Model training, anomaly detection method, device, equipment, medium and product

Abstract

The present disclosure relates to the technical field of network security, and in particular, to a model training and anomaly detection method and device, equipment, medium and product. The method comprises: obtaining a running state sample of a server, wherein the running state sample is running state data collected by the server in a normal running state; performing feature extraction on the running state sample to obtain a feature vector, and performing fitting processing on the feature vector to obtain an observation probability of the feature vector under each preset running state of the server; wherein the observation probability is used to indicate the probability of the feature vector appearing under each preset running state; generating an adversarial sample based on the observation probability, the feature vector and the running state sample; and training a target model based on the running state sample and the adversarial sample to obtain a trained target model. The generated adversarial sample is used to expand the training sample of the model on the basis of the original running state sample, so that the target model can fully fit the actual complex abnormal situation.

Description

Technical Field

[0001] This disclosure relates to the technical field of network security, and more specifically, to a model training, anomaly detection method, apparatus, device, medium, and product. Background Technology

[0002] In bare metal server scenarios, due to the lack of buffering capacity of the virtualization layer, hardware anomalies directly impact business operations. Static thresholds and deep learning models are less adaptable, data dimensions are complex and resource consumption is high, and the disconnect between anomaly detection and resource prediction further exacerbates business risks.

[0003] In related technologies, during the process of collecting training samples, it is often difficult to obtain a complete set of all possible anomalies or the number of anomalies is scarce under certain abnormal states, resulting in insufficient training samples for the model and low accuracy of the anomaly detection process. Summary of the Invention

[0004] This disclosure is made in view of the above-mentioned problems. This disclosure provides a model training, anomaly detection method, apparatus, device, medium, and product.

[0005] According to one aspect of this disclosure, a model training method is provided, comprising:

[0006] Obtain a sample of the server's operating status; wherein, the sample of the operating status is the operating status data collected by the server during normal operation.

[0007] Feature vectors are obtained by extracting features from the running state samples;

[0008] The feature vector is fitted to obtain the observation probability of the feature vector in each preset operating state of the server; wherein the observation probability is used to indicate the probability of the feature vector appearing in each preset operating state;

[0009] Based on the observation probability, the feature vector, and the running state sample, generate adversarial examples;

[0010] The target model is trained based on the running state samples and the adversarial samples to obtain the trained target model.

[0011] Furthermore, according to one aspect of this disclosure, generating adversarial examples based on the observation probability, the feature vector, and the running state sample includes:

[0012] Based on the observation probability and the feature vector, perturbation information of the running state sample is generated, wherein the perturbation information includes the perturbation direction and the amount of perturbation added in each iteration cycle;

[0013] The running state sample is iteratively perturbed based on the perturbation information, and the adversarial sample is determined based on the perturbation result that satisfies the iteration termination condition.

[0014] Furthermore, according to one aspect of this disclosure, generating perturbation information of the operating state sample based on the observation probability and the feature vector includes:

[0015] Within a preset time period, the operating state that appears most frequently among the preset operating states is determined to obtain the target operating state;

[0016] Based on the feature vector and the target operating state, the prediction probability is determined;

[0017] Based on the observed probability and the predicted probability, the perturbation information of the operating state sample is generated.

[0018] Furthermore, determining the prediction probability based on the feature vector and the target operating state according to one aspect of this disclosure includes:

[0019] The model parameters of the target model are adjusted based on the running state samples to obtain the target model after initial training;

[0020] After initial training, the target model outputs the predicted probability of each feature vector under the target operating state.

[0021] Furthermore, according to one aspect of this disclosure, generating perturbation information for the operating state sample based on the observed probability and the predicted probability includes:

[0022] A first sub-observation probability is determined from the observation probabilities, wherein the first sub-observation probability is used to indicate the probability that the feature vector appears in the target operating state;

[0023] The perturbation information of the operating state sample is determined based on the first sub-observation probability and the predicted probability.

[0024] Furthermore, determining the perturbation information of the operating state sample based on the first sub-observation probability and the predicted probability according to one aspect of this disclosure includes:

[0025] Determine the Heringer distance between the first sub-observation probability and the predicted probability;

[0026] The perturbation direction is determined based on the gradient of the Herringer distance;

[0027] Based on the maximum perturbation amplitude, the number of iterations, the running state samples processed in each iteration cycle, and the gradient, the amount of perturbation added in each iteration cycle is determined.

[0028] Furthermore, according to one aspect of this disclosure, the iteration termination condition includes at least one of the following: the difference between the perturbation result and the running state sample processed in the first iteration cycle is greater than or equal to the maximum perturbation amplitude; the Heringer distance corresponding to the running state sample processed in the current iteration cycle is less than or equal to the Heringer distance corresponding to the running state sample processed in the previous iteration cycle; and the Heringer distance corresponding to the running state sample processed in the current iteration cycle is greater than or equal to a distance threshold.

[0029] Furthermore, according to one aspect of this disclosure, feature extraction is performed on the operating state sample to obtain a feature vector, including:

[0030] Determine the feature extraction window and feature extraction method from multiple dimensions;

[0031] Based on the feature extraction window and the feature extraction method, feature extraction is performed on the running state sample to obtain the feature vector.

[0032] Furthermore, according to one aspect of this disclosure, the multiple dimensions include: peak utilization of computing resources, idle rate of computing resources, fluctuation level of workload in the current cycle, and periodic changes in workload; determining the feature extraction window from multiple dimensions includes:

[0033] Based on the highest usage rate and the degree of fluctuation, a feature extraction window for the first time dimension is determined;

[0034] The feature extraction window for the second time dimension is determined based on the idle rate;

[0035] The feature extraction window for the third time dimension is determined based on the periodic changes; wherein the unit time corresponding to the first time dimension, the second time dimension, and the third time dimension is different.

[0036] Furthermore, according to one aspect of this disclosure, feature extraction is performed on the running state sample based on the feature extraction window and the feature extraction method to obtain the feature vector, including:

[0037] Based on the feature extraction window of the first time dimension, determine the first quantile of the highest usage rate and the Shannon entropy of the degree of fluctuation;

[0038] The second quantile of the idle rate is determined based on the feature extraction window of the second time dimension; wherein the quantile value of the second quantile is less than the quantile value of the first quantile.

[0039] The coefficient of variation of the periodic changes is determined based on the feature extraction window of the third time dimension;

[0040] The feature vector is determined based on the first quantile, the Shannon entropy, the second quantile, and the coefficient of variation.

[0041] Furthermore, each of the operating state samples according to one aspect of this disclosure comprises multiple feature vectors; the fitting process of the feature vectors to obtain the observation probability of the feature vectors in each preset operating state of the server includes:

[0042] Determine the mean and standard deviation of the feature vector under each preset operating state;

[0043] A covariance matrix is ​​constructed based on the standard deviation; wherein the covariance matrix is ​​used to indicate the degree of correlation between any two eigenvectors.

[0044] The observation probability is determined based on the mean and the covariance matrix.

[0045] Furthermore, constructing a covariance matrix based on the standard deviation according to one aspect of this disclosure includes:

[0046] The diagonal elements are determined based on the standard deviation.

[0047] Determine the correlation coefficient between any two feature vectors under each preset operating state;

[0048] The off-diagonal elements are determined based on the product of the correlation coefficient and the standard deviation of any two eigenvectors.

[0049] The covariance matrix is ​​determined based on the diagonal elements and the off-diagonal elements.

