A model training method and related apparatus

Abstract

This application provides a model training method and related apparatus, comprising: after determining that a server's detection mode is suspected of being abnormal through an anomaly detection model, outputting the server's monitoring data and the suspected anomaly detection mode at the time of the suspected anomaly, and obtaining a first feedback result from the user regarding the suspected anomaly detection mode. Based on the first feedback result and the server's monitoring data, obtaining a first dataset, and training the anomaly detection model using the first dataset. After monitoring that the training of the anomaly detection model using the first dataset meets preset conditions, statistically analyzing the anomaly situation of any suspected anomaly detection mode to obtain statistical information for any suspected anomaly detection mode, outputting the statistical information, and obtaining a second feedback result from the user regarding the statistical information. Based on the second feedback result and the first feedback result, obtaining a second dataset, and training the anomaly detection model using the second dataset.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a model training method and related device. BACKGROUND

[0002] With the popularity of cloud computing and big data applications, the scale of data centers and server clusters is continuously expanding. The server in the data center and server cluster is abnormal, which affects the use of the data center and server cluster, and therefore it is necessary to detect the server. The current anomaly detection model can be used for anomaly detection of the server. The anomaly detection model can be trained using existing monitoring strategies and hierarchical diagnosis strategies. The detection mechanism used by the monitoring strategy and the hierarchical diagnosis strategy is fixed, so the performance of the anomaly detection model gradually declines in the later stage of deployment. The anomaly detection model can be trained using pure supervised learning. The pure supervised learning relies on historical data, and the anomaly pattern determined based on the historical data is fixed, so it is difficult for the anomaly detection model to add new anomaly patterns. SUMMARY

[0003] In view of the above problems, the present application provides a model training method and related device to ensure the performance of the anomaly detection mode and improve the recognition ability of the new anomaly mode. The specific scheme is as follows:

[0004] The first aspect of the present application provides a model training method, comprising:

[0005] After determining that the detection mode of the server is suspected to be abnormal by the anomaly detection model, output the monitoring data of the server when the suspected abnormality and the detection mode of the suspected abnormality;

[0006] Obtain a first feedback result of the user on the detection mode of the suspected abnormality. The first feedback result is an artificial judgment result of whether the detection mode of the suspected abnormality is abnormal;

[0007] According to the first feedback result and the monitoring data of the server, obtain a first data set, train the anomaly detection model using the first data set, and use the trained anomaly detection model to detect the abnormality of the monitoring data of the server;

[0008] After monitoring that the training of the anomaly detection model using the first data set meets the preset condition, count the abnormality of any suspected abnormality detection mode to obtain statistical information of any suspected abnormality detection mode, and output the statistical information;

[0009] Obtain a second feedback result of the user on the statistical information. The second feedback result is an artificial judgment result of the abnormality of the detection mode of the suspected abnormality. The abnormality division granularity of the second feedback result is smaller than the abnormality division granularity of the first feedback result.

[0010] According to the second feedback result and the first feedback result, a second data set is obtained, and the anomaly detection model is trained by using the second data set, so as to perform anomaly detection on the monitoring data of the server by using the trained anomaly detection model.

[0011] In a possible implementation, the counting of the anomaly conditions of any suspected anomaly detection mode to obtain the statistical information of any suspected anomaly detection mode includes: after it is monitored that the training of the anomaly detection model by using the first data set meets a preset condition, counting the anomaly times of any suspected anomaly detection mode to obtain the total anomaly times of any suspected anomaly detection mode, and the total anomaly times are the statistical information.

[0012] In a possible implementation, the first feedback result is a binary classification result of the suspected anomaly detection mode by a user.

[0013] The obtaining of the second feedback result of the user on the statistical information includes: obtaining an anomaly degree labeled by the user on the suspected anomaly detection mode, and the anomaly degree is labeled with reference to the total anomaly times of the suspected anomaly detection mode.

[0014] In a possible implementation, any data in the first data set includes monitoring data of a suspected anomaly server in a time window, a dimension number of the monitoring data, and a first feedback result of a suspected anomaly detection mode in a time window, and the suspected anomaly server is a server whose detection mode is suspected to be abnormal.

[0015] The anomaly detection model includes a plurality of convolution layers, and a dimension of a low-rank parameter matrix of each convolution layer is determined according to a dimension of the monitoring data and a layer number of the convolution layer in the anomaly detection model.

[0016] The training of the anomaly detection model by using the first data set includes: training the low-rank parameter matrix of each convolution layer in the anomaly detection model by using the monitoring data of the suspected anomaly server and the first feedback result of the suspected anomaly detection mode.

[0017] In a possible implementation, any data in the second data set includes: monitoring data of a suspected anomaly server in a time window, a dimension number of the monitoring data, a first feedback result of a suspected anomaly detection mode in a time window, and a second feedback result of any suspected anomaly detection mode in a time window.

[0018] The anomaly detection model comprises a plurality of convolution layers, and a dimension of a low-rank parameter matrix of each convolution layer is determined according to a number of dimensions of the monitoring data and a number of layers of the convolution layer in the anomaly detection model.

[0019] The training of the anomaly detection model by using the second data set comprises: calculating a reward value of any data in the second data set and calculating an advantage value of the reward value of the any data;

[0020] According to the reward value of the any data, the advantage value of the reward value of the any data, and a preset loss function, a loss value is calculated, the preset loss function corrects the loss value to a preset maximum loss value when the loss value is greater than the preset maximum loss value, and corrects the loss value to a preset minimum loss value when the loss value is less than the preset minimum loss value;

[0021] The low-rank parameter matrix of each convolution layer in the anomaly detection model is trained by using the loss value.

