A system detection method, storage medium and computer program product

Abstract

The application discloses a system detection method, a storage medium and a computer program product. The method obtains index data, inputs the index data into a target model, performs feature data extraction operation under a normal operation state of the target system and feature data extraction operation under an abnormal operation state of the target system, and thus obtains multi-level features. In addition, the application determines a sensitivity parameter according to index fluctuation of the target system at a current time, adjusts the influence proportion of intermediate data and target data on a detection result in real time according to the sensitivity parameter, and effectively adapts to dynamic fluctuation characteristics of system indexes. Finally, after determining a detection score according to the index data, the intermediate data and the target data, the application determines a detection result of the target system in combination with an abnormal detection threshold matched with the target system at the current time, so that the technical effects of reducing false positive rate and false negative rate, improving accuracy and reliability of fault detection are achieved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of system resource monitoring, and particularly to a system detection method, a storage medium and a computer program product. BACKGROUND

[0002] In today's digital and intelligent era, more and more businesses rely on stable computer systems to operate normally, so monitoring computer systems is a crucial task to ensure stable and efficient system operation.

[0003] Currently, the monitoring of computer systems relies on a model for detecting anomalies using deep learning methods, but the existing model may have false positives or false negatives due to unreasonable training and prediction parameter settings. SUMMARY

[0004] In view of the above defects or deficiencies in the prior art, it is desirable to provide a system detection method, a storage medium and a computer program product that can improve system anomaly detection accuracy and adaptability.

[0005] The first aspect provides a system detection method, the method comprising:

[0006] obtaining index data of the target system running at the current time;

[0007] inputting the index data into a target model to extract feature data of the index data under normal operation of the target system as intermediate data, and extracting feature data of the intermediate data under abnormal operation of the target system as target data;

[0008] determining a sensitivity parameter according to the index volatility of the target system at the current time, the sensitivity parameter being used to adjust the proportion of the intermediate data and the target data;

[0009] determining a detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data, comparing the detection score with an anomaly detection threshold of the target system at the current time, and determining a system detection result of the target system at the current time based on the comparison result.

[0010] The system detection method provided in the application considers that the monitoring of the computer system depends on a model for detecting abnormalities by using a deep learning method, but the existing model is prone to false positives or false negatives. The system detection method provided in the application obtains index data of a monitored target system running at a current time, and inputs the index data into a target model to perform feature data extraction operation in a normal operation state of the target system and feature data extraction operation in an abnormal operation state of the target system, thereby obtaining multi-level features. In addition, before determining a detection result according to the index data, intermediate data and target data, the application determines a sensitivity parameter according to index fluctuation of the target system at the current time, so as to adjust the influence proportion of the intermediate data and the target data on the detection result in real time according to the sensitivity parameter, and effectively adapt to the dynamic fluctuation characteristics of the system index. Finally, after determining a detection score according to the index data, the intermediate data and the target data, the application further determines a detection result of the target system in combination with an abnormal detection threshold value matched with the target system at the current time, thereby achieving the technical effects of reducing false positive rate and false negative rate, and improving accuracy and reliability of fault detection.

[0011] The second aspect provides a system detection device, and the device comprises:

[0012] An acquisition module is configured to acquire index data of a monitored target system running at a current time;

[0013] An input processing module is configured to input the index data into a target model to extract feature data of the index data in a normal operation state of the target system as intermediate data, and extract feature data of the intermediate data in an abnormal operation state of the target system as target data;

[0014] A determination module is configured to determine a sensitivity parameter according to index fluctuation of the target system at the current time, and the sensitivity parameter is used to adjust the proportion of the intermediate data and the target data;

[0015] A determination and comparison module is configured to determine a detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data, compare the detection score with an abnormal detection threshold value of the target system at the current time, and determine a system detection result of the target system at the current time based on a comparison result.

[0016] The third aspect provides a computer readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the method of the first aspect.

[0017] The fourth aspect provides a computer program product comprising a computer program, and the computer program is executed by a processor to implement the method of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0018] Other features, objects, and advantages of the application will become more apparent from the following detailed description when read in connection with the following drawings:

[0019] Figure 1 An application scenario diagram of a system detection method provided by the application;

[0020] Figure 2 A step flowchart of a system detection method provided by the application;

[0021] Figure 3 A step flowchart of a system detection method provided by the application;

[0022] Figure 4 A step flowchart of a system detection method provided by the application;

[0023] Figure 5 A step flowchart of a system detection method provided by the application;

[0024] Figure 6 A step flowchart of a system detection method provided by the application;

[0025] Figure 7 A step flowchart of a system detection method provided by the application;

[0026] Figure 8 A structure block diagram of a system detection device provided by the application. DETAILED DESCRIPTION

[0027] The application will be further described below in conjunction with the drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the related application, and not to limit the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for ease of description.

[0028] It should be noted that the embodiments in the application and the features in the embodiments can be combined with each other without conflict. The application will be described in detail below with reference to the drawings and in conjunction with the embodiments.

