of the database, causing query delay to increase. This is because the excessive use of resources such as CPU and memory affects the access speed of the database. These causal relationships can be identified by monitoring various process variable data, combined with advanced data analysis and machine learning techniques, to identify fault risks in advance and optimize system performance and reliability.

[0032] S2: Data cleaning is performed on the process variable data.

[0033] It should be noted that the cleaning process includes missing value processing, outlier detection, duplicate data removal, data format unification and time alignment operations. First, missing data needs to be identified and completed or removed to prevent affecting model training. Secondly, by statistical analysis or rule-based method, obvious outliers are removed to avoid extreme noise interference analysis. Thirdly, redundant records are removed and data units and formats are unified to ensure data consistency. Finally, for time series variables, time stamp alignment and sampling frequency unification are required to ensure the comparability and synchronicity between multi-source data. The cleaned data can provide accurate and reliable input for the model to improve the effect of information system fault detection.

[0034] S3: Sparse reconstruction of the cleaned process variable data by sparse autoencoder.

[0035] Among them, the sparse autoencoder (Sparse Autoencoder, SAE) is a variant of autoencoder, which learns the low-dimensional representation of data by introducing sparsity constraint. Autoencoder is a neural network structure composed of encoder and decoder, the encoder compresses the input data into low-dimensional representation, and the decoder tries to reconstruct the input data from the low-dimensional representation. In the training process of sparse autoencoder, by adding a sparsity penalty term, only a small part of neurons in the hidden layer of neural network is activated, so that the learned features are more sparse and representative. The specific data processing process of sparse autoencoder is a very mature existing technology, which will not be described here.

[0036] Optionally, the sparse autoencoder adopts a multi-layer structure, and the model parameters of each layer of sparse autoencoder are adjusted by minimizing the cost function layer by layer.

[0037] Optionally, the main innovation of the present application is to conceive a brand new cost function, which contains reconstruction error term, sparse penalty term and regularization term:

[0038]

[0039] Among them, J SAE represents the cost function, θ represents the model parameters of the sparse autoencoder, L represents the mean square error loss function, which is used to represent the reconstruction error term, represents the u th original input sample, represents the u th reconstructed sample of the sparse reconstruction of the original input sample, U represents the total number of original input samples, KL represents the Kullback-Leibler divergence, which is used to represent the sparse penalty term, μdenotes the preset sparse target activation, μ v denotes the actual average activation of the v hidden neurons, V denotes the total number of hidden neurons, β denotes the weight coefficient of the sparse penalty term, W e denotes the encoder weight matrix, W d denotes the decoder weight matrix, norm operator, γ denotes the weight coefficient of the regularization term.

[0040] wherein the weight coefficient of the sparse penalty term β and the weight coefficient of the regularization term γ can be set by the person skilled in the art according to the actual situation, and the present application is not limited.

[0041] In the embodiments of the present application, the cost function comprising the reconstruction error term, the sparse penalty term and the regularization term is introduced, which helps the sparse autoencoder to more effectively extract the essential features in the data during the training process. The reconstruction error term ensures that the model can accurately restore the input data and improve the reconstruction quality. The sparse penalty term limits the average activation of the hidden neurons through the Kullback-Leibler divergence, so that the model focuses on the key features and avoids the interference of redundant information, thereby enhancing the discriminability and sparsity of the features. The regularization term constrains the weights to prevent the model from overfitting and improve the generalization ability. Overall, the design of the cost function enables the model to retain the information expression ability while obtaining a simple structure, sparse representation and strong generalization, which is conducive to subsequent anomaly detection and causal analysis.

[0042] S4: According to the sparse reconstruction result, it is judged whether the information system has a fault. If yes, go to the next step. Otherwise, return to S1 to continue monitoring.