[0022] In a possible implementation, when the detection mode of the server is determined to be suspiciously abnormal by the anomaly detection model, the monitoring data of the server when the anomaly is suspected and the detection mode of the suspected anomaly are outputted, comprising:

[0023] After the monitoring data of the server is detected for at least twice by the anomaly detection model, a detection mode that is determined to be suspiciously abnormal in the at least twice is determined;

[0024] The monitoring data of the server when the anomaly is suspected and the detection mode of the suspected anomaly are outputted.

[0025] The second aspect of the present application provides a model training device, comprising:

[0026] An output unit is configured to output the monitoring data of the server when the anomaly is suspected and the detection mode of the suspected anomaly when the detection mode of the server is determined to be suspiciously abnormal by the anomaly detection model;

[0027] An acquisition unit is configured to acquire a first feedback result of a user on the detection mode of the suspected anomaly, the first feedback result being an artificial judgment result on whether the detection mode of the suspected anomaly is abnormal;

[0028] A training unit is configured to obtain a first data set according to the first feedback result and the monitoring data of the server, train the anomaly detection model by using the first data set, and perform anomaly detection on the monitoring data of the server by using the trained anomaly detection model.

[0029] The statistical unit is used to statistically analyze the anomaly of any suspected anomaly detection mode after monitoring that the training of the anomaly detection model using the first dataset meets the preset conditions, so as to obtain statistical information of any suspected anomaly detection mode.

[0030] The output unit is also used to output the statistical information;

[0031] The acquisition unit is further configured to acquire a second feedback result from the user on the statistical information. The second feedback result is a manual judgment result of the abnormality of the detection mode of the suspected abnormality. The abnormality division granularity of the second feedback result is smaller than the abnormality division granularity of the first feedback result.

[0032] The training unit is further configured to obtain a second dataset based on the second feedback result and the first feedback result, and to train the anomaly detection model using the second dataset, so as to use the trained anomaly detection model to perform anomaly detection on the server's monitoring data.

[0033] A third aspect of this application provides a computer program product including computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement the model training method of the first aspect or any implementation thereof.

[0034] A fourth aspect of this application provides an electronic device, including at least one processor and a memory connected to the processor, wherein:

[0035] The memory is used to store computer programs;

[0036] The processor is used to execute the computer program so that the electronic device can implement the model training method of the first aspect or any implementation thereof.

[0037] The fifth aspect of this application provides a computer storage medium carrying one or more computer programs, which, when executed by an electronic device, enable the electronic device to perform the model training method described in the first aspect or any implementation thereof.

[0038] By employing the above technical solution, this application provides a model training method and related apparatus. After determining that the server's detection mode is suspected of being abnormal through an anomaly detection model, the method outputs the server's monitoring data and the suspected abnormal detection mode at the time of the suspected anomaly, and obtains the user's first feedback result on the suspected abnormal detection mode. The first feedback result is a manual judgment result on whether the suspected abnormal detection mode is abnormal. Based on the first feedback result and the server's monitoring data, a first dataset is obtained, and the anomaly detection model is trained using the first dataset. After monitoring that the training of the anomaly detection model using the first dataset meets preset conditions, the anomaly situation of any suspected abnormal detection mode is statistically analyzed to obtain statistical information of any suspected abnormal detection mode, and the statistical information is output for the user to process, obtaining the user's second feedback result on the statistical information. The second feedback result is a manual judgment result on the anomaly situation of the suspected abnormal detection mode. Based on the second feedback result and the first feedback result, a second dataset is obtained, and the anomaly detection model is trained using the second dataset. Thus, the user's first and second feedback results on the detection mode are incorporated into the training process of the anomaly detection model. Since the user's first and second feedback results are the user's manual judgment of the suspected abnormal detection mode, the category to which the suspected abnormal detection mode belongs is updated iteratively through manual judgment. For example, if the category to which the suspected abnormal detection mode belongs is adjusted to abnormal mode by the user, then the suspected abnormal detection mode can be regarded as a newly added abnormal mode, so as to ensure the performance of the abnormal detection mode and improve the ability to identify newly added abnormal modes. Attached Figure Description

[0039] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0040] Figure 1 A flowchart of a model training method provided in this application;

[0041] Figure 2 This application provides a system architecture diagram of an anomaly detection system;

[0042] Figure 3 A flowchart of the short-cycle training submodule provided in this application;

[0043] Figure 4 A flowchart of the long-cycle training submodule provided in this application;

[0044] Figure 5 A schematic diagram of the structure of a model training device provided in this application;

[0045] Figure 6 A schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0046] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is for explaining specific embodiments only and is not intended to limit the scope of this application.

[0047] The embodiments of this application will now be described with reference to the accompanying drawings. Those skilled in the art will recognize that, with technological advancements and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are equally applicable to similar technical problems.

[0048] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same attributes in the embodiments of this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements but may include other elements not explicitly listed or inherent to such processes, methods, systems, products, or apparatus.

[0049] Currently, anomaly detection models can detect whether a server is abnormal. However, these models use fixed detection mechanisms and are trained using known detection patterns. This causes the performance of anomaly detection models to gradually decline in the later stages of deployment, and they also become difficult to identify unknown detection patterns.