[0050] According to another aspect of this disclosure, an anomaly detection method is provided, comprising:

[0051] Obtain the server's predicted operational status data;

[0052] The target model is used to process the data of the operating state to be predicted to obtain the processing result; wherein, the target model is trained by the above-mentioned model training method;

[0053] Anomaly detection is performed on the server based on the probability distribution of the data to be predicted and the Herringer distance between the processing results, and anomaly detection results are obtained; wherein, the probability distribution is used to indicate the probability of the feature vector in the data to be predicted appearing in each preset operating state of the server.

[0054] According to another aspect of this disclosure, a model training apparatus is provided, comprising:

[0055] A sample acquisition unit is used to acquire a sample of the server's operating status; wherein the sample of the operating status is the operating status data collected by the server in its normal operating state;

[0056] The feature extraction unit is used to extract features from the running state samples to obtain feature vectors;

[0057] A vector fitting unit is used to fit the feature vector to obtain the observation probability of the feature vector in each preset operating state of the server; wherein the observation probability is used to indicate the probability of the feature vector appearing in each preset operating state;

[0058] The sample generation unit is used to generate adversarial samples based on the observation probability, the feature vector, and the running state samples;

[0059] The model training unit is used to train the target model based on the running state samples and the adversarial samples to obtain the trained target model.

[0060] According to another aspect of this disclosure, an anomaly detection device is provided, comprising:

[0061] The data acquisition unit is used to acquire the server's predicted operating status data.

[0062] A data processing unit is used to process the data of the operating state to be predicted through a target model to obtain a processing result; wherein the target model is trained by the above-mentioned model training method;

[0063] An anomaly detection unit is used to perform anomaly detection on the server based on the probability distribution of the data to be predicted and the Herringer distance between the processing results, and obtain anomaly detection results; wherein, the probability distribution is used to indicate the probability of the feature vector in the data to be predicted appearing in each preset operating state of the server.

[0064] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, the steps in the above-described model training method or anomaly detection method are performed.

[0065] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores a computer program, which, when executed by a processor, performs the steps in the above-described model training method or anomaly detection method.

[0066] According to another aspect of this disclosure, a computer program product is provided, which is stored in a storage medium and executed by at least one processor to implement the steps in the above-described model training method or anomaly detection method.

[0067] As will be described in detail below, the model training, anomaly detection method, apparatus, device, medium, and product according to embodiments of this disclosure acquire server operating state samples; wherein, the operating state samples are operating state data collected by the server in normal operating state; then, feature extraction is performed on the operating state samples to obtain feature vectors; and the feature vectors are fitted to obtain the observation probability of the feature vectors in each preset operating state of the server; wherein, the observation probability is used to indicate the probability of the feature vectors appearing in each preset operating state; then, adversarial examples are generated based on the observation probabilities, feature vectors, and operating state samples; thereby, a target model can be trained based on the operating state samples and adversarial examples to obtain a trained target model. Through the above processing method, feature vectors can be extracted from the operating state samples, and the observation probability of the feature vectors in each preset operating state of the server can be determined. This enables the generation of adversarial examples based on the original operating state samples, and the expansion of the model's training samples using adversarial examples, allowing the target model to fully fit complex actual anomaly situations. This improves the comprehensiveness of the model training process and, consequently, the accuracy of the trained target model in anomaly detection.

[0068] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0069] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0070] Figure 1 This is a flowchart illustrating a model training method according to an embodiment of the present disclosure.

[0071] Figure 2 This is a schematic diagram illustrating an anomaly detection method according to an embodiment of the present disclosure.

[0072] Figure 3 This is a flowchart illustrating a load state prediction process according to an embodiment of the present disclosure.

[0073] Figure 4This is a flowchart illustrating a model training process according to an embodiment of the present disclosure.

[0074] Figure 5 This is a block diagram illustrating a model training apparatus according to an embodiment of the present disclosure.

[0075] Figure 6 This is a block diagram illustrating an anomaly detection device according to an embodiment of the present disclosure.

[0076] Figure 7 This is a hardware block diagram illustrating an electronic device according to an embodiment of the present disclosure.

[0077] Figure 8 This is a schematic diagram illustrating a computer program product according to an embodiment of the present disclosure. Detailed Implementation

[0078] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0079] To facilitate understanding of this embodiment, a model training method disclosed in this disclosure will first be described in detail. The execution subject of the model training method provided in this disclosure is generally an electronic device with certain computing power, such as a terminal device, a server, or other processing device. In some possible implementations, the model training method can be implemented by a processor calling computer-readable instructions stored in memory.

[0080] See Figure 1 The diagram shows a flowchart of a model training method provided in an embodiment of this disclosure. The method includes steps S101 to S105, wherein:

[0081] Step S101: Obtain a sample of the server's operating status; wherein the sample of the operating status is the operating status data collected by the server during normal operation.

[0082] The training method for this model can be implemented by a cloud platform. This disclosure can be applied to bare metal server scenarios, which typically refer to directly renting physical servers without using virtualization technology. Accordingly, bare metal servers can be selected as the servers. Subsequently, the trained target model can be deployed to the bare metal server, and the server's operating status can be monitored in real time. The server can also periodically evaluate the accuracy and robustness of the target model.

[0083] Here, the running status sample can be understood as the server's performance indicators, such as CPU utilization, memory utilization, temperature, power consumption, etc., and is aggregated and preprocessed at a preset collection time granularity. This collection time granularity can be selected as 5 minutes, or it can be adjusted as needed.

[0084] This disclosure provides an exemplary description of the preprocessing procedure.

[0085] Specifically, if the operational status data is missing at a certain collection point during normal server operation, it can be filled by linear interpolation of the operational status data from the collection points before and after that point. If the operational status data is missing consecutively at multiple collection points, the average of the operational status data for that day can be used to fill the missing data, as shown in the following formula:

[0086] If the running status data i is missing at the collection time point j, then For the processed running status data i, To collect the running status data at time point j-1, To collect the running status data at time point j+1; The amount of running status data, Let k be the running status data at time point j, and let k and i be the same type of running status data.

[0087] By employing the two methods of handling missing data—single-point missing and consecutive missing—we can achieve the following: when there are few missing data points and they are evenly distributed, we use the single-point missing method; when there are many missing data points or the data is unevenly distributed, we use the consecutive missing method.

[0088] In addition, since there may be unreasonable situations where the collected operational status data is unreasonable, this disclosure replaces values ​​that exceed the reasonable data range with boundary values, as shown in the following formula:

[0089] If the running status data i at the collection time point j is unreasonable, then The processed unreasonable operating status data i, 0 and 100 are preset boundary values, which can be adjusted as needed.

[0090] In this embodiment of the disclosure, the cloud platform can obtain the server's running status samples and preprocess the running status samples to ensure the validity of the running status samples and provide a stable data foundation for the subsequent model training process.

[0091] Step S102: Extract features from the running state sample to obtain a feature vector.

[0092] In this embodiment of the disclosure, the cloud platform can extract features from the running status sample from multiple dimensions. One running status sample corresponds to multiple feature vectors, which will be described by example later. No further examples will be given here.

[0093] Both the dimensions and the method of feature extraction can be adjusted according to the actual application scenario.

[0094] Step S103: Perform fitting processing on the feature vector to obtain the observation probability of the feature vector in each preset operating state of the server; wherein, the observation probability is used to indicate the probability of the feature vector appearing in each preset operating state.

[0095] Here, the preset operating state can be understood as the server's load state, such as high load, low load, and normal load. There is a correlation between each feature vector and the preset operating state, which will be described with examples later.