[0043] It should be noted that after the sparse autoencoder is trained on the fault-free data, it can learn and compress the typical feature distribution of the system in the normal state. When the system is in the normal state, the input data is reconstructed by the sparse encoder and the decoder, and the output is highly similar to the original input, and the reconstruction error is small. When the system has a fault, the distribution of the input data is abnormal and deviates from the normal mode learned by the model, so that the autoencoder cannot effectively reconstruct the original data, thereby producing a significant reconstruction error. Therefore, by monitoring the difference (such as the reconstruction error) between the sparse reconstruction result and the original data, it can be judged whether the current input deviates from the normal state, thereby realizing the identification of potential faults.

[0044] In one possible implementation, S4 specifically comprises sub-steps S401 to S404:

[0045] S401: input the time series data in the process variable data into the long short-term memory neural network to determine a time series anomaly score.

[0046] It should be noted that an important innovation of the present application is to introduce a long short-term memory neural network on the basis of a sparse encoder. Process variable data is mainly in the form of text type log data and time series type index data. For text type data, a sparse encoder can be used, while for time series type data, a long short-term memory neural network is more likely to capture short-term and long-term dependencies in the input data, and is suitable for reflecting the law of process variable change over time.

[0047] The long short-term memory neural network (Long Short-Term Memory, LSTM) is an improved recurrent neural network (RNN) specially designed to solve the gradient vanishing and memory decay problems of traditional RNN when processing long sequence data. LSTM introduces a gating mechanism (input gate, forget gate and output gate) to control the preservation, update and output of information, thereby having the ability to capture long-term dependencies. The specific data processing process of the long short-term memory neural network is a prior art, and the present application will not be described again.

[0048] Optionally, the time series anomaly score can be calculated by a Sigmoid activation function according to the hidden state extracted by the long short-term memory neural network.

[0049] S402: compare the difference between the process variable data after sparse reconstruction and the original process variable data to determine a reconstruction anomaly score.

[0050] Optionally, the mean square error between the data after sparse reconstruction and the original process variable data can be used as the reconstruction anomaly score.

[0051] S403: weighted sum of the time series anomaly score and the reconstruction anomaly score to obtain a comprehensive anomaly score.

[0052] Wherein, the skilled person in the art can set the weight of the time series anomaly score and the reconstruction anomaly score according to the actual situation, and the present application does not make any limitation.

[0053] In this embodiment of the invention, LSTM excels at capturing the time dependencies of process variables and can detect dynamic anomalies such as sudden changes, trend drift, and delayed responses. Sparse autoencoders focus on the spatial structure and distribution characteristics between variables and can detect anomalous combination patterns or isolated outliers. Weighted fusion of temporal anomaly scores and reconstructed anomaly scores fully leverages the advantages of both models, thereby more accurately and comprehensively identifying potential abnormal states in information systems. This not only improves detection and anti-interference capabilities but also provides a unified and efficient anomaly measurement basis for automated judgment, making it an important strategy in intelligent fault detection systems.

[0054] S404: Determine if the overall anomaly score is greater than the preset score. If yes, confirm that there is a fault in the information system and proceed to the next step. Otherwise, return to S1 to continue monitoring.

[0055] Those skilled in the art can set the preset score according to the actual situation, and the present invention does not limit it.

[0056] S5: Based on the sparse reconstruction results, construct an undirected graph about each process variable.

[0057] In one possible implementation, S5 specifically includes sub-steps S501 to S505:

[0058] S501: Determine the degree of correlation between process variables based on the hidden nodes that are jointly activated by various process variables.

[0059]

[0060] in, Indicates the first i The process variable and the first j The degree of correlation between process variables Indicates the first i The input node represented by the process variable is related to the first process variable. k The encoding weights between hidden nodes Indicates the first k The hidden node and the first j Each process variable represents the decoding weight between the output node and the input node. K This indicates the total number of hidden nodes.

[0061] It should be noted that, Quantified the first i The process variable for the first... k The impact of a hidden node Quantified the first k The hidden node pairs the _th j The influence of the process variable is determined by multiplying the two variables to determine the first process variable. i The process variable and the first jcorrelation between process variables.