[0050] To address the aforementioned technical problems, this application provides a model training method and related apparatus. After determining that a server's detection mode is suspected of being abnormal through an anomaly detection model, the method outputs the server's monitoring data and the suspected abnormal detection mode at the time of the suspected anomaly. It then obtains a first feedback result from the user regarding the suspected abnormal detection mode, which is a manual judgment of whether the suspected abnormal detection mode is abnormal. Based on the first feedback result and the server's monitoring data, a first dataset is obtained, and the anomaly detection model is trained using this first dataset. After monitoring that the training of the anomaly detection model using the first dataset meets preset conditions, the anomaly situation of any suspected abnormal detection mode is statistically analyzed to obtain statistical information for that mode. This statistical information is then output for user processing, resulting in a second feedback result from the user regarding the statistical information. This second feedback result is also a manual judgment of the suspected abnormal detection mode's anomaly situation. Based on the second and first feedback results, a second dataset is obtained, and the anomaly detection model is trained using this second dataset. Thus, the user's first and second feedback results regarding the detection mode are incorporated into the training process of the anomaly detection model. Since the user's first and second feedback results are the user's manual judgment of the suspected abnormal detection mode, the category to which the suspected abnormal detection mode belongs is updated iteratively through manual judgment. For example, if the category to which the suspected abnormal detection mode belongs is adjusted to abnormal mode by the user, then the suspected abnormal detection mode can be regarded as a newly added abnormal mode, so as to ensure the performance of the abnormal detection mode and improve the ability to identify newly added abnormal modes.

[0051] The model training method and related apparatus provided in the embodiments of this application will be described below with reference to the accompanying drawings. Please refer to... Figure 1 It illustrates an optional flow of a model training method provided in an embodiment of this application, which may include the following steps:

[0052] S101. After determining that the server's detection mode is suspected to be abnormal through the anomaly detection model, output the server's monitoring data and the suspected anomaly detection mode when the anomaly is suspected.

[0053] It's understandable that anomaly detection models are used to detect whether a server's detection mode is abnormal. In practical applications, server monitoring data is input into the anomaly detection model, and the model outputs the degree of anomalousness of the detection mode corresponding to that monitoring data. This degree of anomalousness represents the category to which the detection mode belongs; for example, the detection mode categories include anomalous mode, suspected anomalous mode, and no anomalous mode. When the detection mode corresponding to the monitoring data belongs to the suspected anomalous mode category, the server's detection mode is determined to be suspected of being abnormal.

[0054] For example, outlier scores If the value is 10, then the detection mode corresponding to the monitoring data belongs to the abnormal mode category; if it is 5, then the detection mode belongs to the abnormal mode category. Abnormal scores If the abnormal score is 9, the detection mode corresponding to the monitoring data belongs to the suspected abnormal mode. If the abnormal score is <5, the detection mode corresponding to the monitoring data belongs to the no abnormal mode. When the abnormal score of the detection mode is between [5,9], the detection mode with the abnormal score between [5,9] and the corresponding monitoring data are output.

[0055] After a server's detection mode is suspected of being abnormal, the monitoring data of the server at the time of the suspected abnormality and the suspected abnormal detection mode (i.e., the detection mode belonging to the suspected abnormal mode) can be saved first. When the output condition is met, the monitoring data of the server at the time of the suspected abnormality and the suspected abnormal detection mode are output. In one possible implementation, after receiving an administrator's inspection instruction, the monitoring data of the server at the time of the suspected abnormality and the suspected abnormal detection mode are output. The administrator's inspection instruction is the output condition, and the administrator is the user who manually judges the suspected abnormal detection mode. In another possible implementation, the anomaly detection model can perform anomaly detection on the server's monitoring data at regular intervals (e.g., 15 seconds). After the anomaly detection model has completed anomaly detection on all servers (e.g., all servers in a server cluster), the monitoring data of the server at the time of the suspected abnormality and the suspected abnormal detection mode are output. The completion of anomaly detection on all servers by the anomaly detection model is an output condition.

[0056] When an anomaly is suspected, the server's monitoring data and the suspected anomaly detection mode can be output in a one-to-one manner to ensure a correspondence between the monitoring data and the detection mode. After outputting the server's monitoring data and suspected anomaly detection mode, a prompt message can be sent to the user's electronic device to guide the user in taking appropriate action.

[0057] S102. Obtain the user's first feedback result on the suspected abnormal detection mode. The first feedback result is the manual judgment result of whether the suspected abnormal detection mode is abnormal, so that the user can decide whether to adjust the category to which the detection mode belongs.

[0058] In one possible implementation, the first feedback result is the binary classification result of the user's suspected anomaly detection pattern. This binary classification result includes two types: anomaly pattern and no-anomaly pattern. By performing this binary classification on the suspected anomaly detection pattern, the user can adjust the category of the detection pattern from suspected anomaly pattern to either anomaly pattern or no-anomaly pattern, such as adjusting the anomaly score of the detection pattern to 10 or 1, thereby collecting data. Is it abnormal? The binary classification results.

[0059] If the category of a suspected anomaly detection mode is adjusted to an anomaly mode, then the suspected anomaly detection mode can be considered a newly added anomaly mode; if the category of a suspected anomaly detection mode is adjusted to a no-anomaly mode, then the suspected anomaly detection mode can be considered a newly added no-anomaly mode.

[0060] S103. Based on the first feedback result and the server monitoring data, obtain the first dataset, use the first dataset to train the anomaly detection model, and use the trained anomaly detection model to perform anomaly detection on the server monitoring data.

[0061] In this embodiment, the first dataset may include the first feedback result and the server's monitoring data. Since the first feedback result adjusts the category to which the suspected abnormal detection mode belongs, the abnormal detection model can be iteratively updated after training with the first feedback result to detect the abnormal mode and / or the non-abnormal mode of the abnormal detection mode. This allows for the addition of abnormal modes and / or non-abnormal modes in the abnormal detection mode, thereby improving the abnormal detection model's ability to identify the newly added abnormal modes and / or non-abnormal modes.