[0096] Here, the observation probability is the probability distribution of the feature vector corresponding to each preset operating state. The observation probability can be Gaussian distribution or other forms, and this disclosure does not require it to be.

[0097] In this embodiment of the disclosure, the cloud platform can process the feature vector to obtain the probability of the feature vector appearing in each preset operating state, i.e., the observation probability.

[0098] Step S104: Generate adversarial examples based on the observation probability, the feature vector, and the running state samples.

[0099] Because the model's performance is insufficient under small datasets or adversarial attacks, high-load samples are lacking compared to the running state samples under normal server conditions, resulting in the absence of critical samples, which affects model performance. Therefore, this disclosure generates adversarial samples based on observation probability, feature vectors, and running state samples. Adversarial samples can more accurately expand the distribution of running state samples and improve the model's ability to learn from the boundary running state samples.

[0100] Adversarial examples refer to input samples formed by adding subtle perturbations to the running state samples, causing the model to give an incorrect output with high confidence.

[0101] In this embodiment of the disclosure, the cloud platform can introduce observation probabilities and feature vectors on the basis of the original running state samples, so as to generate adversarial examples through the running state data of normal operation, which improves the comprehensiveness of data collection and enhances the robustness of the model to critical samples.

[0102] Step S105: Train the target model based on the running state samples and the adversarial samples to obtain the trained target model.

[0103] Here, the target model can be a Hidden Markov Model (HHM), a Multi-dimensional Hidden Markov Model (MD-HMM), or other models, but no further examples will be given here.

[0104] In this embodiment of the disclosure, the cloud platform can use running state samples and adversarial samples to train the target model. By expanding the boundary of the samples through adversarial samples, the running state samples are guided to approach the abnormal decision boundary without triggering misjudgment, thereby enhancing the target model's learning ability to samples and effectively alleviating the problem of sample scarcity.

[0105] In the above implementation, feature vectors can be extracted from the running state samples, and the observation probability of the feature vectors in each preset running state of the server can be determined. Based on the original running state samples, adversarial samples can be generated, and the training samples of the model can be expanded using adversarial samples. This allows the target model to fully fit the actual complex anomaly situation, thereby improving the comprehensiveness of the model training process and improving the accuracy of the trained target model in the process of anomaly detection.

[0106] In an optional implementation, the above steps generate adversarial examples based on the observation probability, the feature vector, and the running state samples, specifically including the following steps:

[0107] Based on the observation probability and the feature vector, perturbation information of the running state sample is generated, wherein the perturbation information includes the perturbation direction and the amount of perturbation added in each iteration cycle;

[0108] The running state sample is iteratively perturbed based on the perturbation information, and the adversarial sample is determined based on the perturbation result that satisfies the iteration termination condition.

[0109] As mentioned above, since it is necessary to add perturbations to the running state samples, this disclosure can generate perturbation information based on the observation probability and feature vector.

[0110] Before generating adversarial examples, this disclosure can first initialize parameters, including the maximum perturbation amplitude, the number of iterations, the distance threshold, etc., and use an adversarial generation algorithm based on Heringer distance to generate adversarial examples. The perturbation direction is the direction that makes the Heringer distance increase the fastest. The amount of perturbation added in each iteration cycle can be determined according to the above parameters and the Heringer distance.

[0111] The process for determining the disturbance information and the content included in the disturbance information will be described by example later, and no further examples will be given here.

[0112] In the above implementation, the perturbation information for perturbing the running state sample can be accurately determined based on the observation probability and feature vector. Then, the running state sample is iteratively perturbed based on the perturbation information, and the sample that meets the iteration termination condition is selected as the final adversarial sample to ensure the effectiveness of the adversarial sample. This can improve the learning ability of the target model on the boundary normal sample (i.e. adversarial sample) and improve the robustness of the model training process.

[0113] In an optional implementation, the above steps generate perturbation information for the operating state sample based on the observation probability and the feature vector, specifically including the following steps:

[0114] Within a preset time period, the operating state that appears most frequently among the preset operating states is determined to obtain the target operating state;

[0115] Based on the feature vector and the target operating state, the prediction probability is determined;

[0116] Based on the observed probability and the predicted probability, the perturbation information of the operating state sample is generated.

[0117] This disclosure can analyze the feature vector using the Viterbi algorithm to infer that the most frequently occurring running state of the server is the target running state, and determine the prediction probability of the target model output based on the feature vector and the target running state. Thus, the perturbation information of the running state sample can be generated based on the actual observation probability and the prediction probability predicted by the model.

[0118] In addition to determining the predicted probability of the target model output based on the feature vector and the target running state, it can also support determining the predicted probability of the target model output based on the running state sample and the target running state.

[0119] As mentioned earlier, the running state samples can be iteratively perturbed based on the perturbation information. After each perturbation, the running state that appears most frequently on the server needs to be re-determined using the Viterbi algorithm. If the running state that appears most frequently on the server after each perturbation is different from the target running state, then the state is determined as a new state, and the prediction probability and perturbation information need to be regenerated based on the new state.

[0120] In this embodiment of the disclosure, disturbance information is generated around the operating state that appears most frequently in the server. First, the prediction probability is determined based on the feature vector and the target operating state. Then, based on the observation probability and prediction probability of the feature vector in each preset operating state, the disturbance direction and the amount of disturbance added in each iteration cycle are determined.

[0121] In the above implementation, perturbation information is generated by combining the observed probability and the predicted probability to measure the degree of difference between the true probability distribution and the predicted probability distribution. This accurately determines the boundary metric of sample anomalies, thereby providing effective training samples for the model training process, reducing the model's overfitting to the training data, and enabling the model to cope with complex situations such as scarce samples and noisy data.

[0122] In an optional implementation, the above steps determine the prediction probability based on the feature vector and the target operating state, specifically including the following steps:

[0123] The model parameters of the target model are adjusted based on the running state samples to obtain the target model after initial training;

[0124] After initial training, the target model outputs the predicted probability of each feature vector under the target operating state.

[0125] This disclosure provides an exemplary description of the process for predicting probabilities.

[0126] Specifically, during the model initialization phase, preset operating states and initialization model parameters are set. The preset operating states can be set to low load, normal load, and high load. The initialization model parameters include the initial state distribution, state transition matrix, and observation probability.

[0127] The initial state distribution represents the probability that the server is in each preset running state at the initial moment. If there are three preset running states, then the initial state distribution is one-third.

[0128] The state transition matrix represents the probability of transitions between different preset operating states. A diagonal dominance matrix can be used, where diagonal elements are used to ensure state persistence, and the transitions between adjacent preset operating states have higher priority.

[0129] The observation probability is the probability of the feature vector appearing in each preset operating state, that is, the probability distribution of the feature vector corresponding to each preset operating state. In this disclosure, a multivariate Gaussian distribution can be used as the observation probability, and each preset operating state corresponds to an observation probability.

[0130] Based on this, the Baum-Welch forward-backward algorithm and running state samples can be used to iteratively optimize the model parameters of the initialized target model, and the observation probability can be maximized through maximum likelihood estimation, so that the model parameters can better understand the observation probability. After optimization, the initial trained target model is obtained.

[0131] In this embodiment of the disclosure, after initializing the target model, the running state samples are used to train the initialized target model to obtain the initial trained target model. Based on the target running state, the initial trained target model outputs the predicted probability of each feature vector under the target running state, and uses this as the data basis for perturbation information, which facilitates the generation of perturbation information with the observation probability and ensures the accuracy of the perturbation information.