[0029] In the prior art, computer system monitoring mainly relies on deep learning models for anomaly detection. Traditional methods usually reconstruct input data using a single encoding-decoding structure, and determine anomalies by comparing the differences between the original data and the reconstructed data. However, the system operating environment changes dynamically, and the fluctuation characteristics of index data differ significantly at different times. Models with fixed parameter settings are difficult to adapt to such dynamic characteristics, and are prone to false positives during low fluctuation periods and false negatives during high fluctuation periods, resulting in reduced reliability of detection results. For example, in the load monitoring scenario of a cloud computing platform, the traffic fluctuation amplitude difference between peak business hours and idle hours can be tens of times, and traditional static threshold methods cannot effectively distinguish between normal fluctuations and abnormal behavior.

[0030] To solve the above problems, a mechanism capable of self-adaptively adjusting the detection strategy needs to be designed. Considering that the volatility of system indicators directly affects the difficulty of anomaly determination, the applicant realizes that a dynamic parameter adjustment mechanism should be established. By analyzing the statistical characteristics of the index data, the fluctuation degree at the current time is quantified, and then the attention of the detection model to different levels of features is dynamically adjusted. This adjustment needs to consider the relationship between the original data, intermediate features, and final reconstruction results, to avoid the bias caused by single feature judgment. After multiple experimental verifications, using a two-stage encoding-decoding structure with adjustable fusion weights can effectively balance the contributions of different levels of features.

[0031] Please refer to Figure 1 , Figure 1 An application scenario diagram of a system detection method provided by the present application is provided, which includes a terminal device 100 and a service device 200. The terminal device 100 stores various running indicators of the target system at each time, such as CPU usage, memory usage, disk IO waiting time, network request delay, system load, process state, etc.

[0032] The service device 200 stores a target model. When it is determined that the target system needs to be detected, the service device 200 obtains the index data of the target system running at the current time from the terminal device 100, and inputs the obtained running indicators into the target model for system detection. The terminal device 100 is, for example, a notebook computer, a desktop computer, a tablet computer, a wearable device, etc. The service device 200 is, for example, a single server or a server cluster.

[0033] Next, the system detection method provided by the present application will be described in combination with Figure 2 The service device 200 in Figure 1 The method comprises the following steps:

[0034] Step S20, obtaining index data of a monitoring target system running at the current time;

[0035] The target system running at the current time can be obtained by the terminal device from the terminal device, and the terminal device can be obtained according to a predetermined collection rule, for example, collecting once every 30 seconds. For example, the terminal device can collect the target system running at the current time using the ebpf technology.

[0036] The target system running at the current time reflects the time series measurement value of the system running state; for example, the index data includes CPU usage, memory usage, disk IO, network traffic, system load, process state, etc. It should be noted that when the target system is running, the terminal device can continuously collect the target system running index data.

[0037] The present application provides more comprehensive state information for the target system running by collecting multiple types of data. Using the ebpf technology for data collection, compared with the traditional collection method, ebpf has lower system overhead and higher efficiency. In addition, the present application sets the corresponding collection frequency for data collection, avoiding the additional burden caused by too frequent collection on the system.

[0038] For example, assuming that the system detection system terminal device or service device is deployed on a Linux server, the service device or terminal device can use the ebpf technology to collect the following data every 30 seconds:

[0039] 1. CPU usage: - user: 80% - system: 15% - iowait: 3% - idle: 2%

[0040] 2. Memory usage: - used: 70% - free: 10% - cache: 15% - buffer: 5%

[0041] 3. Disk IO: - read IOPS: 1000 - write IOPS: 500 - await time: 5ms

[0042] 4. Network traffic: - rx packets: 10000 / s - tx packets: 8000 / s - errors: 0

[0043] 5. System load: - load: 4.5

[0044] 6. Process status: - running: 10 - sleep: 200 - uninterruptible sleep: 2 -stop: 0 - zombie: 0.

[0045] The index data will be input into the target model, which can be used to determine whether the system is in an abnormal state.

[0046] In step S30, the index data is input into the target model to extract the characteristic data of the target system in the normal state as intermediate data, and to extract the characteristic data of the intermediate data in the abnormal state of the target system as target data.

[0047] The target model is pre-trained by the service device and stored in the corresponding memory address. If system detection is needed, the target model is obtained from the corresponding memory address, and the index data of the target system obtained from the terminal device is input into the target model to obtain the output intermediate data and target data.

[0048] The target model can extract the characteristic data of the index data in the normal state of the target system to obtain the intermediate data after enhancing the normal characteristics in the index data, that is, the target model reconstructs the characteristic representation in the normal state from the index data. On the other hand, the target model can extract the characteristic data of the intermediate data in the abnormal state of the target system to obtain the target data after enhancing the abnormal characteristics in the intermediate data, that is, the target model reconstructs the characteristic representation in the abnormal state from the intermediate data.

[0049] As can be seen from the above, the target model can capture the data distribution characteristics in the normal and abnormal states. Therefore, the target model can be a machine learning model with dual feature extraction capability.

[0050] For example, the target model can adopt a deep neural network structure containing parallel feature extraction branches, for example, the target model includes a first encoder, a first decoder, a second encoder, and a second decoder, wherein the first encoder and the first decoder are connected in series and connected in parallel with the second encoder and the second decoder connected in series. It should be noted that the structure of the first encoder and the second encoder can be the same structure, and the parameters can be shared; the structure of the first decoder and the second decoder can also be the same, but since they perform different tasks, the parameters cannot be shared.