[0062] In one possible implementation, training the anomaly detection model using the first dataset includes: training the low-rank parameter matrix of the anomaly detection model using the first feedback result and server monitoring data. That is, the anomaly detection model includes a low-rank parameter matrix and an original parameter matrix. Using the first feedback result and server monitoring data, only the low-rank parameter matrix is ​​trained. This improves the anomaly detection model's ability to identify newly added anomaly patterns and / or newly added non-anomaly patterns while reducing the amount of training data. The low-rank parameter matrix can be a LoRA (Low-Rank Adaptation) matrix, also known as LoRA weights.

[0063] One point needs to be clarified here: a detection pattern may be classified as a suspected anomaly in one anomaly detection, but it may be classified as an anomalous pattern or an anomaly-free pattern in the next anomaly detection. Therefore, to improve accuracy and precision, this embodiment can perform multiple (at least two) anomaly detections on the server's monitoring data using the anomaly detection model, and output the detection patterns that have been classified as suspected anomaly patterns in multiple anomaly detections, along with the corresponding monitoring data. These detection patterns, classified as suspected anomaly patterns in multiple anomaly detections, can then be manually judged. Based on the first feedback result and the server's monitoring data, a first dataset is obtained. Each piece of data in the first dataset includes the monitoring data of servers suspected of being anomalous within a time window, the number of dimensions of the monitoring data, and the first feedback result of the detection pattern suspected of being anomalous within a time window. The servers suspected of being anomalous are those whose detection patterns are suspected of being anomalous.

[0064] A time window can be the time taken for an anomaly detection mode to perform multiple anomaly detections. For example, if the anomaly detection mode performs an anomaly detection every 15 seconds and obtains the first dataset after 40 anomaly detections, then the time window is 10 minutes. The data in the first dataset is generated by using the first feedback results of the detection mode that has multiple suspected anomalies within 10 minutes and the monitoring data of the server to which the detection mode belongs.

[0065] For example, the tensor form of the first dataset is: input (batch_size, window_length, channels), label (batch_size, score_short). batch_size (batch size) represents the monitoring data (input) of one server within a time window and the user's feedback anomaly score (label). There are 30 such data entries, so batch_size is 30. The user feedback anomaly score is one form of the first feedback result.

[0066] window_length (time window), for example, if server monitoring data is collected every 15 seconds, 40 sets of monitoring data will be collected in 10 minutes, and window_length is 40.

[0067] Channels represent the number of dimensions of the monitoring data. The dimensions of the monitoring data include CPU (Central Processing Unit) utilization, total number of bytes of memory, number of bytes of memory used, total number of bytes of memory swap space, network RX (receive) speed, etc.

[0068] When training the low-rank parameter matrix in the anomaly detection model, a set of monitoring data and its corresponding anomaly score can be input each time. The training of the low-rank parameter matrix is ​​completed using all monitoring data and their corresponding anomaly scores within a time window. The anomaly score corresponding to the monitoring data can be the anomaly score of the monitoring data's detection mode, or it can be the anomaly score reported by the user.

[0069] In some examples, the anomaly detection model includes multiple convolutional layers, and the dimension of the low-rank parameter matrix of each convolutional layer is determined according to the number of dimensions of the monitored data and the number of convolutional layers in the anomaly detection model; correspondingly, training the anomaly detection model can be done by training the low-rank parameter matrices of each convolutional layer in the anomaly detection model.

[0070] For example, the low-rank parameter matrix of the i-th convolutional layer is... , , Where C represents channels, the number of dimensions of the monitored data. and These are the two matrices obtained from the low-rank decomposition. This represents the rank of the low-rank parameter matrix in the i-th convolutional layer. Different convolutional layers... The value of is determined by the number of layers it belongs to. Different convolutional layers The value can be set to be the minimum in the middle layer and the maximum at both ends to present a U-shaped distribution. For example, if the anomaly detection model includes 8 convolutional layers, then... The possible choices are [8,8,6,4,4,6,8,8].

[0071] In this embodiment, users can manually determine only the detection patterns suspected of being abnormal, reducing their workload, accelerating the training of the anomaly detection model using the first dataset, and improving the timeliness of manual feedback. Furthermore, the first feedback result can be a binary classification result. For example, if the suspected abnormal detection pattern belongs to the category of anomaly pattern, its first feedback result can be 10, which is equivalent to amplifying the suspected abnormal detection pattern. Since this suspected abnormal detection pattern is a recently occurring anomaly, adjusting its classification to an anomaly pattern makes the anomaly detection model more sensitive to recently occurring anomalies and allows it to learn the features of newly added anomaly patterns more quickly, thereby improving its ability to identify new anomaly patterns.

[0072] S104. After monitoring that the training of the anomaly detection model using the first dataset meets the preset conditions, the anomaly situation of any suspected anomaly detection mode is statistically analyzed to obtain the statistical information of any suspected anomaly detection mode, and the statistical information is output.

[0073] In one possible implementation, the training status of the anomaly detection model can be the number of times the model has been trained, and the anomaly status of the suspected anomaly detection patterns can be the total number of anomalies in those patterns, representing the number of times each suspected anomaly detection pattern has been detected. Correspondingly, after detecting that the number of times the anomaly detection model has been trained using the first dataset is greater than or equal to a preset number, the number of anomalies for any suspected anomaly detection pattern is statistically analyzed to obtain the total number of anomalies for that pattern, which is a form of statistical information.

[0074] For example, the preset number of times can be, but is not limited to, 10 times. After training the anomaly detection model at least 10 times using the first dataset, for any suspected anomaly detection mode recorded in the first dataset used in the 10 training sessions, the total number of anomalies for any suspected anomaly detection mode is counted, and the total number of anomalies is used as the statistical information of that detection mode.

[0075] S105. Obtain the user's second feedback result on the statistical information. The second feedback result is the manual judgment result of the abnormal situation of the suspected abnormal detection mode. The abnormal classification granularity of the second feedback result is smaller than the abnormal classification granularity of the first feedback result.