[0132] In an optional implementation, the above steps generate perturbation information for the operating state sample based on the observed probability and the predicted probability, specifically including the following steps:

[0133] A first sub-observation probability is determined from the observation probabilities, wherein the first sub-observation probability is used to indicate the probability that the feature vector appears in the target operating state;

[0134] The perturbation information of the operating state sample is determined based on the first sub-observation probability and the predicted probability.

[0135] Since the observation probability is the probability of the feature vector appearing in each preset operating state, while the perturbation information is generated around the target operating state, it is necessary to extract the first sub-observation probability from the observation probability and combine the first sub-observation probability and the prediction probability to determine the perturbation information of the operating state sample.

[0136] In addition, sample data related to the target's operating state can be extracted from the server's operating state samples. Then, feature extraction can be performed on the sample data, and the extracted feature vector can be fitted to obtain the first sub-observation probability.

[0137] In the above implementation, the perturbation information is determined by combining the first sub-observation probability and the prediction probability under the target's operating state, making the perturbation more targeted, thereby improving the effectiveness of adversarial examples and helping to improve the generalization ability of the target model.

[0138] In an optional implementation, the above steps determine the perturbation information of the operating state sample based on the first sub-observation probability and the predicted probability, specifically including the following steps:

[0139] Determine the Heringer distance between the first sub-observation probability and the predicted probability;

[0140] The perturbation direction is determined based on the gradient of the Herringer distance;

[0141] Based on the maximum perturbation amplitude, the number of iterations, the running state samples processed in each iteration cycle, and the gradient, the amount of perturbation added in each iteration cycle is determined.

[0142] This disclosure allows for the generation of adversarial data using a Heringer distance-based adversarial generation algorithm, as shown in the following formula:

[0143] ,in, The probability of the first child observation. To predict probabilities, Let be the covariance matrix of the first sub-observation probability. The mean of the probability of the first sub-observation. The covariance matrix is ​​the predicted probability. The covariance matrix is ​​used to calculate the mean of the predicted probability, and methods such as determinant (det()), matrix transpose, and matrix inversion are used to process it.

[0144] Based on this, the direction of the fastest increase in Herringer distance can be determined as the perturbation direction, and the gradient formula for the Herringer distance is: , indicating that the gradient of the Herringer distance is proportional to the result of the processing between the covariance matrix and the mean.

[0145] After determining the direction of the perturbation, the amount of perturbation added in each iteration cycle can be further determined based on the maximum perturbation amplitude and the number of iterations mentioned in the initialization parameters above, as shown in the following formula:

[0146] ,in, For the maximum disturbance amplitude, For the number of iterations, This is the sign function, used to ensure the accuracy of the perturbation direction. This refers to the running state sample processed in the k-th iteration cycle. For gradient.

[0147] In this embodiment of the disclosure, the similarity between the first sub-observation probability and the predicted probability can be determined based on the Heringer distance between the first sub-observation probability and the predicted probability, and the perturbation direction can be determined based on the gradient of the Heringer distance. The perturbation amount can be determined based on the initialization parameters, the running state samples processed in each iteration cycle, and the gradient. By controlling the direction and amount of the perturbation, adversarial samples of different levels can be generated in real time to test the model's performance under different adversarial conditions, which is conducive to improving the robustness of the model to sample data.

[0148] In an optional implementation, the iteration termination condition of the above steps specifically includes at least one of the following: the difference between the perturbation result and the running state sample processed in the first iteration cycle is greater than or equal to the maximum perturbation amplitude; the Heringer distance corresponding to the running state sample processed in the current iteration cycle is less than or equal to the Heringer distance corresponding to the running state sample processed in the previous iteration cycle; and the Heringer distance corresponding to the running state sample processed in the current iteration cycle is greater than or equal to the distance threshold.

[0149] This disclosure provides an exemplary description of iteration termination conditions. Specifically, iteration termination conditions include the perturbation amplitude reaching an upper limit. ,in, As a result of the perturbation, This refers to the running state sample processed in the first iteration cycle. The maximum perturbation amplitude is reached; the Herringer distance no longer increases. ,in, The Heringer distance is the distance between the running state samples processed in the k-th iteration cycle. The Heringer distance is the distance to the running state sample processed in the (k+1)th iteration cycle; the Heringer distance to the running state sample processed in the current iteration cycle is greater than or equal to the distance threshold, i.e. ,in, This is the distance threshold.

[0150] The iteration stops when one of the termination conditions is met, and the iteration is retained. or or The perturbation result is considered an adversarial example. Alternatively, a perturbation result that satisfies all three conditions can also be considered an adversarial example. and and The perturbation results are adversarial examples, and the content regarding the iteration termination condition can be adaptively adjusted according to the actual application scenario.

[0151] In this disclosure, an exemplary scheme for the iteration termination condition is provided, which enables the final adversarial sample to be screened out during the iterative perturbation of the running state sample, thereby helping to improve the effectiveness and accuracy of the adversarial sample.

[0152] After determining the adversarial examples based on the perturbation results that satisfy the iteration termination condition, the running state samples and adversarial examples can be used to obtain an augmented training set. The target model is then trained using this augmented training set, the model parameters of the target model are updated, and the trained target model is obtained. The Heringer distance of the original running state samples under the trained target model is calculated, and the maximum value of this Heringer distance is taken as the new distance threshold to ensure that the distance threshold adapts to the expanded augmented training set.

[0153] ,in, For the new distance threshold, The Heringer distance between the running state samples and the target model after training. These are the model parameters of the target model after training.

[0154] During the training of the target model using the augmented training set, multiple iterations can be performed, and the final trained target model and new distance threshold can be output.

[0155] In an optional implementation, the above steps for feature extraction of the running state samples to obtain feature vectors specifically include the following steps:

[0156] Determine the feature extraction window and feature extraction method from multiple dimensions;

[0157] Based on the feature extraction window and the feature extraction method, feature extraction is performed on the running state sample to obtain the feature vector.

[0158] Here, multiple dimensions can be determined for the data attributes of the running status sample, and the feature extraction window and feature extraction method can be determined based on the multiple dimensions. The feature extraction window corresponding to each dimension can be the same or different, and the feature extraction method corresponding to each dimension can be the same or different. This will be described in detail later, and no further examples will be given here.

[0159] In the above embodiments, feature extraction is performed in layers using multi-timescale feature extraction windows, which breaks through the limitations of a single feature extraction window. The appropriate feature extraction window can be selected according to the dimension to adapt to different application scenarios and improve the flexibility of the feature extraction process.

[0160] In an optional implementation, the above steps include multiple dimensions, such as: peak utilization of computing resources, idle rate of computing resources, fluctuation level of workload in the current cycle, and periodic changes in workload; determining the feature extraction window from multiple dimensions specifically includes the following steps:

[0161] Based on the highest usage rate and the degree of fluctuation, a feature extraction window for the first time dimension is determined;

[0162] The feature extraction window for the second time dimension is determined based on the idle rate;

[0163] The feature extraction window for the third time dimension is determined based on the periodic changes; wherein the unit time corresponding to the first time dimension, the second time dimension, and the third time dimension is different.

[0164] This disclosure employs feature extraction windows with three time dimensions.

[0165] Specifically, the feature extraction window for the first time dimension is a short window, which can be set to an hourly feature extraction window; the feature extraction window for the second time dimension is a medium window, which can be set to a daily feature extraction window; and the feature extraction window for the third time dimension is a long window, which can be set to a weekly feature extraction window.

[0166] The first-time dimension feature extraction window (hourly): The peak utilization of computing resources and the fluctuation of the workload in the current period are processed using a short window, which can balance timeliness and statistical significance. The calculation shares a 1-hour sliding window to avoid duplicate calculations. The short window can defend against scenarios such as sudden traffic or process crashes.