[0062] For example, CPU utilization (the first variable) and memory occupancy (the second variable) both show strong activation on some hidden neurons (i.e., high influence on the same hidden feature), which means that these two variables may have a co-variation or coupling mechanism inside the system, which will be captured and represented as a link with a higher edge weight in the undirected graph.

[0063] In the embodiments of the present application, this correlation calculation method does not rely on time information or explicit modeling, and reflects the coupling relationship between variables inside the system through the influence path of variables on common hidden nodes, which helps to automatically build a variable relationship graph in high-dimensional data and improve the ability to describe the internal dependency structure of a complex system, providing a solid graph foundation for subsequent fault propagation analysis and causal reasoning.

[0064] For how to determine the correlation between each process variable, a method of applying perturbation to one process variable and observing the change of another process variable can also be used to quantify the correlation between process variables.

[0065] S502: Construct a correlation matrix according to the correlation between each process variable:

[0066]

[0067] wherein, A represents the correlation matrix, n represents the total number of process variables.

[0068] S503: Construct a symmetric correlation matrix according to the correlation matrix:

[0069]

[0070]

[0071] wherein, S represents the symmetric correlation matrix, T represents the transpose operation, s ij represents the symmetric correlation between the first i process variable and the first j process variable.

[0072] It should be noted that when constructing the undirected graph, the correlation of the two variables is bidirectional and equivalent, so the symmetric correlation matrix is obtained by symmetric processing.

[0073] S504: Retain the process variable pairs with a symmetric correlation greater than a preset correlation in the symmetric correlation matrix. ​

[0074] Wherein, the person skilled in the art can set the size of the preset correlation degree according to the actual situation, and the present application is not limited.

[0075] It should be noted that the process variable pair with the reserved symmetric correlation degree greater than the preset correlation degree can exclude weakly related or accidental correlation edges and retain the key path.

[0076] S505: The remaining process variables are used as nodes, and the symmetric correlation degrees between the process variables are used as edges to construct an undirected graph.

[0077] In the embodiment of the present application, the potential structural correlation between the process variables is extracted from the sparse autoencoder hidden layer, and through the construction of the correlation matrix, the symmetrization, the screening and the graph construction, an undirected graph model expressing the static dependence relationship of the variables is finally formed. The core advantage lies in: not dependent on prior physical model or time sequence, having data driving capability, suitable for high-dimensional sparse data, and applicable to the interpretable modeling of multiple systems. The graph model not only provides structural support for subsequent causal information flow analysis, but also provides an important basis for intelligent fault diagnosis, system decoupling and optimization.

[0078] S6: Using standard operation data and fault state data, the information flow of the path formed between each process variable in the undirected graph is calculated.

[0079] In one possible implementation, S6 specifically includes sub-steps S601 to S603:

[0080] S601: Using standard operation data and fault state data, the probability density and conditional probability density of each process variable are calculated.

[0081] Wherein, the probability density function describes the statistical distribution law of the system variable in different states.

[0082] S602: According to the probability density and conditional probability density of each process variable, the information flow between each process variable pair in the undirected graph is calculated:

[0083]

[0084] Wherein, represents the information flow from the i th process variable to the j th process variable, j i represents the i th process variable data, i j represents the j th process variable data, x i represents the description of the i th process variable data, i x j represents the j th process variable data, j F i represents the description of the i th process variable data, ia deterministic function of the process variable, ρ j a probability density function of the process variable, j a conditional probability density function of the process variable given the process variable, i j a random noise intensity of the information system, b d a differential operator, x a process variable, R n an integral region being a state space of the entire system, n

[0085] It should be noted that in actual information systems, we cannot always explicitly list the analytical form of the deterministic function, and an approximate function model can be obtained by fitting historical data, such as: regression model (linear / nonlinear), neural network (such as MLP, LSTM), local weighted estimation, and kernel density estimation, etc. The goal of the deterministic function is to predict the trend of the variable over time and extract the action relationship between other variables.

