System detection method, storage medium and computer program product

Abstract

The invention discloses a system detection method, a storage medium and a computer program product. And inputting the index data into a target model to perform extraction operation of feature data in a normal operation state of the target system and extraction operation of feature data in an abnormal operation state of the target system, thereby obtaining multi-level features. Besides, the sensitivity parameter is determined according to the index volatility of the target system at the current moment, so that the influence proportion of the intermediate data and the target data on the detection result is adjusted in real time according to the sensitivity parameter, and the dynamic fluctuation characteristic of the system index is effectively adapted; and finally, after the detection score is determined according to the index data, the intermediate data and the target data, the detection result of the target system is determined in combination with the abnormal detection threshold matched with the target system at the current moment, so that the technical effects of reducing the false alarm rate and the missing report rate and improving the accuracy and the reliability of fault detection are achieved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of system resource monitoring, and particularly to a system detection method, a storage medium and a computer program product. BACKGROUND

[0002] In today's digital and intelligent era, more and more businesses rely on stable computer systems to operate normally, so monitoring computer systems is a crucial task to ensure stable and efficient system operation.

[0003] At present, the monitoring of computer systems relies on a model for detecting anomalies by deep learning methods, but the existing model may have false positives or false negatives due to unreasonable training and prediction parameter settings. SUMMARY

[0004] In view of the above defects or deficiencies in the prior art, it is desirable to provide a system detection method, a storage medium and a computer program product, which can improve system anomaly detection accuracy and adaptability.

[0005] The first aspect provides a system detection method, the method comprising: obtaining index data of the target system running at the current time; inputting the index data into a target model to extract feature data of the index data under normal operation of the target system as intermediate data, and to extract feature data of the intermediate data under abnormal operation of the target system as target data; determining a sensitivity parameter according to the index volatility of the target system at the current time, the sensitivity parameter being used to adjust the proportion of the intermediate data and the target data; determining a detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data, comparing the detection score with an anomaly detection threshold of the target system at the current time, and determining a system detection result of the target system at the current time based on the comparison result.

[0006] The system detection method provided in the application considers that the monitoring of the computer system depends on a model for detecting abnormalities by using a deep learning method, but the existing model is prone to false positives or false negatives. The system detection method provided in the application obtains index data of a target system running at a current time, and inputs the index data into a target model to perform feature data extraction operation in a normal operation state of the target system and feature data extraction operation in an abnormal operation state of the target system, thereby obtaining multi-level features. In addition, before determining a detection result according to the index data, intermediate data and target data, the application determines a sensitivity parameter according to index fluctuation of the target system at the current time, so as to adjust the influence proportion of the intermediate data and the target data on the detection result in real time according to the sensitivity parameter, and effectively adapt to the dynamic fluctuation characteristics of the system index. Finally, after determining a detection score according to the index data, the intermediate data and the target data, the application determines a detection result of the target system in combination with an abnormal detection threshold value matched with the target system at the current time, thereby achieving the technical effects of reducing false positive rate and false negative rate, and improving accuracy and reliability of fault detection.

[0007] The second aspect provides a system detection device, and the device comprises: An acquisition module is configured to acquire index data of a target system running at a current time. An input processing module is configured to input the index data into a target model to extract feature data of the index data in a normal operation state of the target system as intermediate data, and extract feature data of the intermediate data in an abnormal operation state of the target system as target data. A determination module is configured to determine a sensitivity parameter according to index fluctuation of the target system at the current time, and the sensitivity parameter is used to adjust the proportion of the intermediate data and the target data. A determination and comparison module is configured to determine a detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data, compare the detection score with an abnormal detection threshold value of the target system at the current time, and determine a system detection result of the target system at the current time based on a comparison result.

[0008] The third aspect provides a computer readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the method of the first aspect.

[0009] The fourth aspect provides a computer program product comprising a computer program, and the computer program is executed by a processor to implement the method of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0010] Other features, objects and advantages of the present application will become more apparent upon reading the detailed description of non-limiting embodiments made with reference to the following drawings: Figure 1 An application scenario diagram of a system detection method provided in this application; Figure 2 A flowchart of the steps of a system detection method provided in this application; Figure 3 A flowchart of the steps of a system detection method provided in this application; Figure 4 A flowchart of the steps of a system detection method provided in this application; Figure 5 A flowchart of the steps of a system detection method provided in this application; Figure 6 A flowchart of the steps of a system detection method provided in this application; Figure 7 A flowchart of the steps of a system detection method provided in this application; Figure 8 This is a structural block diagram of a system detection device provided in this application. DETAILED DESCRIPTION

[0011] The present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the relevant invention and are not intended to limit the invention. It should also be noted that, for ease of description, only portions relevant to the invention are shown in the accompanying drawings.