[0167] The second time dimension feature extraction window (daily level) covers the complete day and night load cycle, ensuring that it can reflect the baseline of the actual idle rate of computing resources, such as the continuous low load at night.

[0168] The third time-dimensional feature extraction window (weekly): Periodic changes in workload are handled using a non-continuous skip window, avoiding the computationally intensive nature of a 7-day window. Instead, in-phase sampling is used, significantly reducing computational load. Longer-term windows can detect periodic load drift, guiding pre-configured capacity planning decisions.

[0169] In an optional implementation, the above steps, based on the feature extraction window and the feature extraction method, extract features from the running state sample to obtain the feature vector, specifically including the following steps:

[0170] Based on the feature extraction window of the first time dimension, determine the first quantile of the highest usage rate and the Shannon entropy of the degree of fluctuation;

[0171] The second quantile of the idle rate is determined based on the feature extraction window of the second time dimension; wherein the quantile value of the second quantile is less than the quantile value of the first quantile.

[0172] The coefficient of variation of the periodic changes is determined based on the feature extraction window of the third time dimension;

[0173] The feature vector is determined based on the first quantile, the Shannon entropy, the second quantile, and the coefficient of variation.

[0174] For the highest utilization rate of computing resources, the 95th percentile can be used. This percentile can filter out sudden spikes, accurately reflect the risk of resource bottlenecks, and avoid misjudgments caused by instantaneous fluctuations. It is a core indicator for capacity planning. The computing resources can include CPU and memory. Since the highest utilization rates of CPU and memory are not synchronized, the highest utilization rates of CPU and memory are calculated independently.

[0175] CPU peak utilization: CPU_P95 is calculated based on a feature extraction window in the first time dimension, which is the hour preceding the current time t. Here, we take a time granularity of 5 minutes as an example. One hour corresponds to twelve points, that is, the value range of k is 0-11.

[0176] To construct a daily observation vector, it is necessary to aggregate from hourly to daily levels. The daily aggregation method uses the maximum value of the 24 hours. .

[0177] P95 (95th percentile) is a statistical concept that indicates that 95% of the observations in a dataset are less than or equal to this value. The calculation of CPU_P95 can identify the 5% of the time period with the highest load throughout the day, accurately reflecting the resource demand during peak business periods.

[0178] The calculation principle for hourly P95 is as follows:

[0179] (1) Data sorting: Arrange the data in ascending order to obtain a new sequence.

[0180] (2) Calculate the position of the 95th percentile: Where n is the total number of data points, i.e., 12 points, and p is the target quantile, i.e., 0.95.

[0181] (3) Interpolation: k is a non-integer, requiring a weighted average of the 11th and 12th data points. The weights are assigned as follows: ,in, It is the integer part of y.

[0182] (4) Final value: This represents the final quantile. The first quantile of the highest CPU utilization can be obtained using this method.

[0183] Peak memory utilization: MEM_P95, representing peak memory pressure. By capturing peak memory usage pressure, the 95th percentile value identifies potential OOM (Out of Memory) risks, quantifying memory overflow risks. It is more stable than the maximum value and more sensitive than the mean. The calculation process first calculates MEM_P95(t) based on an hourly window, using the same method as CPU_P95(t). Accordingly, aggregation from hourly to daily levels is performed by taking the P95 value of MEM_P95(t) over 24 hours.

[0184] Similarly, the above processing method can be used to obtain the first quantile of the highest memory utilization, and finally obtain the feature vector corresponding to the highest utilization.

[0185] The degree of workload fluctuation in the current cycle: CPU fluctuation entropy (CPU_Entropy) is the entropy value of the standard deviation of CPU utilization, used to quantify the complexity of CPU load fluctuations and can sensitively detect sudden abnormal fluctuations. CPU fluctuations are usually more likely to reflect anomalies than memory fluctuations (memory leaks are slower). The reason for choosing entropy is that, compared to standard deviation, entropy is more efficient at detecting sudden fluctuations (such as DDoS attacks, process crashes). The higher the entropy value, the more disordered the fluctuations, and the greater the probability of identifying anomalies. The calculation method is to aggregate the hourly CPU fluctuation entropy (12 points / hour) into a daily fluctuation entropy (24-hour weighted average). Since the entropy value has a greater impact during high-load periods, the hourly entropy weight allocation uses the average CPU load per hour as the weighting factor.

[0186] The specific calculation formula is as follows: (1) Hourly fluctuation entropy: Calculate the mean of the running state samples within the feature extraction window of the first time dimension: Sum of standard deviation: Then divide it into ten equal intervals: Let represent the interval for the h-th hour, which includes 95% of the data points in the running state samples during the h-th hour. Secondly, the probability distribution of statistical data points is: Count the number of data points falling within this interval, calculate the proportion of this data point to the total number of data points, which is the probability of that interval. Finally, calculate the Shannon entropy: This is the Shannon entropy of the degree of fluctuation, from which we obtain the eigenvector corresponding to the degree of fluctuation.

[0187] (2) Hourly weighting factor: The average value of the 1-hour running status sample is used as the weight: ,in, This represents the k-th running state sample in the h-th hour.

[0188] (3) Daily weighted average fluctuation entropy: , among which, when When the value is 0, it indicates that the cloud server is idle all day, and CPU_Entropy is set to 0.

[0189] Computing resource idle rate: Combined_P25 represents the resource idle rate, comprehensively assessing the idle level of CPU and memory. The 25th percentile reflects the resource waste window. Taking the average avoids bias from a single indicator, and since both are often idle simultaneously during low-load periods, redundancy is avoided by saving one dimension. Combined_P25 is directly related to cost optimization, such as scaling down and reducing specifications. The calculation window is the 24 hours prior to the current time t (288 points). The calculation process is to first calculate the P25 of CPU and memory separately, and then calculate their arithmetic mean.

[0190] .

[0191] The calculation process for daily P25 is the same as the calculation principle for hourly P95 mentioned above. No further examples will be given here. In the end, we can also obtain the second quantile of the idle rate, which is the feature vector corresponding to the idle rate. The quantile value of the second quantile is less than the quantile value of the first quantile.

[0192] The periodic variation of workload: Day_CV is used to identify periodically drifting loads. It quantifies the difference between the current day's load pattern and historical patterns of the same period using the coefficient of variation (CV). A higher CV value indicates weaker periodicity and a greater probability of anomalous drift. By quantifying the stability of historical periodic patterns, it provides temporal context constraints for the hidden state transitions of the Hidden Markov Model (HMM), overcoming the Markov shortsightedness limitation of traditional HMMs. The calculation of Day_CV employs a non-continuous time-point sampling strategy, avoiding the redundancy of traditional sliding window calculations and achieving efficient capture of periodic patterns. The calculation window is the CPU_P95 value at the same point in the past. The calculation steps are as follows:

[0193] (1) Extract the CPU_P95 values ​​at the same time in the previous 7 days:

[0194] .

[0195] (2) Calculate the coefficient of variation (mean and standard deviation), mean: Standard deviation: .

[0196] (3) Calculate CV: ,in, Using the matching coefficient, we can ultimately obtain the eigenvector corresponding to the periodic changes.

[0197] Accordingly, the feature extraction methods for the highest utilization rate and the idle rate of computing resources are quantiles, the feature extraction method for the current periodic fluctuation of workload is Shannon entropy, and the feature extraction method for the periodic change of workload is the coefficient of variation.