[0076] In this embodiment, the anomaly granularity is used to indicate the interval between anomaly patterns and non-anomaly patterns. For example, when determining whether an anomaly is determined by anomaly scores, the anomaly granularity is used to indicate the difference between two adjacent anomaly scores. As before, the first feedback result is a binary classification result, which can be represented by 10 or 1, so the anomaly granularity of the first feedback result is 10. The second feedback result is a finer-grained classification of 1-10. For example, the second feedback result can use 1, 5, and 10, where 1 represents a non-anomaly pattern, 5 represents a suspected anomaly pattern, and 10 represents an anomaly pattern, so the anomaly granularity of the second feedback result is 5. In some examples, the anomaly granularity of the second feedback result can be the same as the anomaly score granularity of the anomaly detection model.

[0077] In one possible implementation, obtaining the user's second feedback result on the statistical information includes: obtaining the user's labeling of the anomaly severity of the suspected anomaly detection patterns, with the anomaly severity labeled based on the total number of anomalies of the suspected anomaly detection patterns. In this embodiment, the suspected anomaly detection patterns are sorted according to the total number of anomalies, such as from high to low. The higher the ranking of a detection pattern, the more times it has been detected as suspected anomaly, and therefore the greater its anomaly severity. Its category should be adjusted to an anomaly mode; conversely, it can be adjusted to a no-anomaly mode. Patterns in the middle of the ranking can maintain their original category. If the anomaly severity is represented by an anomaly score, the higher the ranking, the higher the anomaly score.

[0078] One point to note here is that the first feedback result involves manually judging detection patterns that are suspected of being abnormal within a short period of time. This manual judgment process amplifies the detection patterns suspected of being abnormal, and this process may contain certain errors. Therefore, in this embodiment, after monitoring that the training of the anomaly detection model using the first dataset meets the preset conditions, a second manual judgment is performed on all detection patterns suspected of being abnormal that have been manually judged once. In the second manual judgment, the total number of abnormalities for each suspected abnormal detection pattern is taken into account to make corrections. The higher the total number of abnormalities for a detection pattern, the more times that detection pattern has been detected as suspected abnormal. By taking into account the total number of abnormalities to correct the classification of the suspected abnormal detection patterns, errors can be reduced and the accuracy and precision of the classification of the detection patterns can be improved.

[0079] S106. Based on the second feedback result and the first feedback result, obtain the second dataset, use the second dataset to train the anomaly detection model, and use the trained anomaly detection model to perform anomaly detection on the server's monitoring data.

[0080] In this embodiment, the second dataset may include the first feedback result, the second feedback result, and server monitoring data. Because the second feedback result adjusts the classification of suspected anomaly detection patterns, training the anomaly detection model using the second feedback result can iteratively update the classification of detection patterns, thereby improving the anomaly detection model's ability to identify various types of detection patterns. In one possible implementation, training the anomaly detection model using the second dataset includes: training the low-rank parameter matrix in the anomaly detection model using the first feedback result, the second feedback result, and server monitoring data. For an explanation of the low-rank parameter matrix, please refer to the above description; it will not be detailed here.

[0081] The second feedback result is executed after monitoring that the training of the anomaly detection model using the first dataset meets the preset conditions. Therefore, the interval time for training the anomaly detection model using the second dataset is longer than the interval time for training the anomaly detection model using the first dataset. Thus, training the anomaly detection model using the second dataset can be regarded as a long-cycle loop, while training the anomaly detection model using the first dataset can be regarded as a short-cycle loop.

[0082] In some examples, any data in the second dataset includes: monitoring data of servers suspected of being abnormal within a time window, the number of dimensions of the monitoring data, the first feedback result of the detection mode of the suspected abnormality within a time window, and the second feedback result of the detection mode of any suspected abnormality within a time window.

[0083] A time window can be the time taken for the anomaly detection pattern to complete a preset number of training iterations. The time window for the second dataset is longer than the time window for the first dataset. The tensor form of the second dataset is:

[0084] input0(batch_size, window_length, channels), input1(batch_size, score_short), input2(batch_size, score_long). Please refer to the description of the first dataset above for input0 and input1. In input2, score_long is the exception score fed back according to the total number of exceptions (a form of the second feedback result).

[0085] One approach to training an anomaly detection model using a second dataset includes: calculating the reward value and the advantage value of the reward value for any data point in the second dataset; calculating the loss value based on the reward value, the advantage value, and a preset loss function; adjusting the loss value to the preset maximum loss value when it is greater than the preset maximum loss value, and adjusting it to the preset minimum loss value when it is less than the preset minimum loss value; and using the loss value to train the low-rank parameter matrix of each convolutional layer in the anomaly detection model.

[0086] In this embodiment, the reward value can be calculated using a preset reward model. This preset reward model can be trained based on the historical reward values ​​of the second historical dataset and any data point within it. For example, the preset reward model could be an RLHF (Reinforcement Learning from Human Feedback) reward model, which can be a simple MLP (Multilayer Perceptron) model. After obtaining the second dataset, the RLHF reward model is used to output the reward value for each data point. The reward value for each data point can be input into the GAE (Generalized Advantage Estimation) algorithm to obtain the advantage value output by the GAE algorithm. Then, the reward value and advantage value of the same data point are input into a preset loss function to obtain the loss value output by the preset loss function. The preset loss function can be the PPO (Proximal Policy Optimization) algorithm. The PPO algorithm employs a clipping mechanism and sets a maximum and minimum loss value to avoid catastrophic forgetting.

[0087] Because the second feedback result can improve the accuracy and precision of the classification to which the detected pattern belongs, training the anomaly detection model with the second feedback result can not only improve the recognition ability but also improve the accuracy and precision.