[0051] In step S40, the sensitivity parameter is determined according to the index volatility of the target system at the current time, and the sensitivity parameter is used to adjust the proportion of the intermediate data and the target data.

[0052] The sensitivity parameter is a regulating factor for balancing the importance of different levels of features, and is used in the application to balance the fusion proportion of the intermediate data and the target data. The sensitivity parameter in the application is dynamically adjusted according to the index volatility of the target system at the current time. For example, when the index volatility of the target system at the current time is large, the weight of the intermediate data is increased to avoid abnormal feature interference; when the index volatility of the target system at the current time is small, the weight of the target data is increased to focus on the deep influence of abnormal features.

[0053] The index volatility of the target system at the current time can be determined according to the volatility index of different types of indexes, which will be described in detail below, and will not be repeated here.

[0054] In step S50, the detection score of the index data is determined according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data, the detection score is compared with the abnormal detection threshold of the target system at the current time, and the system detection result of the target system at the current time is determined based on the comparison result.

[0055] The adjusted sensitivity parameter, the index data, the intermediate data and the target data are obtained according to the above process, and the normal or abnormal detection score of the index data can be obtained, so as to quantify the evaluation of the abnormal degree of the index data. For example, the detection score can be obtained by calculating the difference distance between the original data and different reconstruction results.

[0056] The abnormal detection threshold is also a threshold matched with the running state of the target system at the current time, and belongs to a dynamically changing quantity. It can be determined according to the detection score of the index data to better adapt to the current running state of the target system.

[0057] The comparison result of comparing the detection score with the abnormal detection threshold of the target system at the current time can include two cases that the detection score is greater than or equal to the abnormal detection threshold and the detection score is less than the abnormal detection threshold. For example, the system detection result of the target system is determined to be abnormal when the comparison result is that the detection score is greater than or equal to the abnormal detection threshold; otherwise, the system detection result of the target system is determined to be normal when the comparison result is that the detection score is less than the abnormal detection threshold.

[0058] The present scheme respectively captures the changes of the surface features and the deep features to enhance the normal and abnormal features of the index data, which is convenient for subsequent identification. The dynamic sensitivity parameter setting enables the model to automatically adjust the feature weight according to the real-time volatility, and this adaptive mechanism effectively solves the problem of unstable performance of the fixed parameter model in the dynamic environment, and avoids misjudgment caused by environmental changes.

[0059] Through the technical solution, the application can automatically optimize the detection strategy according to real-time changes of the system running state. The dynamic adjustment mechanism significantly improves the adaptability of anomaly detection, effectively reduces the false positive rate caused by environmental noise while ensuring high sensitivity to detect potential anomalies. Through multi-level feature fusion, the recognition ability of complex anomaly patterns is enhanced, especially for hidden anomalies with time correlation, more reliable detection is achieved.

[0060] In an optional embodiment, as shown in Figure 3 Figure 3 An optional method embodiment for determining the sensitivity parameter is provided for an exemplary embodiment of the application, and the method embodiment comprises the following steps:

[0061] Step S301, the coefficient of variation of each index data is calculated according to the standard deviation and the mean value of the index data;

[0062] The coefficient of variation is used to measure the relative volatility of different dimension index data; for example, the absolute value of the standard deviation divided by the mean value can be used to achieve it. It should be noted here that different types of index data have different coefficients of variation. For example, the coefficient of variation (CoV) of CPU usage is 0.3, the CoV of memory usage is 0.1, and the CoV of network traffic is 0.4.

[0063] Step S302, the index volatility of the target system at the current time is determined according to the mean value of the coefficient of variation of each index data;

[0064] The index volatility refers to the stability of the overall running state of the target system, and the mean value of the coefficient of variation of each index can be used to achieve it, reflecting the comprehensive volatility of multiple indexes.

[0065] For example, it is calculated by the following formula:

[0066]

[0067] n represents the number of types of index data.

[0068] If the coefficient of variation (CoV) of CPU usage is 0.3, the CoV of memory usage is 0.1, and the CoV of network traffic is 0.4, then the volatility index V = (0.3 + 0.1 + 0.4) / 3 = 0.267.

[0069] Step S303, the sensitivity parameter is determined according to the index volatility of the target system at the current time, the reference sensitivity parameter, the preset adjustment intensity, and the volatility threshold.

[0070] ​The reference sensitivity parameter refers to an initial set sensitivity reference value, which can be a fixed value determined in advance through experiments or experience, and is used as a reference for adjustment. The preset adjustment strength refers to the magnitude of the change of the sensitivity parameter, which can be a proportionality coefficient set according to actual needs, and is used to control the adjustment speed of the sensitivity parameter. The fluctuation threshold refers to a critical value for judging whether the index fluctuation is significant, which can be a value set according to historical data statistics or system operation requirements, and is used to trigger dynamic adjustment of the sensitivity parameter.

[0071] For example, the sensitivity parameter can be determined according to the following formula:

[0072]

[0073] α_base is the reference sensitivity, and the default value is 0.5; γ is the adjustment strength, and the default value is 0.3; V_threshold is the fluctuation threshold, and the default value is 0.2; and the sigmoid function is used to smooth the parameter change. It can be understood that the application can recalculate the volatility index V and the parameter α every 100 time windows (about 16 minutes) in order to better adapt to the current running state of the target system.