[0198] In this embodiment of the disclosure, the feature vector corresponding to each dimension can be determined according to the feature extraction window and feature extraction method of each dimension, so as to realize personalized processing of the feature extraction process and thus effectively improve the flexibility of the feature extraction process.

[0199] In the above implementation, the feature extraction window with multiple time dimensions breaks through the expressive power limitation of single time scale feature engineering, realizes hierarchical feature compression, and avoids the data scarcity problem caused by dimensional explosion in model training while retaining key information, making the model detection more interpretable.

[0200] The relationship between each feature extraction process and each preset running state mentioned above is shown in Table 1:

[0201] Table 1

[0202]

[0203] This disclosure also illustrates the correlation between each preset operating state and joint feature, as shown in Table 2:

[0204] Table 2

[0205]

[0206] In an optional implementation, each of the above-described operating state samples contains multiple feature vectors; fitting the feature vectors to obtain the observation probability of the feature vectors in each preset operating state of the server specifically includes the following steps:

[0207] Determine the mean and standard deviation of the feature vector under each preset operating state;

[0208] A covariance matrix is ​​constructed based on the standard deviation; wherein the covariance matrix is ​​used to indicate the degree of correlation between any two eigenvectors.

[0209] The observation probability is determined based on the mean and the covariance matrix.

[0210] This disclosure provides an exemplary description of the process for processing observation probabilities.

[0211] Here, the initialization parameters for the mean can be set based on historical data. Table 3 shows the initialization parameter settings for the mean.

[0212] Table 3

[0213]

[0214] Among them, the mean reflects the volatility between operating states, and the covariance matrix reflects the degree of correlation between any two eigenvectors or any two dimensions.

[0215] In this embodiment of the disclosure, the mean and standard deviation can be determined based on the feature vectors in each operating state, and a covariance matrix describing the degree of correlation between any two feature vectors can be constructed based on the standard deviation. Finally, by fitting the mean and covariance matrix, the observation probability of the feature vectors in each preset operating state of the server can be obtained, which helps to accurately generate adversarial examples based on the observation probability.

[0216] In an optional implementation, the above steps construct a covariance matrix based on the standard deviation, specifically including the following steps:

[0217] The diagonal elements are determined based on the standard deviation.

[0218] Determine the correlation coefficient between any two feature vectors under each preset operating state;

[0219] The off-diagonal elements are determined based on the product of the correlation coefficient and the standard deviation of any two eigenvectors.

[0220] The covariance matrix is ​​determined based on the diagonal elements and the off-diagonal elements.

[0221] This disclosure provides an exemplary description of the process for constructing the covariance matrix.

[0222] Specifically, the design principle for the initialization parameters of the covariance matrix is: variance reflects the volatility of eigenvectors under various operating conditions, and covariance reflects the correlation between eigenvectors.

[0223] First, the standard deviation benchmark for each operating state can be determined through historical data. Then, the upper-middle value of each standard deviation benchmark (e.g., P75) can be taken as the initial variance. For high-load operating states, an additional 20% fluctuation margin can be added and used as the diagonal element.

[0224] Then, a correlation coefficient matrix can be constructed first. This correlation coefficient matrix is ​​used to describe the association between any two feature vectors under each preset operating state. The design principle of this correlation coefficient matrix is ​​to set a strong positive correlation under high load conditions and zero correlation under low load conditions. The correlation coefficient conversion formula is: ,in, The correlation coefficient between feature vector i and feature vector j can be set according to business logic, as shown in Table 4. Let i be the standard deviation of the feature vector i. Let be the standard deviation of the eigenvector j.

[0225] Table 4

[0226]

[0227] After this, the covariance matrix can be corrected through Cholesky decomposition, and business knowledge constraints can be set, such as prohibiting physical inconsistencies (e.g., negative correlation between CPU_95 and P25) and setting an upper limit for the correlation coefficient.

[0228] In this embodiment of the disclosure, the covariance matrix can capture the true distribution of feature vectors under each operating state and reflect the business correlation between feature vectors. This helps the model remain stable when facing outliers or noise, enhances the model's robustness to uncertainty, and facilitates improving the accuracy of model prediction.

[0229] See Figure 2 The diagram shows a flowchart of an anomaly detection method provided in an embodiment of this disclosure. The method includes steps S201 to S203, wherein:

[0230] Step S201: Obtain the server's operational status data to be predicted.

[0231] Step S202: Process the data of the operating state to be predicted using the target model to obtain the processing result; wherein the target model is trained using the above-mentioned model training method.

[0232] Step S203: Perform anomaly detection on the server based on the probability distribution of the data to be predicted and the Herringer distance between the processing results to obtain anomaly detection results; wherein, the probability distribution is used to indicate the probability of the feature vector in the data to be predicted appearing in each preset operating state of the server.

[0233] In this embodiment of the disclosure, the server's operating state data to be predicted can be input into the target model. After the target model processes the data, it outputs the processing result. The processing result can be understood as the predicted probability of the feature vector in the operating state data to be predicted appearing in each preset operating state of the server. In addition to obtaining the anomaly detection result, it can also be used to predict the load state, which facilitates the generation of response suggestions by combining the load state prediction result and the anomaly detection result.

[0234] Specifically, when a user clicks "Immediate Anomaly Detection" or "Scheduled Anomaly Detection," the cloud platform will detect whether the cloud server is in an abnormal state in real time or at regular intervals and predict the load. The sequence length of the data to be predicted for the operating status can be selected as 7 days or can be adjusted adaptively.

[0235] Load status prediction:

[0236] The Viterbi algorithm is used to calculate the most probable operating state of the data to be predicted (e.g., S1 low load, S2 normal load, S3 high load), and the load state is predicted based on the operating state. To identify load persistence patterns, the load state is extended based on the operating state in conjunction with business requirements, such as... Figure 3 As shown:

[0237] S301; Obtain the server's predicted operating status data.

[0238] S302: Determine if the server has been in the same operating state for more than five days.

[0239] If yes, then execute S303; otherwise, execute S304.

[0240] S303: Mark this running state as a continuous state.

[0241] S304: Frequency of statistical operation status.

[0242] If the number of high load events is greater than or equal to 5, then execute S305; if the number of low load events is greater than or equal to 5, then execute S306.

[0243] S305: Marked as continuously high load.

[0244] S306: Marked as continuous low load.

[0245] S307: Determine if a high-frequency state exists.

[0246] If yes, and the number of high load events is greater than or equal to 5, then execute S308; if yes, and the number of low load events is greater than or equal to 5, then execute S309; ​​otherwise, execute S310.

[0247] S308: Marked as high frequency and high load.

[0248] S309: Marked as high frequency, low load.

[0249] S310: Select the highest frequency operating state.

[0250] Anomaly detection:

[0251] ,in, The probability distribution of the operating state data to be predicted. For the processing result, if If the distance exceeds the new distance threshold, the server is considered to be malfunctioning.

[0252] Finally, based on the combined processing of load status prediction and anomaly detection, response recommendations can be obtained, as shown in Table 5:

[0253] Table 5

[0254]

[0255] The following is combined with Figure 4 The training process of the above model is described below:

[0256] S401: Obtain a sample of the server's running status.

[0257] Here, the running status sample is the running status data collected by the server during normal operation.

[0258] S402: Extract features from the running status samples to obtain feature vectors.

[0259] S403: Fit the feature vector to obtain the observation probability of the feature vector under each preset operating state of the server.

[0260] Here, the observation probability is used to indicate the probability of the feature vector appearing in each preset operating state.