[0012] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0013] In existing technologies, computer system monitoring primarily relies on deep learning models for anomaly detection. Traditional methods typically use a single encoding / decoding structure to reconstruct input data and identify anomalies by comparing the original data with the reconstructed data. However, the system operating environment is subject to dynamic changes, and the volatility of indicator data varies significantly over time. Models with fixed parameter settings struggle to adapt to this dynamic nature, prone to false positives during periods of low volatility and missed positives during periods of high volatility, resulting in reduced reliability of detection results. For example, in load monitoring scenarios on cloud computing platforms, traffic fluctuations between peak and off-peak periods can vary by tens of times, making traditional static threshold methods ineffective in distinguishing normal fluctuations from abnormal behavior.

[0014] To solve the above problems, a mechanism capable of self-adaptive adjustment of detection strategy needs to be designed. Considering that the volatility of system indicators directly affects the difficulty of anomaly determination, the applicant realizes that a dynamic parameter adjustment mechanism should be established. By analyzing the statistical characteristics of the indicator data, the volatility degree at the current time is quantified, and then the attention degree of the detection model to different levels of features is dynamically adjusted. This adjustment needs to consider the relationship between the original data, the intermediate features and the final reconstruction results, so as to avoid the deviation caused by single feature judgment. After many experiments, it is verified that the use of two-stage encoding-decoding structure combined with adjustable fusion weight can effectively balance the contribution of different levels of features.

[0015] Reference is made to Figure 1 , Figure 1 An application scenario diagram of a system detection method provided by the present application is provided, which includes a terminal device 100 and a service device 200. The terminal device 100 stores various running indicators of the target system at each time, such as CPU usage, memory usage, disk IO waiting time, network request delay, system load, process state, etc.

[0016] The service device 200 stores a target model. When it is determined that the target system needs to be detected, the service device 200 obtains the indicator data of the target system running at the current time from the terminal device 100, and inputs the obtained running indicators into the target model for system detection. The terminal device 100 is, for example, a notebook computer, a desktop computer, a tablet computer, a wearable device, etc. The service device 200 is, for example, a single server or a server cluster.

[0017] Next, the system detection method provided by the present application is described in combination with Figure 2 The service device 200 in Figure 1 The method includes the following steps: Step S20, obtaining the indicator data of the target system running at the current time; The indicator data of the target system running at the current time can be obtained by the service device from the terminal device. The terminal device can be obtained by collecting according to a predetermined collection rule, such as collecting once every 30 seconds. For example, the terminal device can collect the indicator data of the target system running at the current time by using the ebpf technology.

[0018] The indicator data of the target system running at the current time reflects the time series measurement value of the system running state. For example, the indicator data includes CPU usage, memory usage, disk IO, network traffic, system load, process state, etc. It should be noted that when the target system is running, the terminal device can continuously collect the indicator data of the target system running.

[0019] The present application provides more comprehensive state information for the target system by collecting multiple types of data. Using the ebpf technology for data collection has lower system overhead and higher efficiency compared to traditional collection methods. In addition, the present application sets a corresponding collection frequency for data collection to avoid the additional burden on the system caused by too frequent collection.

[0020] For example, assume that the system detection system is deployed on a Linux server to detect terminal devices or service devices. The service device or terminal device can use the ebpf technology to collect the following data every 30 seconds: 1. CPU usage: - user: 80% - system: 15% - iowait: 3% - idle: 2% 2. Memory usage: - used: 70% - free: 10% - cache: 15% - buffer: 5% 3. Disk IO: - read IOPS: 1000 - write IOPS: 500 - await time: 5ms 4. Network traffic: - rx packets: 10000 / s - tx packets: 8000 / s - errors: 0 5. System load: - load: 4.5 6. Process status: - running: 10 - sleep: 200 - uninterruptible sleep: 2 - stop: 0 - zombie: 0.

[0021] These indicator data will be used as input for the target model to determine whether the system is in an abnormal state.

[0022] In step S30, the indicator data is input into the target model to extract feature data of the indicator data under the normal running state of the target system as intermediate data, and to extract feature data of the intermediate data under the abnormal running state of the target system as target data. The target model is pre-trained by the service device and stored in the corresponding memory address. If system detection needs to be performed, the target model is obtained from the corresponding memory address, and the target system's current running indicator data obtained from the terminal device is input into the target model to obtain the output intermediate data and target data.

[0023] The target model can extract feature data of the index data under the normal operation state of the target system to obtain intermediate data after enhancing the normal features in the index data, that is, the target model reconstructs the feature representation under the normal state from the index data; on the other hand, the target model can extract feature data of the intermediate data under the abnormal operation state of the target system to obtain target data after enhancing the abnormal features in the intermediate data, that is, the target model reconstructs the feature representation under the abnormal state from the intermediate data.

[0024] As can be seen from the above, the target model can capture the data distribution features under the normal and abnormal states at the same time. Therefore, the target model can be a machine learning model with double feature extraction capability.

[0025] For example, the target model can adopt a deep neural network structure containing parallel feature extraction branches, for example, the target model includes a first encoder, a first decoder, a second encoder, and a second decoder, wherein the first encoder and the first decoder are connected in series and connected in parallel with the second encoder and the second decoder connected in series. It should be noted that the structures of the first encoder and the second encoder can be the same structure, and the parameters can be shared; the structures of the first decoder and the second decoder can also be the same, but since different tasks are performed, the parameters cannot be shared.