[0086] Further, the first term in the information flow calculation formula is the information flow dominated by deterministic dynamics, which describes the "real causal effect" between variables, and is used to quantify the degree to which the process variable affects the process variable through deterministic mechanisms. The probability density function of the process variable given the process variable ensures that the calculation only depends on the process variable and the process variable, excluding the interference of other variables. j i i j i j

[0087] Further, the second term in the information flow calculation formula is the adjustment effect of random noise, which is used to correct the interference of random noise on information flow and filter false correlations caused by sensor noise or environmental disturbance.

[0088] In the embodiments of the present application, the information flow is innovatively calculated by combining the probability density, conditional probability density and deterministic function of the process variable, which not only quantifies the real causal effect between variables, but also effectively eliminates false correlations caused by environmental disturbance or sensor noise. This calculation method does not depend on global joint modeling of variables, but is based on local density and dynamic rules for inference, has good interpretability and computational feasibility, and is particularly suitable for fault propagation modeling and root cause positioning in complex, multi-variable actual information systems. ​​​​​​​​​​​

[0089] S603: Integrate the information flow data at various times into a time series format for subsequent dynamic analysis.

[0090] S7: Based on the information flow, calculate the coefficient of variation of the causal relationship between the paths formed between the various process variables.

[0091] In one possible implementation, S7 specifically includes sub-steps S701 and S702:

[0092] S701: Calculate the standard deviation and mean of the time series composed of information flow data at each time point.

[0093] S702: The ratio of the standard deviation to the mean is used to determine the coefficient of variation of the causal relationship of the paths formed between the process variables.

[0094]

[0095] in, Indicates the first j The process variable to the first i Coefficient of variation of information flow causal relationship of process variables Indicates the first j The process variable to the first i Information flow of process variables This represents the standard deviation of a time series composed of information stream data at various points in time. It represents the average value of a time series composed of information flow data at various times.

[0096] In this embodiment of the invention, the coefficient of variation (COP) is obtained by calculating the ratio of the standard deviation to the mean of the information flow time series. This COP effectively measures the stability and sensitivity of the causal relationship between variables. The COP reflects the degree of fluctuation in the information flow at different times. Compared to static indicators such as the mean or maximum value, the COP can identify paths that, while having a low average impact, exhibit significant fluctuations and are more sensitive to faults. This method not only improves the ability to perceive dynamic anomalies but also highlights the most unstable and diagnostically valuable variable association paths when a fault occurs. It provides a quantitative basis for subsequent screening of highly sensitive paths and root cause localization, enhancing the accuracy and robustness of system fault analysis.

[0097] S8: Filter out highly sensitive paths with a causal relationship variation coefficient greater than the preset variation coefficient, and normalize the information flow on the highly sensitive paths.

[0098] Those skilled in the art can set the preset coefficient of variation according to the actual situation, and the present invention does not limit it.

[0099] It's important to note that information flow normalization is necessary because unnormalized information flow is insufficient to establish a unidirectional causal relationship between process variables. For example, the information flow value might be small, but if the process variable itself also changes very slightly, then this impact may be significant enough. Conversely, the information flow value might appear large, but if the process variable itself fluctuates dramatically or is strongly influenced by multiple variables, then this path may be insignificant. Without normalization, the information flow is merely a vague "impact quantity," making it difficult to construct a clear, interpretable unidirectional causal graph or identify root variables.

[0100] In one possible implementation, S8 specifically includes sub-steps S801 and S802:

[0101] S801: Filter out highly sensitive paths where the coefficient of variation of causal relationships is greater than the preset coefficient of variation.

[0102] S802: Normalization of information flow on highly sensitive paths based on deterministic entropy change rate and random noise entropy change rate:

[0103]

[0104]

[0105] in, Indicates the first j The process variable to the first i Normalized information flow of process variables, Indicates the first j The process variable to the first i Information flow of process variables Indicates the first j The process variable to the first i The normalized denominator of each process variable, Indicates the first i The deterministic entropy rate of change of each process variable. Indicates the first i The rate of change of random noise entropy of each process variable d Represents the differential operator. t Indicates the time.