[0261] S404: Based on the observation probability and feature vector, generate perturbation information of the running state sample.

[0262] Here, the perturbation information includes the perturbation direction and the amount of perturbation added in each iteration cycle.

[0263] S405: Iteratively perturb the running state samples based on perturbation information, and determine adversarial samples based on the perturbation results that meet the iteration termination condition.

[0264] S406: Train the target model based on running state samples and adversarial samples to obtain the trained target model.

[0265] As can be seen from the above description, the technical solution disclosed herein has the following advantages:

[0266] (1) This application addresses the problem of abnormal data collection. It proposes to implement anomaly detection based on Heringer distance. This method trains the model based on the operational status data collected by the server during normal operation, thus solving the problems of scarce abnormal samples, difficult labeling, and high collection costs. This application also utilizes generated adversarial examples to expand the operational status samples, thereby improving the detection performance and adversarial robustness of the anomaly detection process.

[0267] (2) This disclosure proposes a hierarchical multi-scale feature fusion mechanism for feature extraction, which achieves dimensionality reduction optimization while retaining key information. It employs three feature extraction windows to extract features hierarchically, quantifies resource pressure and idle cost through quantile statistics, captures load fluctuation characteristics using entropy theory, and combines cross-day difference degree modeling cycle mode to achieve full-spectrum load characterization from transient anomalies to long-term patterns, breaking through the limitations of traditional single time scale. While retaining key information, it solves the problem of dimensionality explosion in long-term dependent modeling.

[0268] (3) To address the issues of delayed fault warnings and poor decision interpretability, this disclosure can simultaneously achieve anomaly detection and load prediction, and designs an anomaly-state joint decision matrix by combining the two to output accurate response strategies. This disclosure not only improves the accuracy of anomaly detection but also outputs predictive operation and maintenance decision suggestions. In the operation and maintenance scenario of bare metal servers, the isolation of resource prediction and anomaly detection can drastically amplify business risks, and faults can easily lead to business interruptions with difficulty in locating the root cause. This disclosure achieves efficient and interpretable intelligent operation and maintenance of resources by integrating detection and prediction, effectively avoiding business risks.

[0269] Based on the same inventive concept, this disclosure also provides a model training device corresponding to the model training method. Since the principle of the device in this disclosure for solving the problem is similar to the model training method described above in this disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0270] Reference Figure 5 The diagram shown is a schematic of a model training device provided in an embodiment of this disclosure. The device includes: a sample acquisition unit 50, a feature extraction unit 51, a vector fitting unit 52, a sample generation unit 53, and a model training unit 54; wherein:

[0271] A sample acquisition unit is used to acquire a sample of the server's operating status; wherein the sample of the operating status is the operating status data collected by the server in its normal operating state;

[0272] The feature extraction unit is used to extract features from the running state samples to obtain feature vectors;

[0273] A vector fitting unit is used to fit the feature vector to obtain the observation probability of the feature vector in each preset operating state of the server; wherein the observation probability is used to indicate the probability of the feature vector appearing in each preset operating state;

[0274] The sample generation unit is used to generate adversarial samples based on the observation probability, the feature vector, and the running state samples;

[0275] The model training unit is used to train the target model based on the running state samples and the adversarial samples to obtain the trained target model.

[0276] The processing flow of each module and the interaction flow between modules can be referred to the relevant descriptions in the above method embodiments, and will not be elaborated here.

[0277] Reference Figure 6 The diagram shown is a schematic representation of an anomaly detection device provided in an embodiment of this disclosure. The device includes: a data acquisition unit 60, a data processing unit 61, and an anomaly detection unit 62; wherein:

[0278] The data acquisition unit is used to acquire the server's predicted operating status data.

[0279] A data processing unit is used to process the data of the operating state to be predicted through a target model to obtain a processing result; wherein the target model is trained by the above-mentioned model training method;

[0280] An anomaly detection unit is used to perform anomaly detection on the server based on the probability distribution of the data to be predicted and the Herringer distance between the processing results, and obtain anomaly detection results; wherein, the probability distribution is used to indicate the probability of the feature vector in the data to be predicted appearing in each preset operating state of the server.

[0281] The processing flow of each module and the interaction flow between modules can be referred to the relevant descriptions in the above method embodiments, and will not be elaborated here.

[0282] Corresponding to Figure 1 Model training methods in Figure 2 In addition to the anomaly detection method, this disclosure also provides an electronic device 70, such as... Figure 7 The diagram shown is a structural schematic of an electronic device 70 provided in an embodiment of this disclosure, including:

[0283] The system includes a processor 71, a memory 72, and a bus 73. The memory 72 stores execution instructions and includes main memory 721 and external memory 722. The main memory 721, also called internal memory, temporarily stores the computational data in the processor 71, as well as data exchanged with external memory such as a hard disk. The processor 71 exchanges data with the external memory 722 through the main memory 721. When the electronic device 70 is running, the processor 71 communicates with the memory 72 via the bus 73, causing the processor 71 to execute the following instructions:

[0284] Obtain a sample of the server's operating status; wherein, the sample of the operating status is the operating status data collected by the server during normal operation.

[0285] Feature vectors are obtained by extracting features from the running state samples;

[0286] The feature vector is fitted to obtain the observation probability of the feature vector in each preset operating state of the server; wherein the observation probability is used to indicate the probability of the feature vector appearing in each preset operating state;

[0287] Based on the observation probability, the feature vector, and the running state sample, generate adversarial examples;

[0288] The target model is trained based on the running state samples and the adversarial samples to obtain the trained target model.

[0289] Alternatively, execute the following command:

[0290] Obtain the server's predicted operational status data;

[0291] The target model is used to process the data of the operating state to be predicted to obtain the processing result; wherein, the target model is trained by the above-mentioned model training method;

[0292] Anomaly detection is performed on the server based on the probability distribution of the data to be predicted and the Herringer distance between the processing results, and anomaly detection results are obtained; wherein, the probability distribution is used to indicate the probability of the feature vector in the data to be predicted appearing in each preset operating state of the server.

[0293] This disclosure also provides a computer-readable storage medium storing a computer program. When a processor runs the computer program, it executes the steps of the model training method and anomaly detection method described in the above method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0294] This disclosure also provides a computer program product 80, such as... Figure 8 The diagram shown is a schematic diagram of the structure of a computer program product 80 provided in an embodiment of this disclosure. The computer program product 80 carries a computer program 81. The program included in the computer program 81 can be used to execute the steps of the model training method and the anomaly detection method described in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0295] The above description, with reference to the accompanying drawings, outlines a model training and anomaly detection method, apparatus, device, medium, and product according to embodiments of the present disclosure. First, a server operating state sample is acquired; wherein the operating state sample is operating state data collected by the server during normal operation. Then, feature extraction is performed on the operating state sample to obtain a feature vector; and the feature vector is fitted to obtain the observation probability of the feature vector in each preset operating state of the server; wherein the observation probability indicates the probability of the feature vector appearing in each preset operating state. Second, adversarial examples are generated based on the observation probabilities, feature vectors, and operating state samples. Finally, a target model is trained based on the operating state samples and adversarial examples to obtain the trained target model. Through the above processing method, feature vectors can be extracted from the operating state samples, and the observation probability of the feature vector in each preset operating state of the server can be determined. This enables the generation of adversarial examples based on the original operating state samples, and the expansion of the model's training samples using adversarial examples. This allows the target model to fully fit complex actual anomaly situations, thereby improving the comprehensiveness of the model training process and ultimately enhancing the accuracy of the trained target model in anomaly detection.