[0026] In step S40, a sensitivity parameter is determined according to the index volatility of the target system at the current time, and the sensitivity parameter is used to adjust the proportion of the intermediate data and the target data; The sensitivity parameter is a regulating factor for balancing the importance of different levels of features, and is used in this application to balance the fusion proportion of the intermediate data and the target data. The sensitivity parameter in this application is dynamically adjusted according to the index volatility of the target system at the current time. For example, when the index volatility of the target system at the current time is large, the weight of the intermediate data is increased to avoid interference of abnormal features; when the index volatility of the target system at the current time is small, the weight of the target data is increased to focus on the deep influence of abnormal features.

[0027] The index volatility of the target system at the current time can be determined according to the volatility index of different types of indexes, which will be described in detail below, and will not be repeated here.

[0028] In step S50, the detection score of the index data is determined according to the adjusted sensitivity parameter, the index data, the intermediate data, and the target data, the detection score is compared with the abnormal detection threshold of the target system at the current time, and the system detection result of the target system at the current time is determined based on the comparison result.

[0029] After obtaining the adjusted sensitivity parameters, indicator data, intermediate data, and target data according to the above process, a normal or abnormal detection score for the indicator data can be obtained, thereby quantifying the degree of abnormality of the indicator data through the detection score. For example, the detection score can be obtained by weighted calculation of the difference distance between the original data and different reconstruction results.

[0030] The anomaly detection threshold is also a threshold that matches the current operating state of the target system and is a dynamically changing quantity. It can be determined based on the detection score of the indicator data to better adapt to the current operating state of the target system.

[0031] The comparison result of the detection score and the abnormality detection threshold of the target system at the current moment may include two situations: the detection score is greater than or equal to the abnormality detection threshold, and the detection score is less than the abnormality detection threshold. For example, the present application may determine that the system detection result of the target system is abnormal when the comparison result is that the detection score is greater than or equal to the abnormality detection threshold; conversely, when the comparison result is that the detection score is less than the abnormality detection threshold, the system detection result of the target system is normal.

[0032] This solution captures changes in both surface and underlying features, enhancing both normal and abnormal characteristics of the indicator data for subsequent identification. The dynamic sensitivity parameter setting enables the model to automatically adjust feature weights based on real-time fluctuations. This adaptive mechanism effectively addresses the unstable performance of fixed-parameter models in dynamic environments, avoiding misjudgments caused by environmental changes.

[0033] Through the above technical solution, this application can automatically optimize detection strategies based on real-time changes in the system's operating status. This dynamic adjustment mechanism significantly improves the adaptability of anomaly detection, effectively reducing the false alarm rate caused by environmental noise while ensuring high sensitivity in detecting potential anomalies. Through multi-level feature fusion, the ability to recognize complex anomaly patterns is enhanced, especially for latent anomalies with temporal correlations, achieving more reliable detection.

[0034] In an optional embodiment, if Figure 3 As shown, Figure 3 An optional method embodiment of determining a sensitivity parameter provided by an exemplary embodiment of the present application includes the following steps: Step S301, calculating the coefficient of variation of each indicator data according to the standard deviation and mean of each indicator data; The coefficient of variation is used to measure the relative volatility of different dimension index data; for example, the standard deviation divided by the absolute value of the mean can be used to achieve it. It should be noted here that different types of index data have different coefficients of variation. For example, the coefficient of variation (CoV) of CPU usage is 0.3, the CoV of memory usage is 0.1, and the CoV of network traffic is 0.4.

[0035] Step S302, determining the index volatility of the target system at the current time according to the mean of the coefficients of variation of each index data; The index volatility refers to the stability of the overall operation state of the target system, and the mean of the coefficients of variation of each index can be used to achieve it, reflecting the comprehensive volatility of multiple indexes.

[0036] For example, the following formula is used to calculate:

[0037] n represents the number of types of index data.

[0038] If the coefficient of variation (CoV) of CPU usage is 0.3, the CoV of memory usage is 0.1, and the CoV of network traffic is 0.4, then the volatility index V = (0.3 + 0.1 + 0.4) / 3 = 0.267.

[0039] Step S303, determining the sensitivity parameter according to the index volatility of the target system at the current time, the reference sensitivity parameter, the preset adjustment intensity, and the volatility threshold.

[0040] The reference sensitivity parameter refers to the initial set sensitivity reference value, which can be a fixed value determined by experiment or experience in advance, and is used as the reference for adjustment. The preset adjustment intensity refers to the amplitude of the sensitivity parameter change, which can be a proportion coefficient set according to actual needs, and is used to control the adjustment speed of the sensitivity parameter. The volatility threshold refers to the critical value for judging whether the index volatility is significant, which can be a value set according to historical data statistics or system operation requirements, and is used to trigger the dynamic adjustment of the sensitivity parameter.