[0074] Compared with the prior art, the traditional method usually uses a fixed sensitivity parameter, which cannot adapt to the dynamic change of index fluctuation during system operation. For example, when the system is in a high load state, the index fluctuation may increase significantly, and if a fixed parameter is still used at this time, the detection result will deviate from the actual state. The present scheme introduces the coefficient of variation and a dynamic adjustment mechanism, which can adaptively adjust the parameter according to the real-time fluctuation, so that the detection model remains adaptive under different running states.

[0075] Through the above technical solution, the application can effectively solve the false alarm or missed alarm problem caused by unreasonable parameter setting. By dynamically adjusting the sensitivity parameter, the model can pay more attention to the intermediate data when the system fluctuation is high, and focus on the target data when the fluctuation is low, thereby improving the accuracy of anomaly detection. For example, in the scenario of sudden surge of system traffic, the method can automatically increase the sensitivity parameter to capture potential anomalies in time and avoid response delay caused by fixed parameters.

[0076] In an optional embodiment, as shown in Figure 4 , the method for determining the detection score of the index data provided by the example embodiment of the application includes the following steps: Figure 4

[0077] Step S401, determining the first Euclidean norm distance between the index data and the intermediate data, and the second Euclidean norm distance between the index data and the target data; ​

[0078] Euclidean norm distance refers to the straight-line distance between two data points in a multidimensional space. Specifically, it can be calculated by taking the square root of the sum of the squares of the differences in each dimension of the vector. It is used to quantify the degree of difference between indicator data and intermediate or target data.

[0079] Step S402: Sum the product of the adjusted sensitivity parameter and the first Euclidean norm distance with the product of the first parameter to obtain the detection score. The sum of the first parameter and the adjusted sensitivity parameter is 1.

[0080] The adjusted sensitivity parameter is used to adjust the weight ratio of intermediate data and target data in the detection score calculation. Specifically, it can be obtained through index volatility calculation. Its function is to adaptively balance the influence of different data sources based on real-time changes in the system's operating status. The first parameter refers to the weight coefficient complementary to the adjusted sensitivity parameter. Specifically, it can be numerically calculated so that the sum of the two equals 1. Its function is to ensure that the weight allocation remains normalized throughout the detection score calculation process.

[0081] The test score can be obtained using the following formula:

[0082]

[0083] in, For indicator data, For intermediate data, Here, α is the target data, 1-α is the adjusted sensitivity parameter, and 1-α is the first parameter.

[0084] This solution introduces a sensitivity parameter and a complementary first parameter, and combines the differences in data generated by the two encoding and decoding processes to achieve real-time adjustment of weight allocation, enabling the anomaly detection process to automatically optimize the judgment criteria for different fluctuation scenarios.

[0085] Through the above technical solution, this application solves the problem of false alarms or missed alarms caused by rigid parameter settings in the prior art. By dynamically adjusting the weight ratio of intermediate data and target data, the detection score can more accurately reflect the degree of abnormality in the system's operating status, thereby improving the reliability of the anomaly detection results.

[0086] In an optional embodiment, such as Figure 5 As shown, Figure 5 An optional method embodiment for providing the system detection result of the target system at the current moment, as an exemplary embodiment of this application, includes the following steps:

[0087] Step S501: If the comparison result is that the detection score is greater than or equal to the anomaly detection threshold of the target system at the current time, then obtain the system context information data of the target system at the current time.

[0088] The system context information data refers to auxiliary data related to the current state generated during the operation of the target system, and is used to supplement the operation state information other than the index data, reduce misjudgment caused by single index fluctuation, and for example includes system logs, process states, resource utilization rates, or network traffic data.

[0089] In step S502, the system context information data is input into the decision tree model to obtain a confidence level.

[0090] The decision tree model refers to a machine learning model based on a tree structure for data classification, and is used to generate the reliability of the abnormality judgment according to the context information data. For example, it is trained by using ID3, C4.5, or CART algorithm, and after training, it can be stored in the memory address corresponding to the service device, and when further detection of the target system is needed, it can be obtained from the corresponding memory address.

[0091] The confidence level refers to the probability value of the decision tree model for determining whether the current system state is abnormal, and is used to quantify the reliability of the abnormality judgment, for example, which can be calculated by the classification probability or normalized score output by the model.

[0092] In step S503, if the confidence level is greater than or equal to a decision threshold, it is determined that the system detection result of the target system at the current time is abnormal.

[0093] The decision threshold refers to a critical probability value for determining abnormality, which can be set by historical normal data statistics or empirical values, and is used to filter low-confidence abnormality judgment results.

[0094] In step S504, if the comparison result is that the detection score is less than the abnormality detection threshold of the target system at the current time, it is determined that the system detection result of the target system at the current time is normal.

[0095] For example, when the detection score exceeds the abnormality detection threshold, the system context information data is extracted and input into the decision tree model, which generates a confidence level in combination with the operation state features other than the index data. If the confidence level reaches the decision threshold, the system is confirmed to be abnormal; if it does not reach, it can be excluded from false positives. When the detection score is lower than the abnormality detection threshold, the system is directly determined to be normal. This process reduces the risk of misjudgment of the single detection score by introducing a secondary verification mechanism of the context information.