[0088] As can be seen from the above technical solution, the model training method provided in this embodiment, after determining that the server's detection mode is suspected of being abnormal through the anomaly detection model, outputs the server's monitoring data and the suspected abnormal detection mode when the anomaly is suspected, and obtains the user's first feedback result on the suspected abnormal detection mode. The first feedback result is a manual judgment result on whether the suspected abnormal detection mode is abnormal. Based on the first feedback result and the server's monitoring data, a first dataset is obtained, and the anomaly detection model is trained using the first dataset. After monitoring that the training of the anomaly detection model using the first dataset meets preset conditions, the anomaly situation of any suspected abnormal detection mode is statistically analyzed to obtain statistical information of any suspected abnormal detection mode, and the statistical information is output for the user to process, obtaining the user's second feedback result on the statistical information. The second feedback result is a manual judgment result on the anomaly situation of the suspected abnormal detection mode. Based on the second feedback result and the first feedback result, a second dataset is obtained, and the anomaly detection model is trained using the second dataset. Thus, the user's first and second feedback results on the detection mode are incorporated into the training process of the anomaly detection model. Since the user's first and second feedback results are the user's manual judgment of the suspected abnormal detection mode, the category to which the suspected abnormal detection mode belongs is updated iteratively through manual judgment. For example, if the category to which the suspected abnormal detection mode belongs is adjusted to abnormal mode by the user, then the suspected abnormal detection mode can be regarded as a newly added abnormal mode, so as to ensure the performance of the abnormal detection mode and improve the ability to identify newly added abnormal modes.

[0089] Furthermore, the first and second feedback results allow for continuous manual determination of the classification of suspected anomaly detection modes, thereby continuously improving the accuracy and precision of anomaly detection modes. The anomaly detection mode can perform anomaly checks every 15 seconds, meeting the monitoring needs of large-scale server clusters and exhibiting high scalability.

[0090] In some examples, the anomaly detection model can be a TCN (Temporal Convolutional Network) model. A TCN model can take multi-dimensional monitoring data as input and output anomaly scores. Because the TCN model is entirely based on convolutions, it can achieve fully parallel computation in the time dimension, resulting in extremely high throughput and extremely low latency. Therefore, it is suitable for large-scale real-time inference to meet the monitoring needs of large-scale server clusters.

[0091] The basic structure in the TCN model is the residual block (ResBlock), which can be composed of two causal convolutions, in the form of:

[0092] →[Conv1d(dilation=d, k=K, causal) → WeightNorm → ReLU → Dropout]

[0093] → [Conv1d(dilation=d, k=K, causal) → WeightNorm → ReLU → Dropout]

[0094] → + Residual.

[0095] The residual block is repeated in L layers, with the dilation rate of each layer following a sequence of 1, 2, 4, 8...2. L-1 Incremental receptive fields are achieved through layer-by-layer dilation convolution, and independent LoRA weights are designed for each dilation rate. For example, a set of LoRA weights is inserted after each of the two convolutional layers in the i-th residual block. , , , This is used to independently fine-tune the weights of this layer, where C represents channels, the number of dimensions of the monitored data. This represents the rank of the LoRA weights in the i-th layer residual block. The inflation rate of residual blocks differs between layers, and the corresponding... Different sizes need to be selected, usually set with the middle layer being the smallest and the two ends being the largest. For example, if L=8, and the set of expansion rates is [1,2,4,8,16,32,64,128], then... The possible choices are [8,8,6,4,4,6,8,8].

[0096] By independently inserting LoRA weights into each convolutional layer, only a few parameters need to be added, and the weights of that convolutional layer can be finely tuned independently. Experiments show that this type of structure can significantly improve performance in anomaly detection tasks without increasing the complexity of the backbone, such as significantly improving the anomaly detection F1 score by 2 to 5 percentage points.

[0097] To enable anomaly detection of servers using an anomaly detection model, and to update and deploy the anomaly detection model during the anomaly detection process, this embodiment provides an anomaly detection system. The system architecture of this anomaly detection system is as follows: Figure 2 As shown, the anomaly detection system may include: a data collection module, an evaluation module, a management interaction module, a training module, and a CI (Continuous Integration) / CD (Continuous Deployment) deployment module.

[0098] The data collection module can be integrated into the data collection server, and a data monitoring system such as Prometheus can be deployed in the data collection module to collect monitoring data from the server.

[0099] The evaluation module can be integrated into a GPU (Graphics Processing Unit) server. This module incorporates an anomaly detection model, which processes the server's monitoring data to determine the classification of the detection patterns corresponding to the monitoring data. The anomaly detection model can be a TCN model. The evaluation module can also integrate a LoRA loader and a reward submodule. The LoRA loader loads LoRA weights into the convolutional layers of the anomaly detection model, and the reward submodule trains a reward model, which can be trained for up to 1000 epochs.

[0100] The management interaction module can be integrated into the management server. The management interaction module is used to execute the automated control mechanism. The automated control mechanism is used to provide a monitoring and management interface to users (such as administrators). The monitoring and management interface can output the detection mode of suspected anomalies, statistical information, etc., to collect the first feedback result and the second feedback result from the administrator.

[0101] The training module can be integrated into the GPU server. It includes short-cycle training sub-modules and long-cycle training sub-modules. The short-cycle training sub-module trains the anomaly detection model using a first dataset (short-cycle dataset), and the long-cycle training sub-module trains the anomaly detection model using a second dataset (long-cycle dataset). The evaluation and training modules can be integrated into different GPU servers, allowing one GPU server to be dedicated to anomaly detection while another GPU server trains and updates the anomaly detection model in parallel, thus isolating training and detection resources. Each GPU server can be configured with four A100 GPUs to improve processing efficiency.