[0041] For example, the sensitivity parameter can be determined according to the following formula:

[0042] a base is a reference sensitivity, and the default value is 0.5; g is an adjustment intensity, and the default value is 0.3; V threshold is a fluctuation threshold, and the default value is 0.2; and the sigmoid function is used to smooth the parameter change. It can be understood that the application can recalculate the fluctuation index V and the parameter a every 100 time windows (about 16 minutes) in order to better adapt to the current running state of the target system.

[0043] Compared with the prior art, the conventional method generally uses a fixed sensitivity parameter and cannot adapt to the dynamic change of the index fluctuation during system operation. For example, when the system is in a high load state, the index fluctuation may increase significantly, and if the fixed parameter is still used at this time, the detection result will deviate from the actual state. The present scheme can adaptively adjust the parameter according to the real-time fluctuation by introducing the coefficient of variation and the dynamic adjustment mechanism, so that the detection model remains adaptive under different running states.

[0044] Through the above technical scheme, the application can effectively solve the false alarm or missed alarm problem caused by unreasonable parameter setting. By dynamically adjusting the sensitivity parameter, the model can pay more attention to the intermediate data when the system fluctuation is high, and focus on the target data when the fluctuation is low, thereby improving the accuracy of anomaly detection. For example, in the scenario of sudden surge of system traffic, the method can automatically increase the sensitivity parameter to capture potential anomalies in time and avoid response delay caused by fixed parameters.

[0045] In an optional embodiment, as shown in Figure 4 , an optional method embodiment for determining the detection score of the index data provided by an example embodiment of the application includes the following steps: Figure 4 The method embodiment includes the following steps: Step S401, determining a first Euclidean norm distance between the index data and the intermediate data, and a second Euclidean norm distance between the index data and the target data; Wherein, the Euclidean norm distance refers to the straight line distance between two data points in a multi-dimensional space, which can be calculated by summing the square of the difference of each dimension of the vector and taking the square root, and is used to quantify the difference between the index data and the intermediate data or the target data.

[0046] Step S402, summing the product of the adjusted sensitivity parameter and the first Euclidean norm distance and the product of the first parameter, to obtain the detection score, and the sum of the first parameter and the adjusted sensitivity parameter is 1.

[0047] The adjusted sensitivity parameter is used to adjust the weight ratio between intermediate data and target data in the detection score calculation. This parameter can be calculated through indicator volatility. Its function is to adaptively balance the influence of different data sources based on real-time changes in the system's operating status. The first parameter is a weight coefficient that complements the adjusted sensitivity parameter. Specifically, it can be numerically calculated so that the sum of the two equals 1. Its function is to ensure that the weight distribution during the detection score calculation process remains normalized.

[0048] The detection score can be obtained by the following formula:

[0049] in, For indicator data, is the intermediate data, is the target data, α is the adjusted sensitivity parameter, and 1-α is the first parameter.

[0050] This solution achieves real-time adjustment of weight distribution by introducing a sensitivity parameter and a complementary first parameter, combined with the data difference generated by the two encoding and decoding operations, so that the anomaly detection process can automatically optimize the judgment basis for different fluctuation scenarios.

[0051] Through the above technical solution, the present application solves the problem of false alarm or missed alarm caused by rigid parameter settings in the existing technology. By dynamically adjusting the weight ratio of intermediate data and target data, the detection score can more accurately reflect the degree of abnormality of the system operation status, thereby improving the reliability of the abnormality detection results.

[0052] In an optional embodiment, if Figure 5 As shown, Figure 5 An optional method embodiment of a system detection result of a target system at a current moment provided by an exemplary embodiment of the present application includes the following steps: Step S501: If the comparison result shows that the detection score is greater than or equal to the anomaly detection threshold of the target system at the current moment, then the system context information data of the target system at the current moment is obtained; Among them, system context information data refers to auxiliary data related to the current status generated during the operation of the target system. It is used to supplement the operating status information other than the indicator data and reduce misjudgments caused by fluctuations in a single indicator. For example, it includes system logs, process status, resource utilization or network traffic data.

[0053] Step S502: inputting the system context information data into the decision tree model to obtain confidence; The decision tree model is a machine learning model based on a tree structure for data classification, and is used to generate the reliability of the abnormality judgment according to the context information data. For example, ID3, C4.5 or CART algorithm is used for training, and after training, it can be stored in the memory address corresponding to the service device. When further detection of the target system is needed, it can be obtained from the corresponding memory address.

[0054] The confidence degree refers to the probability value of the decision tree model for determining whether the current system state is abnormal, and is used to quantify the reliability of the abnormality judgment. For example, it can be obtained by calculating the classification probability or normalized score output by the model.

[0055] In step S503, if the confidence degree is greater than or equal to the decision threshold, it is determined that the system detection result of the target system at the current time is abnormal. The decision threshold refers to a critical probability value for determining abnormality, which can be set by historical normal data statistics or empirical value, and is used to filter low-confidence abnormality judgment results.