[0096] Compared with the prior art, the existing method usually only relies on the direct comparison of the detection score with a threshold value, without considering the dynamic interference factors of the system operating environment, such as temporary resource occupation or temporary network fluctuation, which may cause misjudgment. However, in the present scheme, when the detection score is abnormal, the abnormality is judged from a single dimension to multi-dimensional data verification through the joint analysis of the context information and the decision tree model, effectively distinguishing the real abnormality from the noise interference.

[0097] Through the above technical solution, the present application can reduce the false alarm problem caused by training data bias or transient fluctuation, and avoid the missed alarm risk caused by unreasonable model parameter setting. By introducing the secondary verification mechanism of context information, the reliability of the abnormality detection result is improved, and the accuracy of the system state judgment is ensured.

[0098] Optionally, the abnormality detection threshold value of the present application can be updated according to the detection score when the system detection result is normal each time, so as to reduce the misjudgment risk caused by the rigidity of the threshold value. It can be understood that if the system detection result is abnormal at this time, the present application stops updating the abnormality detection threshold value, and continues to update the abnormality detection threshold value according to the detection score when the system detection result is normal until the system detection result is normal for n consecutive times, wherein n is greater than or equal to 100.

[0099] In an optional embodiment, as shown in Figure 6 , an optional method embodiment for updating the abnormality detection threshold value provided by an exemplary embodiment of the present application includes the following steps: Figure 6 Step S601, determining a first mean value according to a second parameter, a third parameter, a historical mean value corresponding to the abnormality detection threshold value, and a detection score of the index data, wherein the sum of the second parameter and the third parameter is 1;

[0100] Among them, the second parameter refers to the weight of the historical data in the mean value calculation, for example, an exponential decay method can be used to realize it, which is used to balance the influence of the historical data on the current threshold value. The third parameter refers to the weight of the current detection score in the mean value calculation, for example, a dynamic adjustment strategy can be used to realize it, which is used to reflect the real-time change of the current system state. The historical mean value refers to the average value of the abnormality detection threshold value at multiple time points in the past, which can be calculated by using a sliding window method, and is used to maintain the stability of the threshold value.

[0101] Exemplarily, the first mean value can be calculated according to the following formula:

[0102]

[0103]

[0104] ​β is a second parameter, 1-β is a third parameter, μ_t-1 is a historical mean value corresponding to the anomaly detection threshold, and Score_t is a detection score.

[0105] If β is 0.99, μ_t-1 is 0.5, and Score_t is 0.6, then μ_t = 0.99 × 0.5 + 0.01 × 0.6 = 0.501.

[0106] In step S602, a first standard deviation is determined according to the second parameter, the third parameter, a historical standard deviation corresponding to the anomaly detection threshold, the detection score of the index data, and the first mean value.

[0107] The historical standard deviation refers to the fluctuation degree of the anomaly detection threshold at a plurality of time points in the past, and can be obtained by calculating the variance and taking the square root, for quantifying the historical fluctuation range of the threshold. The first mean value refers to a new mean value calculated in combination with the historical mean value and the current detection score, and can be realized by using the weighted average method, for dynamically adjusting the base value of the threshold. The first standard deviation refers to a new standard deviation calculated in combination with the historical standard deviation and the current detection score, and can be realized by calculating the weighted variance and taking the square root, for reflecting the latest fluctuation of the threshold.

[0108] For example, the square of the first standard deviation can be calculated according to the following formula, and the first standard deviation can be calculated by taking the square root:

[0109]

[0110] σ²_t = 0.99 × 0.1² + 0.01 × (0.6 - 0.501)² ≈ 0.0099

[0111] σ_t = √0.0099 ≈ 0.0995

[0112] In step S603, the anomaly detection threshold is updated according to the sum of the product of the first mean value and a preset coefficient and the first standard deviation.

[0113] The preset coefficient refers to the amplification multiple of the standard deviation in the threshold update, and can be determined according to an empirical value or experimental optimization, for controlling the sensitivity of the threshold to fluctuations, for example, 0.3.

[0114] The new anomaly detection threshold can be calculated according to the following formula:

[0115]

[0116] k is a preset coefficient. θ_t = 0.501 + 3 × 0.0995 ≈ 0.7995.

[0117] This solution introduces weighted mean and standard deviation calculations, combining historical data with real-time detection scores, enabling the threshold to be adaptively adjusted, balancing stability and sensitivity, thereby more accurately reflecting the actual state of the system.

[0118] Through the above technical solution, this application achieves dynamic optimization of the anomaly detection threshold, solving the problem of false alarms or missed alarms caused by unreasonable parameter settings in traditional methods. By integrating historical statistical features and real-time detection results, the threshold update process can automatically adapt to fluctuations in system indicators, improving sensitivity while ensuring detection stability and effectively reducing the risk of misjudgment.

[0119] In an optional embodiment, such as Figure 7 As shown, Figure 7 An optional method embodiment for training a target model provided in an exemplary embodiment of this application includes the following steps:

[0120] Step S701: Obtain historical indicator data of the target system as sample data;

[0121] Step S702: Input the sample data into the first sub-model to perform feature data extraction operation on the sample data under the normal operating state of the target system, and output the first reconstructed data;

[0122] Step S703: Input the sample data into the second sub-model to perform feature data extraction operation on the sample data under the abnormal operation state of the target system, and output the second reconstructed data;

[0123] Step S704: Input the first reconstructed data into the second sub-model to perform feature data extraction operation on the first reconstructed data under the abnormal operation state of the target system, and output the third reconstructed data.