[0102] The CI / CD deployment module can be integrated into the CI / CD support server. This module deploys the CI / CD support system, which continuously updates the anomaly detection model in the evaluation module, enabling one-click deployment without manual intervention and ensuring high system stability. The CI / CD support system has a trigger latency of less than one minute, enabling rapid updates and deployment of the anomaly detection model.

[0103] The process of the short-cycle training submodule is as follows: Figure 3 As shown, the following steps may be included:

[0104] 1) The anomaly detection model in the evaluation module performs anomaly detection on all servers at regular intervals, such as every 15 seconds. All servers can be all servers in the server cluster or data center.

[0105] 2) Obtain the anomaly score for any detection mode output by the anomaly detection model, and filter out suspected anomaly detection modes from all detection modes, such as anomaly scores. 10. The detection mode belongs to the anomaly mode category, 5. Abnormal scores 9. If the detection mode belongs to the suspected abnormal mode category and the abnormality score is <5, and the detection mode belongs to the no abnormal mode category, then the detection mode is a suspected abnormal detection mode when the detection mode belongs to the suspected abnormal mode category.

[0106] 3) Obtain the user's first feedback result on the suspected anomaly detection mode. The first feedback result is... Is it abnormal? The binary classification results.

[0107] 4) Obtain the first dataset, which includes the first feedback result and the corresponding monitoring data.

[0108] 5) Train the low-rank parameter matrix of the anomaly detection model using the first dataset. For example, the first dataset can include 100 to 200 items, and the training steps can be 500 steps.

[0109] 6) After training the anomaly detection model, the new low-rank parameter matrix is ​​automatically deployed to the anomaly detection model in the evaluation module through the CI / CD support system.

[0110] The process of the long-cycle training submodule is as follows: Figure 4 As shown, the following steps may be included:

[0111] 11) After the short-cycle training submodule trains the anomaly detection model 10 times, the total number of anomalies in the suspected anomaly detection patterns is counted. Specifically, training the anomaly detection model 10 times means performing 10 anomaly detections using the anomaly detection model, and the total number of times the suspected anomaly detection patterns appear in the 10 anomaly detections needs to be counted.

[0112] 12) Sort and output the detection modes of suspected anomalies according to the total number of anomalies, and obtain the user's second feedback result on the detection modes of suspected anomalies. The second feedback result can be anomaly score, and the granularity of the anomaly score is smaller than the granularity of the binary classification result.

[0113] 13) Obtain the second dataset, which includes the first feedback result, the second feedback result, and the monitoring data.

[0114] 14) Call the reward model to calculate the reward value for each data point in the second dataset, and obtain the advantage value of the reward value for each data point.

[0115] 15) Calculate the loss value based on the reward value of any data, the advantage value of the reward value of any data, and the preset loss function. When the loss value is greater than the preset maximum loss value, the preset loss function will correct the loss value to the preset maximum loss value. When the loss value is less than the preset minimum loss value, the preset loss function will correct the loss value to the preset minimum loss value.

[0116] 16) Use the loss value to train the low-rank parameter matrix of the anomaly detection model.

[0117] 17) After training the anomaly detection model, the new low-rank parameter matrix is ​​automatically deployed to the anomaly detection model in the evaluation module through the CI / CD support system.

[0118] The above describes a model training method provided by an embodiment of this application. The following describes the apparatus for performing the above model training method.

[0119] Please see Figure 5 , Figure 5 This is a schematic diagram of a model training device provided in an embodiment of this application. Figure 5 As shown, the model training device may include: an output unit 10, an acquisition unit 20, a training unit 30, and a statistics unit 40.

[0120] Output unit 10 is used to output the server's monitoring data and the detection mode of the suspected anomaly when the server's detection mode is suspected to be abnormal after the anomaly detection model is used.

[0121] The acquisition unit 20 is used to acquire the user's first feedback result on the detection mode of suspected anomalies. The first feedback result is the manual judgment result on whether the detection mode of suspected anomalies is abnormal.

[0122] Training unit 30 is used to obtain a first dataset based on the first feedback result and the server's monitoring data, and to train an anomaly detection model using the first dataset, so as to use the trained anomaly detection model to detect anomalies in the server's monitoring data.

[0123] The statistics unit 40 is used to statistically analyze the anomaly of any suspected anomaly detection mode after monitoring that the training of the anomaly detection model using the first dataset meets the preset conditions, so as to obtain the statistical information of any suspected anomaly detection mode.

[0124] Output unit 10 is also used to output statistical information.

[0125] The acquisition unit 20 is also used to acquire the user's second feedback result on the statistical information. The second feedback result is the manual judgment result of the abnormal situation of the detection mode of suspected abnormality. The abnormality division granularity of the second feedback result is smaller than the abnormality division granularity of the first feedback result.

[0126] Training unit 30 is also used to obtain a second dataset based on the second feedback result and the first feedback result, and to train the anomaly detection model using the second dataset, so as to use the trained anomaly detection model to perform anomaly detection on the server's monitoring data.

[0127] In one possible implementation, after monitoring that the training of the anomaly detection model using the first dataset meets the preset conditions, the statistics unit 40 performs statistics on the anomaly situation of any suspected anomaly detection mode to obtain the statistical information of any suspected anomaly detection mode. This includes: after monitoring that the number of training times of the anomaly detection model using the first dataset is greater than or equal to the preset number of training times, the number of anomalies in any suspected anomaly detection mode is counted to obtain the total number of anomalies in any suspected anomaly detection mode. The total number of anomalies is the statistical information.