[0296] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0297] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0298] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0299] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0300] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0301] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0302] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A model training method, characterized in that, include: Obtain a sample of the server's operating status; wherein, the sample of the operating status is the operating status data collected by the server during normal operation. Feature vectors are obtained by extracting features from the running state samples; The feature vector is fitted to obtain the observation probability of the feature vector under each preset operating state of the server; wherein the observation probability is used to indicate the probability of the feature vector appearing under each preset operating state, and the preset operating state is the load state of the server. Based on the observation probability, the feature vector, and the running state sample, generate adversarial examples; The target model is trained based on the running state samples and the adversarial samples to obtain the trained target model; The step of generating adversarial examples based on the observation probability, the feature vector, and the running state samples includes: Within a preset time period, the operating state that appears most frequently among the preset operating states is determined to obtain the target operating state; The model parameters of the target model are adjusted based on the running state samples to obtain the target model after initial training; After initial training, the target model outputs the predicted probability of each feature vector under the target operating state. A first sub-observation probability is determined from the observation probabilities, wherein the first sub-observation probability is used to indicate the probability that the feature vector appears in the target operating state; Determine the Heringer distance between the first sub-observation probability and the predicted probability; The perturbation direction is determined based on the gradient of the Herringer distance; Based on the maximum perturbation amplitude, the number of iterations, the running state samples processed in each iteration cycle, and the gradient, the amount of perturbation added in each iteration cycle is determined; The running state sample is iteratively perturbed based on the perturbation direction and the amount of perturbation added in each iteration cycle, and the adversarial sample is determined based on the perturbation result that satisfies the iteration termination condition.

2. The method according to claim 1, characterized in that, The iteration termination condition includes at least one of the following: the difference between the perturbation result and the running state sample processed in the first iteration cycle is greater than or equal to the maximum perturbation amplitude; the Heringer distance corresponding to the running state sample processed in the current iteration cycle is less than or equal to the Heringer distance corresponding to the running state sample processed in the previous iteration cycle; and the Heringer distance corresponding to the running state sample processed in the current iteration cycle is greater than or equal to the distance threshold.

3. The method according to claim 1, characterized in that, The step of extracting features from the running state samples to obtain feature vectors includes: Determine the feature extraction window and feature extraction method from multiple dimensions; Based on the feature extraction window and the feature extraction method, feature extraction is performed on the running state sample to obtain the feature vector.

4. The method according to claim 3, characterized in that, The multiple dimensions include: peak utilization of computing resources, idle rate of computing resources, fluctuation of workload in the current cycle, and periodic changes in workload; The process of determining the feature extraction window from multiple dimensions includes: Based on the highest usage rate and the degree of fluctuation, a feature extraction window for the first time dimension is determined; The feature extraction window for the second time dimension is determined based on the idle rate; The feature extraction window for the third time dimension is determined based on the periodic changes; wherein the unit time corresponding to the first time dimension, the second time dimension, and the third time dimension is different.

5. The method according to claim 4, characterized in that, The step of extracting features from the running state sample based on the feature extraction window and the feature extraction method to obtain the feature vector includes: Based on the feature extraction window of the first time dimension, determine the first quantile of the highest usage rate and the Shannon entropy of the degree of fluctuation; The second quantile of the idle rate is determined based on the feature extraction window of the second time dimension; wherein the quantile value of the second quantile is less than the quantile value of the first quantile. The coefficient of variation of the periodic changes is determined based on the feature extraction window of the third time dimension; The feature vector is determined based on the first quantile, the Shannon entropy, the second quantile, and the coefficient of variation.

6. The method according to claim 1, characterized in that, Each of the aforementioned operating state samples contains multiple feature vectors; the fitting process of the feature vectors to obtain the observation probability of the feature vectors in each preset operating state of the server includes: Determine the mean and standard deviation of the feature vector under each preset operating state; A covariance matrix is ​​constructed based on the standard deviation; wherein the covariance matrix is ​​used to indicate the degree of correlation between any two eigenvectors. The observation probability is determined based on the mean and the covariance matrix.

7. The method according to claim 6, characterized in that, The construction of the covariance matrix based on the standard deviation includes: The diagonal elements are determined based on the standard deviation. Determine the correlation coefficient between any two feature vectors under each preset operating state; The off-diagonal elements are determined based on the product of the correlation coefficient and the standard deviation of any two eigenvectors. The covariance matrix is ​​determined based on the diagonal elements and the off-diagonal elements.

8. An anomaly detection method, characterized in that, include: Obtain the server's predicted operational status data; The target model is used to process the data of the operating state to be predicted to obtain the processing result; wherein the target model is trained by the model training method of any one of claims 1 to 7. Anomaly detection is performed on the server based on the probability distribution of the data to be predicted and the Herringer distance between the processing results, and anomaly detection results are obtained; wherein, the probability distribution is used to indicate the probability of the feature vector in the data to be predicted appearing in each preset operating state of the server.

9. A model training device, characterized in that, include: A sample acquisition unit is used to acquire a sample of the server's operating status; wherein the sample of the operating status is the operating status data collected by the server in its normal operating state; The feature extraction unit is used to extract features from the running state samples to obtain feature vectors; A vector fitting unit is used to fit the feature vector to obtain the observation probability of the feature vector under each preset operating state of the server; wherein the observation probability is used to indicate the probability of the feature vector appearing under each preset operating state, and the preset operating state is the load state of the server. The sample generation unit is used to generate adversarial samples based on the observation probability, the feature vector, and the running state samples; The model training unit is used to train the target model based on the running state samples and the adversarial samples to obtain the trained target model. The step of generating adversarial examples based on the observation probability, the feature vector, and the running state samples includes: Within a preset time period, the operating state that appears most frequently among the preset operating states is determined to obtain the target operating state; The model parameters of the target model are adjusted based on the running state samples to obtain the target model after initial training; After initial training, the target model outputs the predicted probability of each feature vector under the target operating state. A first sub-observation probability is determined from the observation probabilities, wherein the first sub-observation probability is used to indicate the probability that the feature vector appears in the target operating state; Determine the Heringer distance between the first sub-observation probability and the predicted probability; The perturbation direction is determined based on the gradient of the Herringer distance; Based on the maximum perturbation amplitude, the number of iterations, the running state samples processed in each iteration cycle, and the gradient, the amount of perturbation added in each iteration cycle is determined; The running state sample is iteratively perturbed based on the perturbation direction and the amount of perturbation added in each iteration cycle, and the adversarial sample is determined based on the perturbation result that satisfies the iteration termination condition.

10. An anomaly detection device, characterized in that, include: The data acquisition unit is used to acquire the server's operational status data to be predicted. A data processing unit is configured to process the data of the operating state to be predicted using a target model to obtain a processing result; wherein the target model is trained using the model training method described in any one of claims 1 to 7. An anomaly detection unit is used to perform anomaly detection on the server based on the probability distribution of the data to be predicted and the Herringer distance between the processing results, and obtain anomaly detection results; wherein, the probability distribution is used to indicate the probability of the feature vector in the data to be predicted appearing in each preset operating state of the server.

11. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of the model training method as described in any one of claims 1 to 7; or perform the steps of the anomaly detection method as described in claim 8.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the model training method as described in any one of claims 1 to 7; or performs the steps of the anomaly detection method as described in claim 8.

13. A computer program product, characterized in that, The computer program product is stored in a storage medium and is executed by at least one processor to implement the model training method as described in any one of claims 1 to 7; or to perform the steps of the anomaly detection method as described in claim 8.

Images