[0106] Optionally, a traditional Max-Min normalization processing mode can also be adopted, and the advantage of the normalization processing adopted in the application is that the normalization mode not only considers the absolute intensity of the information flow itself, but also introduces the deterministic entropy rate and the random noise entropy rate, which correspond to the order and randomness of the system state change respectively. This design can more comprehensively reflect the dynamic complexity and system stability behind the change of the information flow, dynamically adjust the normalization scale, and improve the perception ability of the model to system complexity, non-stationarity and external disturbance, so as to more accurately distinguish abnormal driving changes from normal fluctuations in the high sensitivity path.

[0107] S9: analyzing the normalized information flow, determining the fault propagation path, and tracking the root cause component.

[0108] In a possible implementation, S9 specifically includes sub-steps S901 to S903:

[0109] S901: determining the one-way causal relationship between each process variable according to the normalized information flow, and forming the fault propagation path.

[0110] S902: determining the source of the fault propagation path as the root cause component.

[0111] S903: outputting the information of the root cause component, and completing the tracking of the root cause component.

[0112] In the embodiment of the application, the one-way causal relationship between each process variable is determined through the normalized information flow, which can effectively construct a clear and directionally explicit fault propagation path, avoiding confusing weak or false correlations between variables. Based on this path, the starting point of the fault propagation chain can be identified, and the root cause component can be accurately located. This method not only improves the accuracy and interpretability of fault location, but also significantly shortens the fault troubleshooting time, avoids blind traversal of the whole system, and improves the system operation efficiency and intelligent level.

[0113] The technical scheme provided by the embodiment of the application has at least the following beneficial effects:

[0114] In the embodiment of the application, the internal law of the process variable data is automatically identified by the sparse autoencoder, and the health condition of the information system is intelligently detected. At the same time, when there is a fault, the correlation between the process variables can be found through the information flow calculation, and the causal relationship can be further deduced to identify the fault propagation path and the root cause, avoiding the tediousness and limitations of manual rule setting, and being able to cope with more complex and dynamic changes, and improving the fault detection accuracy of the information system.

[0115] Reference is made to the accompanying drawings Figure 3 , which shows a structural schematic diagram of an information system fault detection system based on a sparse autoencoder provided by an embodiment of the application.

[0116] The embodiment of the present application provides a kind of information system fault detection system 20 based on sparse self-encoder, comprising: processor 201 and memory 202;

[0117] The memory 202 stores the program or instruction that can be run on the processor 201, the program or instruction is implemented when the processor 201 is executed The steps of the information system fault detection method based on sparse self-encoder described above, and the same technical effect can be achieved, to avoid repetition, the present application will not repeat the present application will not repeat.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application, but not to limit them. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can modify the technical solutions recorded in the foregoing embodiments or make equivalent substitutions for some technical features; and these modifications or substitutions do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and any changes or substitutions easily thought of by those skilled in the art within the technical scope disclosed by the present application should be covered within the protection scope of the present application.