[0124] Step S705: Calculate the first loss function of the first sub-model and the second loss function of the second sub-model based on the first reconstructed data, the second reconstructed data, and the third reconstructed data. Continue until the first loss function and the second loss function do not decrease for n consecutive rounds, then stop the model training operation and obtain the target model, where n is greater than or equal to 5.

[0125] The sample data consists of historical indicator data of the target system during normal operation.

[0126] Training the target model involves two processes: pre-training and adversarial training. The purpose of pre-training is to minimize the reconstruction error. The purpose of adversarial training is to maximize the difference between the reconstructed data and the original data.

[0127] The first sub-model can include an encoder and a decoder. For the sake of distinguishing from the second sub-model, the encoder and the decoder of the first sub-model are referred to as a first encoder and a first decoder. The second sub-model can include a second encoder and a second decoder.

[0128] If the first encoder and the second encoder are the same, the architecture of the first encoder and the second encoder is, for example, as follows: the input layer is the data of T time points of n indicators, with a dimension of [T, n]; the first hidden layer contains 128 neurons, with a ReLU activation function; the second hidden layer contains 64 neurons, with a ReLU activation function; and the latent space layer contains 32 neurons, without an activation function.

[0129] The first encoder is used for normal feature reconstruction, and the architecture thereof is, for example, as follows: the input layer is a latent space vector, with a dimension of 32; the first hidden layer contains 64 neurons, with a ReLU activation function; the second hidden layer contains 128 neurons, with a ReLU activation function; and the output layer is the data of T time points of n indicators, with a dimension of [T, n], without an activation function.

[0130] The second encoder is used for abnormal feature reconstruction, and the architecture thereof is, for example, as follows: the input layer is a latent space vector, with a dimension of 32; the first hidden layer contains 64 neurons, with a ReLU activation function; the second hidden layer contains 128 neurons, with a ReLU activation function; and the output layer is the data of T time points of n indicators, with a dimension of [T, n], without an activation function. The architecture is the same as that of the first encoder, but the parameters are not shared.

[0131] During training, the application can input sample data into the first sub-model to perform feature data extraction operation under the normal operation state of the target system, to obtain first reconstruction data; and input the sample data into the second sub-model to perform feature data extraction operation under the abnormal operation state of the target system, to obtain second reconstruction data. Further, the application also inputs the first reconstruction data into the second sub-model to perform feature data extraction operation under the abnormal operation state of the target system, to output third reconstruction data.

[0132] Then, the loss function of the first sub-model is as follows:

[0133]

[0134] Then, the loss function of the second sub-model is as follows:

[0135]

[0136] wherein, is the sample data, is the first reconstruction data, is the second reconstruction data, For the third reconstruction data, n is a balance parameter for adjusting the proportion of reconstruction error and adversarial loss, the gradient is calculated during training to update the model parameters, and the above steps are repeated for multiple rounds until the first loss function and the second loss function do not decrease for n consecutive rounds, then the model training operation is stopped, the target model is obtained, and n is greater than or equal to 5.

[0137] Through the training of the two stages, the model can learn the normal features and abnormal features of the index data at the same time, so as to more accurately identify abnormal situations in actual detection.

[0138] And the scheme introduces a double model interactive training mechanism, forces the model to learn data features from different angles, and simultaneously uses a secondary reconstruction process to enhance feature expression capability. This training method effectively avoids the feature omission problem caused by insufficient model capacity or insufficient training in traditional methods, and provides a more reliable feature representation basis for subsequent anomaly detection.

[0139] Through the above technical solutions, the present application can improve the feature learning ability of the model for the normal operation state of the system, so that the model can more accurately identify abnormal data deviating from the normal mode in the detection stage. Through the double model collaborative training mechanism, the fitting ability of the model to complex data distribution is enhanced, thereby reducing the false positive or false negative risk caused by insufficient feature learning. At the same time, the introduction of the dynamic early stopping strategy effectively controls the convergence state of the model training process, avoiding the decline of detection performance caused by overfitting.

[0140] It should be noted that although the operations of the method of the present application are described in a specific order in the accompanying drawings, this does not require or imply that the operations must be performed in that specific order, or that all of the shown operations must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart can change the order of execution.

[0141] Further reference is made to Figure 8 which shows an exemplary structural block diagram of a system detection device 800 according to an embodiment of the present application, which includes an acquisition module 801, an input processing module 802, a determination module 803 and a determination comparison module 804.

[0142] The acquisition module 801 is used to acquire index data running at the current time of the target system;

[0143] The input processing module 802 inputs the index data into the target model to extract feature data of the index data under the normal operation state of the target system as intermediate data, and extracts feature data of the intermediate data under the abnormal operation state of the target system as target data;

[0144] The determining module 803 is configured to determine a sensitivity parameter according to an index fluctuation of the target system at the current time point, the sensitivity parameter being used to adjust proportions of the intermediate data and the target data.