[0056] In step S504, if the comparison result is that the detection score is less than the abnormality detection threshold of the target system at the current time, it is determined that the system detection result of the target system at the current time is normal.

[0057] For example, when the detection score exceeds the abnormality detection threshold, the system context information data is extracted and input into the decision tree model, which generates a confidence degree in combination with the operating state features other than the index data. If the confidence degree reaches the decision threshold, the system is confirmed to be abnormal; if it does not reach, it can be excluded. When the detection score is lower than the abnormality detection threshold, the system is directly determined to be normal. This process reduces the risk of false positives by introducing a secondary verification mechanism of context information.

[0058] Compared with the prior art, the existing method usually only relies on the direct comparison of the detection score and the threshold, without considering the dynamic interference factors of the system operating environment, such as temporary resource occupation or temporary network fluctuation, which may cause false positives. However, in the present scheme, when the detection score is abnormal, the joint analysis of the context information and the decision tree model expands the abnormality judgment from a single dimension to multi-dimensional data verification, effectively distinguishing between real abnormalities and noise interference.

[0059] Through the above technical solutions, the present application can reduce the false positive problem caused by training data bias or transient fluctuation, and avoid the false negative risk caused by unreasonable model parameter setting. By introducing a secondary verification mechanism of context information, the reliability of the abnormality detection result is improved, and the accuracy of the system state judgment is ensured.

[0060] Optionally, the abnormality detection threshold of the present application can be updated according to the detection score when the system detection result is normal, so as to reduce the risk of misjudgment caused by threshold rigidity. It can be understood that if the system detection result is abnormal at this time, the present application stops updating the abnormality detection threshold, and continues to update the abnormality detection threshold according to the detection score when the system detection result is normal until the system detection result is normal for n times, where n is greater than or equal to 100.

[0061] In an optional embodiment, as shown in Figure 6 Figure 6 An optional method embodiment for updating the abnormality detection threshold provided by an exemplary embodiment of the present application includes the following steps: Step S601, determining a first mean value according to a second parameter, a third parameter, a historical mean value corresponding to the abnormality detection threshold, and a detection score of the index data, wherein the sum of the second parameter and the third parameter is 1; Wherein, the second parameter refers to the weight of historical data in mean value calculation, for example, exponential decay method can be used to achieve, for balancing the influence of historical data on the current threshold. The third parameter refers to the weight of the current detection score in the mean value calculation, for example, a dynamic adjustment strategy can be used to achieve, for reflecting the real-time change of the current system state. The historical mean value refers to the average value of the abnormality detection threshold at multiple time points in the past, which can be calculated by sliding window method, for maintaining the stability of the threshold.

[0062] For example, the first mean value can be calculated according to the following formula:

[0063] β is the second parameter, 1-β is the third parameter, μ_t-1 is the historical mean value corresponding to the abnormality detection threshold, and Score_t is the detection score.

[0064] If β is 0.99, μ_t-1 is 0.5, and Score_t is 0.6, then μ_t = 0.99 × 0.5 + 0.01 × 0.6 = 0.501.

[0065] Step S602, determining a first standard deviation according to the second parameter, the third parameter, the historical standard deviation corresponding to the abnormality detection threshold, the detection score of the index data and the first mean value; ​The historical standard deviation refers to the fluctuation degree of the anomaly detection threshold at a plurality of time points in the past, and can be obtained by calculating the variance and taking the square root, for quantifying the historical fluctuation range of the threshold. The first mean value refers to a new mean value calculated in combination with the historical mean value and the current detection score, and can be realized by using the weighted average method, for dynamically adjusting the base value of the threshold. The first standard deviation refers to a new standard deviation calculated in combination with the historical standard deviation and the current detection score, and can be realized by calculating the weighted variance and taking the square root, for reflecting the latest fluctuation of the threshold.

[0066] For example, the square of the first standard deviation can be calculated according to the following formula, and the first standard deviation can be calculated by taking the square root:

[0067] σ²_t = 0.99 × 0.1² + 0.01 × (0.6 - 0.501)² ≈ 0.0099 σ_t = √0.0099 ≈ 0.0995 In step S603, the anomaly detection threshold is updated according to the sum of the first mean value and the product of the preset coefficient and the first standard deviation.

[0068] The preset coefficient refers to the amplification multiple of the standard deviation in the threshold updating, and can be determined according to an empirical value or experimental optimization, for controlling the sensitivity of the threshold to the fluctuation, for example, 0.3.

[0069] The new anomaly detection threshold can be calculated according to the following formula:

[0070] k is the preset coefficient. θ_t = 0.501 + 3 × 0.0995 ≈ 0.7995.

[0071] The scheme introduces the calculation of weighted mean value and standard deviation, combines historical data and real-time detection score, so that the threshold can be adaptively adjusted, and stability and sensitivity are considered, so that the actual state of the system can be more accurately reflected.

[0072] Through the above technical scheme, the dynamic optimization of the anomaly detection threshold is realized, and the false alarm or missed alarm problem caused by unreasonable parameter setting in the traditional method is solved. By fusing historical statistical features and real-time detection results, the threshold updating process can automatically adapt to the fluctuation of the system index, while ensuring the stability of the detection, the sensitivity is improved, and the risk of misjudgment is effectively reduced.