Claims

1. A method for information system failure detection based on sparse autoencoder, characterized in that, The method comprises the following steps: S1: collecting process variable data of an information system during operation; S2: data cleaning of the process variable data; S3: sparse reconstruction of the cleaned process variable data by a sparse autoencoder; S4: determining whether the information system has a fault according to the sparse reconstruction result; if yes, proceeding to the next step; otherwise, returning to S1 for continuous monitoring; S5: constructing an undirected graph about each process variable according to the sparse reconstruction result; S6: calculating information flow of a path formed between each process variable in the undirected graph by using standard operation data and fault state data; S7: calculating a causal relationship variation coefficient of the path formed between each process variable according to the information flow; S8: screening a high-sensitive path with a causal relationship variation coefficient greater than a preset variation coefficient, and performing normalization processing on information flow of the high-sensitive path; S9: analyzing the normalized information flow, determining a fault propagation path, and tracking a root cause component; The S6 specifically comprises: S601: calculating probability density and conditional probability density of each process variable by using the standard operation data and the fault state data; S602: calculating information flow between each process variable pair in the undirected graph according to the probability density and the conditional probability density of each process variable: S603: integrating information flow data at each time into a time series form; wherein, represents the information flow from the j th process variable to the i th process variable, x i represents the i th process variable data, x j represents the j th process variable data, F i represents a deterministic function describing the i th process variable, The S7 specifically comprises: j represents the probability density function of the j th process variable, represents the conditional probability density function of the j th process variable given the i th process variable, b represents the random noise intensity of the information system, d represents the differential operator, x represents a process variable, represents the partial derivative operator, R n represents the integral region being the entire system state space, n represents the total number of process variables; S701: calculating a standard deviation and an average value of a time series composed of information flow data at each time; S702: determining a causal relationship variation coefficient of the path formed between each process variable as a ratio of the standard deviation to the average value: The S8 specifically comprises: S801: screening a high-sensitive path with a causal relationship variation coefficient greater than a preset variation coefficient; wherein, represents a process variable to a process variable information flow causality variation coefficient, j i represents a process variable to a process variable information flow causality variation coefficient, j represents a process variable to a process variable information flow, i represents a standard deviation of a time series composed of information flow data at each time, represents a mean value of a time series composed of information flow data at each time;​​​ S802: performing normalization processing on information flow of the high-sensitive path based on a deterministic entropy change rate and a random noise entropy change rate: The sparse autoencoder adopts a multi-layer structure, and adjusts model parameters of each layer of the sparse autoencoder by layer-by-layer minimization of a cost function. The cost function contains a reconstruction error term, a sparse penalty term, and a regularization term. wherein, denotes a normalized information flow from the j process variable to the i process variable, denotes an information flow from the j process variable to the i process variable, denotes a normalized denominator from the j process variable to the i process variable, denotes a deterministic entropy rate of the i process variable, denotes a stochastic noise entropy rate of the i process variable, d denotes a differential operator, t denotes a time instant.

2. The sparse autoencoder-based information system failure detection method according to claim 1, characterized in that, The S4 specifically comprises:

3. The sparse autoencoder-based information system failure detection method according to claim 2, characterized in that, S401: inputting time series data in the process variable data into a long short-term memory neural network to determine a time series anomaly score; 4. The sparse autoencoder-based information system failure detection method of claim 1, wherein, S402: comparing differences between the process variable data after sparse reconstruction and the original process variable data to determine a reconstruction anomaly score; S403: performing weighted summation on the time series anomaly score and the reconstruction anomaly score to obtain a comprehensive anomaly score; S404: determining whether the comprehensive anomaly score is greater than a preset score; if yes, determining that the information system has a fault, and proceeding to the next step; otherwise, returning to S1 for continuous monitoring. The S5 specifically comprises: S501: determining a correlation degree between each process variable according to a hidden node commonly activated by each process variable; 5. The sparse autoencoder-based information system failure detection method of claim 1, wherein, S502: constructing a correlation matrix according to the correlation degree between each process variable; ​ ​ S503: constructing a symmetric correlation matrix according to the correlation matrix; S504: reserving process variable pairs with symmetric correlation degrees greater than a preset correlation degree in the symmetric correlation matrix; S505: constructing the undirected graph by taking the reserved process variables as nodes and the symmetric correlation degrees between the process variables as edges.

6. The sparse autoencoder-based information system failure detection method of claim 1, wherein, The S9 specifically includes: S901: determining a one-way causal relationship between each process variable according to the normalized information flow, and forming the fault propagation path; S902: determining the source of the fault propagation path as the root cause component; S903: outputting information of the root cause component, and completing tracking of the root cause component.

7. A sparse autoencoder based information system failure detection system, characterized in that, It includes: a processor; a memory, the memory having computer readable instructions stored thereon, the computer readable instructions being executed by the processor to implement the information system fault detection method based on the sparse autoencoder according to any one of claims 1 to 6.

Images