[0145] The determining and comparing module 804 is configured to determine a detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data, and the target data, compare the detection score with an anomaly detection threshold of the target system at the current time point, and determine a system detection result of the target system at the current time point based on a comparison result.

[0146] In an optional embodiment, the determining module 803 is specifically configured to calculate a coefficient of variation of each index data according to a standard deviation and a mean value of each index data.

[0147] The index fluctuation of the target system at the current time point is determined according to a mean value of the coefficient of variation of each index data.

[0148] The sensitivity parameter is determined according to the index fluctuation of the target system at the current time point, a reference sensitivity parameter, a preset adjustment intensity, and a fluctuation threshold.

[0149] In an optional embodiment, the determining and comparing module 804 is specifically configured to determine a first Euclidean norm distance between the index data and the intermediate data, and a second Euclidean norm distance between the index data and the target data.

[0150] A product of the adjusted sensitivity parameter and the first Euclidean norm distance is added with a product of a first parameter, to obtain the detection score, and a sum of the first parameter and the adjusted sensitivity parameter is 1.

[0151] In an optional embodiment, the determining and comparing module 804 is specifically further configured to acquire system context information data of the target system at the current time point if the comparison result is that the detection score is greater than or equal to the anomaly detection threshold of the target system at the current time point.

[0152] The system context information data is input into a decision tree model to obtain a confidence degree.

[0153] If the confidence degree is greater than or equal to a decision threshold, it is determined that the system detection result of the target system at the current time point is abnormal.

[0154] If the comparison result is that the detection score is less than the anomaly detection threshold of the target system at the current time point, it is determined that the system detection result of the target system at the current time point is normal.

[0155] In an optional embodiment, the system further comprises an updating module configured to update the anomaly detection threshold based on the detection score of the index data if it is determined that the system detection result of the target system at the current time is normal.

[0156] In an optional embodiment, the updating module is specifically configured to determine a first mean value based on a second parameter, a third parameter, a historical mean value corresponding to the anomaly detection threshold, and the detection score of the index data, wherein the sum of the second parameter and the third parameter is 1.

[0157] determine a first standard deviation based on the second parameter, the third parameter, a historical standard deviation corresponding to the anomaly detection threshold, the detection score of the index data, and the first mean value.

[0158] update the anomaly detection threshold based on the sum of the first mean value and a product of a preset coefficient and the first standard deviation.

[0159] In an optional embodiment, the system further comprises a training module configured to obtain historical index data of the target system as sample data.

[0160] input the sample data into the first sub-model to perform feature data extraction operation on the sample data under normal operation state of the target system, and output first reconstruction data;

[0161] input the sample data into the second sub-model to perform feature data extraction operation on the sample data under abnormal operation state of the target system, and output second reconstruction data;

[0162] input the first reconstruction data into the second sub-model to perform feature data extraction operation on the first reconstruction data under abnormal operation state of the target system, and output third reconstruction data;

[0163] calculate a first loss function of the first sub-model and a second loss function of the second sub-model based on the first reconstruction data, the second reconstruction data, and the third reconstruction data, and stop the model training operation until the first loss function and the second loss function do not decrease for n consecutive rounds, wherein n is greater than or equal to 5, and obtain the target model.

[0164] It should be understood that the units or modules described in the system detection device 800 are consistent with the units or modules described with reference to the system detection device 700. Figure 2The various steps in the described methods correspond. Thus, the operations and features described above for the method also apply to the system detection apparatus 800 and the units contained therein, which will not be described again. The system detection apparatus 800 can be pre- implemented in the browser or other security application of the electronic device, or can be loaded into the browser or security application of the electronic device by downloading or the like. The corresponding units in the system detection apparatus 800 can cooperate with the units in the electronic device to implement the solutions of the embodiments of the present application.

[0165] As another aspect, the present application also provides a computer readable storage medium, which can be the computer readable storage medium contained in the apparatus described in the above embodiments; or can exist independently and not be assembled into the device. The computer readable storage medium stores one or more programs, which are executed by one or more processors to perform the system detection method described in the present application.

[0166] In one embodiment, a computer program product is provided, which includes a computer program that is executed by a processor to implement the above system detection method.

[0167] The above description is merely preferred embodiments of the present application and a description of the principles of the technology used. Those skilled in the art should understand that the scope of the application involved in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features can be replaced with the technical features disclosed in the present application (but not limited to) having similar functions to form technical solutions.

Claims

1. A system detection method, characterized by, The method comprises: acquiring index data of a monitoring target system running at a current time; inputting the index data into a target model to extract feature data of the index data under a normal running state of the target system as intermediate data, and to extract feature data of the intermediate data under an abnormal running state of the target system as target data; determining a sensitivity parameter according to index fluctuation of the target system at the current time, the sensitivity parameter being used to adjust proportions of the intermediate data and the target data; the index fluctuation refers to stability of an overall running state of the target system, and is specifically realized by using a mean value of each index variation coefficient to reflect a comprehensive fluctuation degree of multiple indexes; determining a detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data, comparing the detection score with an abnormal detection threshold value of the target system at the current time, and determining a system detection result of the target system at the current time based on a comparison result; wherein the index data comprises multiple, and the determining of the sensitivity parameter according to the index fluctuation of the target system at the current time comprises: calculating a variation coefficient of each index data according to a standard deviation and a mean value of each index data; the variation coefficient is used to measure relative fluctuation of different dimension index data; determining the index fluctuation of the target system at the current time according to a mean value of the variation coefficient of each index data; determining the sensitivity parameter according to the index fluctuation of the target system at the current time, a reference sensitivity parameter, a preset adjustment intensity and a fluctuation threshold value; the determining of the detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data comprises: determining a first Euclidean norm distance between the index data and the intermediate data, and a second Euclidean norm distance between the index data and the target data; summing a product of the adjusted sensitivity parameter and the first Euclidean norm distance with a product of a first parameter and the second Euclidean norm distance to obtain the detection score, the first parameter and the adjusted sensitivity parameter being a sum of 1.