[0073] In an optional embodiment, as shown in Figure 7 Figure 7 ​An optional method embodiment for training a target model is provided for an exemplary embodiment of the present application, and the method embodiment comprises the following steps: In step S701, historical index data of the target system is obtained as sample data. In step S702, the sample data is input into the first sub-model to perform feature data extraction operation on the sample data under normal operation state of the target system, and first reconstruction data is output. In step S703, the sample data is input into the second sub-model to perform feature data extraction operation on the sample data under abnormal operation state of the target system, and second reconstruction data is output. In step S704, the first reconstruction data is input into the second sub-model to perform feature data extraction operation on the first reconstruction data under abnormal operation state of the target system, and third reconstruction data is output. In step S705, the first loss function of the first sub-model and the second loss function of the second sub-model are calculated based on the first reconstruction data, the second reconstruction data and the third reconstruction data, and the model training operation is stopped until the first loss function and the second loss function do not decrease for n consecutive rounds, and the target model is obtained, where n is greater than or equal to 5.

[0074] The sample data is historical index data when the target system is in normal operation.

[0075] The training of the target model includes two processes: a pre-training process and an adversarial training process. The purpose of the pre-training process is to minimize the reconstruction error. The purpose of the adversarial training process is to maximize the difference between the reconstruction data and the original data.

[0076] The first sub-model can include an encoder and a decoder. In order to distinguish from the second sub-model, we call the encoder and the decoder of the first sub-model as the first encoder and the first decoder. The second sub-model can include a second encoder and a second decoder.

[0077] If the first encoder and the second encoder are the same, the architecture of the first encoder and the second encoder is, for example, that the input layer is data of T time points of n indexes, with a dimension of [T, n]; the first hidden layer contains 128 neurons, with a ReLU activation function; the second hidden layer contains 64 neurons, with a ReLU activation function; and the latent space layer contains 32 neurons, without an activation function.

[0078] The first encoder is used for normal feature reconstruction, and the architecture thereof is, for example, that the input layer is a latent space vector, with a dimension of 32; the first hidden layer contains 64 neurons, with a ReLU activation function; the second hidden layer contains 128 neurons, with a ReLU activation function; and the output layer is data of T time points of n indexes, with a dimension of [T, n], without an activation function.

[0079] The second encoder is used for abnormal feature reconstruction, and the architecture is, for example: the input layer is a latent space vector with a dimension of 32; the first hidden layer contains 64 neurons, and the activation function is ReLU; the second hidden layer contains 128 neurons, and the activation function is ReLU; the output layer is T time point data of n indicators, with a dimension of [T, n], and without an activation function. The architecture is the same as that of the first encoder, but the parameters are not shared.

[0080] During training, the present application can input sample data into the first sub-model to perform feature data extraction operation in the normal running state of the target system and obtain first reconstruction data; and input the sample data into the second sub-model to perform feature data extraction operation in the abnormal running state of the target system and obtain second reconstruction data. Further, the present application also inputs the first reconstruction data into the second sub-model to perform feature data extraction operation in the abnormal running state of the target system and outputs third reconstruction data.

[0081] Then, the loss function of the first sub-model is as follows:

[0082] Then, the loss function of the second sub-model is as follows:

[0083] wherein, is the sample data, is the first reconstruction data, is the second reconstruction data, is the third reconstruction data, n is a balance parameter for adjusting the proportion of reconstruction error and adversarial loss, the gradient is calculated during training, the model parameters are updated, and the above steps are repeated for multiple rounds until the first loss function and the second loss function do not decrease for n consecutive rounds, then the model training operation is stopped, the target model is obtained, and n is greater than or equal to 5.

[0084] Through the training of the two stages, the model can learn the normal features and abnormal features of the indicator data at the same time, so as to more accurately identify abnormal conditions in actual detection.

[0085] The present application introduces a double model interaction training mechanism, forces the model to learn data features from different angles, and simultaneously uses a secondary reconstruction process to enhance feature expression capability. This training method effectively avoids the feature omission problem caused by insufficient model capacity or insufficient training in traditional methods, and provides a more reliable feature representation basis for subsequent anomaly detection.

[0086] By the technical solution, the feature learning capability of the model for the normal operation state of the system can be improved, so that the model can more accurately identify abnormal data deviating from the normal mode in the detection stage. Through the double-model collaborative training mechanism, the fitting capability of the model for complex data distribution is enhanced, thereby reducing the false positive or false negative risk caused by insufficient feature learning. Meanwhile, the introduction of the dynamic early stopping strategy effectively controls the convergence state of the model training process, avoiding the decline of detection performance caused by overfitting.

[0087] It should be noted that, although the operations of the method of the present application are described in a specific order in the accompanying drawings, this does not require or imply that the operations must be performed in that specific order, or that all of the shown operations must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart can change the order of execution.

[0088] Further reference is made to Figure 8 which shows an exemplary structural block diagram of a system detection apparatus 800 according to an embodiment of the present application, the system detection apparatus 800 comprising an acquisition module 801, an input processing module 802, a determination module 803 and a determination comparison module 804.

[0089] The acquisition module 801 is configured to acquire index data of the target system running at the current time. The input processing module 802 is configured to input the index data into a target model to extract feature data of the index data under the normal operation state of the target system as intermediate data, and extract feature data of the intermediate data under the abnormal operation state of the target system as target data. The determination module 803 is configured to determine a sensitivity parameter according to the index volatility of the target system at the current time, the sensitivity parameter being used to adjust the proportion of the intermediate data and the target data. The determination comparison module 804 is configured to determine a detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data, compare the detection score with an abnormal detection threshold value of the target system at the current time, and determine a system detection result of the target system at the current time based on the comparison result.

[0090] In an optional embodiment, the determination module 803 is specifically configured to calculate a coefficient of variation of each index data according to the standard deviation and the mean value of each index data. The index volatility of the target system at the current time is determined according to the mean value of the coefficient of variation of each index data. The sensitivity parameter is determined according to the index volatility of the target system at the current time, a reference sensitivity parameter, a preset adjustment intensity and a volatility threshold value.

[0091] In an optional embodiment, the determining module 804 is specifically configured to determine a first Euclidean norm distance between the index data and the intermediate data, and a second Euclidean norm distance between the index data and the target data; The product of the adjusted sensitivity parameter and the first Euclidean norm distance is added with a product of a first parameter, and a sum of the first parameter and the adjusted sensitivity parameter is 1, to obtain the detection score.

[0092] In an optional embodiment, the determining module 804 is further configured to, if the comparison result is that the detection score is greater than or equal to an anomaly detection threshold of a current time of the target system, acquire system context information data of the current time of the target system; The system context information data is input into a decision tree model to obtain a confidence level; If the confidence level is greater than or equal to a decision threshold, it is determined that a system detection result of the current time of the target system is abnormal; If the comparison result is that the detection score is less than the anomaly detection threshold of the current time of the target system, it is determined that the system detection result of the current time of the target system is normal.

[0093] In an optional embodiment, the method further includes an updating module configured to, if it is determined that the system detection result of the current time of the target system is normal, update the anomaly detection threshold according to the detection score of the index data.

[0094] In an optional embodiment, the updating module is specifically configured to determine a first mean value according to a second parameter, a third parameter, a historical mean value corresponding to the anomaly detection threshold, and the detection score of the index data, wherein a sum of the second parameter and the third parameter is 1. determine a first standard deviation according to the second parameter, the third parameter, a historical standard deviation corresponding to the anomaly detection threshold, the detection score of the index data, and the first mean value. update the anomaly detection threshold according to a sum of the first mean value and a product of a preset coefficient and the first standard deviation.

[0095] In an optional embodiment, the method further includes a training module configured to acquire historical index data of the target system as sample data. perform feature data extraction operation on the sample data in a normal operation state of the target system, and output first reconstruction data. perform feature data extraction operation on the sample data in an abnormal operation state of the target system, and output second reconstruction data. The first reconstruction data is input into the second sub-model to perform feature data extraction operation on the first reconstruction data in the target system abnormal running state, and third reconstruction data is output; The first loss function of the first sub-model and the second loss function of the second sub-model are calculated based on the first reconstruction data, the second reconstruction data and the third reconstruction data, and the model training operation is stopped until the first loss function and the second loss function do not decrease for n consecutive rounds, and the target model is obtained, n is greater than or equal to 5.

[0096] It should be understood that the units or modules described in the system detection apparatus 800 correspond to the respective steps in the method described above. Therefore, the operations and features described above for the method also apply to the system detection apparatus 800 and the units contained therein, and will not be described here again. The system detection apparatus 800 can be pre- implemented in a browser or other security application of an electronic device, or can be loaded into the browser or security application of the electronic device by downloading or the like. The corresponding units in the system detection apparatus 800 can cooperate with the units in the electronic device to implement the solutions of the embodiments of the present application. Figure 2 The operations and features described above for the method also apply to the system detection apparatus 800 and the units contained therein, and will not be described here again. The system detection apparatus 800 can be pre- implemented in a browser or other security application of an electronic device, or can be loaded into the browser or security application of the electronic device by downloading or the like. The corresponding units in the system detection apparatus 800 can cooperate with the units in the electronic device to implement the solutions of the embodiments of the present application.

[0097] As another aspect, the present application also provides a computer readable storage medium, which can be the computer readable storage medium contained in the apparatus described in the above embodiments; or can exist separately and not be assembled into the device. The computer readable storage medium stores one or more programs, which are executed by one or more processors to perform the system detection method described in the present application.

[0098] In one embodiment, a computer program product is provided, which includes a computer program that is executed by a processor to implement the above system detection method.