2. The method of claim 1, wherein, the determining of the system detection result of the target system at the current time based on the comparison result comprises: if the comparison result is that the detection score is greater than or equal to the abnormal detection threshold value of the target system at the current time, acquiring system context information data of the target system at the current time; inputting the system context information data into a decision tree model to obtain a confidence degree; if the confidence degree is greater than or equal to a decision threshold value, determining that the system detection result of the target system at the current time is abnormal; if the comparison result is that the detection score is less than the abnormal detection threshold value of the target system at the current time, determining that the system detection result of the target system at the current time is normal.

3. The method of claim 2, wherein, The method further comprises: if it is determined that the system detection result of the target system at the current time is normal, updating the abnormal detection threshold value according to the detection score of the index data.

4. The method of claim 3, wherein, The updating the anomaly detection threshold according to the detection score of the index data comprises: determining a first mean value according to a second parameter, a third parameter, a historical mean value corresponding to the anomaly detection threshold, and the detection score of the index data, wherein the sum of the second parameter and the third parameter is 1; the second parameter refers to the weight of the historical mean value in mean value calculation, and the third parameter refers to the weight of the detection score in mean value calculation; determining a first standard deviation according to the second parameter, the third parameter, a historical standard deviation corresponding to the anomaly detection threshold, the detection score of the index data, and the first mean value; updating the anomaly detection threshold according to the sum of the first mean value and the product of a preset coefficient and the first standard deviation; the preset coefficient refers to the amplification multiple of the standard deviation in threshold updating.

5. The method of claim 1, wherein, The target model comprises a first sub-model and a second sub-model, and the method further comprises the steps of training the target model: obtaining historical index data of the target system as sample data; inputting the sample data into the first sub-model to perform feature data extraction operation on the sample data under the normal operation state of the target system, and outputting first reconstruction data; inputting the sample data into the second sub-model to perform feature data extraction operation on the sample data under the abnormal operation state of the target system, and outputting second reconstruction data; inputting the first reconstruction data into the second sub-model to perform feature data extraction operation on the first reconstruction data under the abnormal operation state of the target system, and outputting third reconstruction data; calculating a first loss function of the first sub-model and a second loss function of the second sub-model based on the first reconstruction data, the second reconstruction data, and the third reconstruction data, and stopping the model training operation until the first loss function and the second loss function do not decrease for n consecutive rounds, thereby obtaining the target model, wherein n is greater than or equal to 5.

6. A system detection apparatus, characterized by, The device comprises: an acquisition module configured to acquire index data of a monitoring target system running at a current time; an input processing module configured to input the index data into a target model to extract feature data of the index data under a normal operation state of the target system as intermediate data, and to extract feature data of the intermediate data under an abnormal operation state of the target system as target data; a determination module configured to determine a sensitivity parameter according to index volatility of the target system at the current time, wherein the sensitivity parameter is used to adjust the proportion of the intermediate data and the target data; the index volatility refers to the stability of the overall operation state of the target system, and is specifically implemented by using the mean value of the coefficient of variation of each index to reflect the comprehensive fluctuation degree of multiple indexes; a determination comparison module configured to determine a detection score of the index data according to the adjusted sensitivity parameter, the index data, the intermediate data, and the target data, to compare the detection score with an anomaly detection threshold of the target system at the current time, and to determine a system detection result of the target system at the current time based on the comparison result. The index data includes a plurality of index data, and the sensitivity parameter is determined according to index fluctuation of the target system at the current time point, including: The coefficient of variation of each index data is calculated according to the standard deviation and the mean value of each index data, and the coefficient of variation is used to measure the relative fluctuation of different dimension index data; The index fluctuation of the target system at the current time point is determined according to the mean value of the coefficient of variation of each index data; The sensitivity parameter is determined according to the index fluctuation of the target system at the current time point, the reference sensitivity parameter, the preset adjustment intensity and the fluctuation threshold; The detection score of the index data is determined according to the adjusted sensitivity parameter, the index data, the intermediate data and the target data, including: The first Euclidean norm distance between the index data and the intermediate data, and the second Euclidean norm distance between the index data and the target data are determined; The product of the adjusted sensitivity parameter and the first Euclidean norm distance is summed with the product of the first parameter and the second Euclidean norm distance, and the detection score is obtained, and the sum of the first parameter and the adjusted sensitivity parameter is 1.

7. A computer-readable storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to realize the steps of the method in any one of claims 1 to 5.

8. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 1 to 5.

Images