[0099] The above description is merely preferred embodiments of the present application and a description of the principles of the applied technology. Those skilled in the art should understand that the scope of the application involved in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or equivalent features without departing from the inventive concept. For example, the above features can be replaced with technical features disclosed in the present application (but not limited to) having similar functions to form technical solutions.

Claims

1. A system detection method, characterized in that: The method comprises: Obtaining indicator data for monitoring the current operation of the target system; Inputting the indicator data into a target model to extract characteristic data of the indicator data when the target system is in a normal operating state as intermediate data; and extracting characteristic data of the intermediate data when the target system is in an abnormal operating state as target data; Determining a sensitivity parameter according to the indicator volatility of the target system at a current moment, wherein the sensitivity parameter is used to adjust the proportion of the intermediate data and the target data; The detection score of the indicator data is determined according to the adjusted sensitivity parameter, the indicator data, the intermediate data and the target data, the detection score is compared with the abnormality detection threshold of the target system at the current moment, and the system detection result of the target system at the current moment is determined based on the comparison result.

2. The method according to claim 1, characterized in that The indicator data includes a plurality of items, and the sensitivity parameter is determined according to the indicator volatility of the target system at the current moment, including: Calculate the coefficient of variation of each indicator data based on the standard deviation and mean of each indicator data; Determining the indicator volatility of the target system at the current moment according to the mean of the coefficient of variation of each indicator data; The sensitivity parameter is determined according to the indicator volatility of the target system at the current moment, a baseline sensitivity parameter, a preset adjustment intensity, and a fluctuation threshold.

3. The method according to claim 2, characterized in that The determining the detection score of the indicator data according to the adjusted sensitivity parameter, the indicator data, the intermediate data, and the target data includes: determining a first Euclidean norm distance between the indicator data and the intermediate data, and a second Euclidean norm distance between the indicator data and the target data; The detection score is obtained by summing the product of the adjusted sensitivity parameter and the first Euclidean norm distance and the product of the first parameter, where the sum of the first parameter and the adjusted sensitivity parameter is 1.

4. The method according to claim 1, wherein Determining the system detection result of the target system at the current moment based on the comparison result includes: If the comparison result is that the detection score is greater than or equal to the abnormality detection threshold of the target system at the current moment, obtaining the system context information data of the target system at the current moment; Inputting the system context information data into a decision tree model to obtain confidence; If the confidence level is greater than or equal to the decision threshold, determining that the system detection result of the target system at the current moment is abnormal; If the comparison result is that the detection score is less than the abnormality detection threshold of the target system at the current moment, it is determined that the system detection result of the target system at the current moment is normal.

5. The method according to claim 4, characterized in that The method further comprises: If it is determined that the system detection result of the target system at the current moment is normal, the abnormality detection threshold is updated according to the detection score of the indicator data.

6. The method according to claim 5, characterized in that The updating of the anomaly detection threshold according to the detection score of the indicator data includes: determining a first mean value based on the second parameter, the third parameter, the historical mean value corresponding to the anomaly detection threshold, and the detection score of the indicator data, where the sum of the second parameter and the third parameter is 1; determining a first standard deviation based on the second parameter, the third parameter, the historical standard deviation corresponding to the anomaly detection threshold, the detection score of the indicator data, and the first mean; The abnormality detection threshold is updated according to the sum of the first mean value, a product of a preset coefficient and the first standard deviation.

7. The method according to claim 1, characterized in that The target model includes a first sub-model and a second sub-model, and the method further includes the step of training the target model: Obtaining historical indicator data of the target system as sample data; Inputting the sample data into the first sub-model, performing a feature data extraction operation on the sample data under the normal operating state of the target system, and outputting first reconstructed data; Inputting the sample data into the second sub-model, performing a feature data extraction operation on the sample data in the abnormal operation state of the target system, and outputting second reconstructed data; Inputting the first reconstructed data into the second sub-model, performing a feature data extraction operation on the first reconstructed data in the abnormal operation state of the target system, and outputting third reconstructed data; Based on the first reconstructed data, the second reconstructed data and the third reconstructed data, the first loss function of the first sub-model and the second loss function of the second sub-model are calculated until the first loss function and the second loss function do not decrease for n consecutive rounds, then the model training operation is stopped to obtain the target model, where n is greater than or equal to 5.

8. A system detection device, characterized in that: The device comprises: An acquisition module is used to acquire indicator data for monitoring the current operation of the target system; An input processing module inputs the indicator data into a target model to extract characteristic data of the indicator data when the target system is in a normal operating state as intermediate data; and extracts characteristic data of the intermediate data when the target system is in an abnormal operating state as target data; a determination module, configured to determine a sensitivity parameter according to the indicator volatility of the target system at a current moment, wherein the sensitivity parameter is used to adjust the proportion of the intermediate data and the target data; Determine a comparison module, which is used to determine the detection score of the indicator data based on the adjusted sensitivity parameter, the indicator data, the intermediate data and the target data, compare the detection score with the anomaly detection threshold of the target system at the current moment, and determine the system detection result of the target system at the current moment based on the comparison result.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images