[0128] In one possible implementation, the first feedback result is the binary classification result of the user's suspected anomaly detection pattern; the acquisition unit 20 acquires the second feedback result of the user's statistical information, which includes: acquiring the degree of anomaly labeled by the user for the suspected anomaly detection pattern, with the degree of anomaly labeled with reference to the total number of anomalies in the suspected anomaly detection pattern.

[0129] In one possible implementation, any data in the first dataset includes monitoring data of servers suspected of being abnormal within a time window, the number of dimensions of the monitoring data, and the first feedback result of a detection pattern of suspected abnormality within a time window. The servers suspected of being abnormal are those with a detection pattern of suspected abnormality. The anomaly detection model includes multiple convolutional layers, and the dimension of the low-rank parameter matrix of each convolutional layer is determined according to the dimension of the monitoring data and the number of layers in the anomaly detection model. The training unit 30 trains the anomaly detection model using the first dataset by: using the monitoring data of servers suspected of being abnormal and the first feedback result of the detection pattern of suspected abnormality to train the low-rank parameter matrix of each convolutional layer in the anomaly detection model.

[0130] In one possible implementation, any data in the second dataset includes: monitoring data of servers suspected of being abnormal within a time window, the number of dimensions of the monitoring data, the first feedback result of the detection mode of the suspected abnormality within a time window, and the second feedback result of the detection mode of any suspected abnormality within a time window; the anomaly detection model includes multiple convolutional layers, and the dimension of the low-rank parameter matrix of each convolutional layer is determined according to the number of dimensions of the monitoring data and the number of layers of the convolutional layer in the anomaly detection model; the training unit 30 trains the anomaly detection model using the second dataset by: calculating the reward value of any data in the second dataset and calculating the advantage value of the reward value of any data; calculating the loss value based on the reward value of any data, the advantage value of the reward value of any data, and a preset loss function, wherein the preset loss function corrects the loss value to the preset maximum loss value when the loss value is greater than the preset maximum loss value, and corrects the loss value to the preset minimum loss value when the loss value is less than the preset minimum loss value; and training the low-rank parameter matrix of each convolutional layer in the anomaly detection model using the loss value.

[0131] In one possible implementation, after the output unit 10 determines that the server's detection mode is suspected to be abnormal through the anomaly detection model, the output unit 10 outputs the server's monitoring data and the suspected anomaly detection mode when the anomaly is suspected, including: after performing at least two anomaly detections on the server's monitoring data through the anomaly detection model, determining that the detection mode is identified as suspected anomaly in at least two anomaly detections; and outputting the server's monitoring data and the suspected anomaly detection mode when the anomaly is suspected.

[0132] This application also provides an electronic device in its embodiments. (See reference...) Figure 6 The diagram illustrates a structural schematic suitable for implementing the electronic device in the embodiments of this application. The electronic device in the embodiments of this application may include, but is not limited to, fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 6 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0133] like Figure 6As shown, the electronic device may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 201, which can perform various appropriate actions and processes according to a program stored in ROM 202 or a program loaded from storage device 208 into RAM 203. When the electronic device is powered on, RAM 203 also stores various programs and data required for the operation of the electronic device. The processing unit 201, ROM 202, and RAM 203 are interconnected via bus 204. I / O interface 205 is also connected to bus 204. The processing unit 201 can be considered as a processor in the electronic device, and ROM 202, RAM 203, and storage device 208 can be considered as memory in the electronic device, wherein: the memory is used to store computer programs; the processor is used to execute the computer programs to enable the electronic device to implement any of the model training methods provided in the embodiments of this application.

[0134] Typically, the following devices can be connected to I / O interface 205: input devices 206 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 207 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 208 including, for example, memory cards, hard drives, etc.; and communication devices 209. Communication device 209 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0135] This application also provides a computer program product including computer-readable instructions, which, when executed on an electronic device, cause the electronic device to implement any of the model training methods provided in this application.

[0136] This application also provides a computer-readable storage medium that carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any of the model training methods provided in this application.

[0137] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0138] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0139] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0140] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A model training method, characterized in that, The method comprises: After determining that the detection mode of the server is suspected to be abnormal by the anomaly detection model, output the monitoring data of the server when suspected to be abnormal and the detection mode suspected to be abnormal; Obtain a first feedback result of the user on the detection mode suspected to be abnormal, the first feedback result being a manual determination result on whether the detection mode suspected to be abnormal is abnormal; According to the first feedback result and the monitoring data of the server, obtain a first data set, train the low-rank parameter matrix of each convolution layer in the anomaly detection model by using the first data set, and use the trained anomaly detection model to perform anomaly detection on the monitoring data of the server, wherein the values of different convolution layers in the anomaly detection model are set in a manner that the values of intermediate layers are minimum and the values of both ends are maximum; After monitoring that the training of the anomaly detection model by using the first data set satisfies a preset condition, count the abnormal conditions of any detection mode suspected to be abnormal to obtain statistical information of any detection mode suspected to be abnormal, and output the statistical information; Obtain a second feedback result of the user on the statistical information, the second feedback result being a manual determination result on the abnormal conditions of the detection mode suspected to be abnormal, and the abnormal division granularity of the second feedback result being smaller than that of the first feedback result; According to the second feedback result and the first feedback result, obtain a second data set, calculate the reward value of any data in the second data set, input the reward value into a generalized advantage estimation algorithm to obtain the advantage value of the reward value of any data output by the generalized advantage estimation algorithm; According to the reward value of any data, the advantage value of the reward value of any data, and a preset loss function, calculate a loss value, wherein the preset loss function corrects the loss value to a preset maximum loss value when the loss value is greater than the preset maximum loss value, and corrects the loss value to a preset minimum loss value when the loss value is less than the preset minimum loss value; Train the low-rank parameter matrix of each convolution layer in the anomaly detection model by using the loss value, so as to use the trained anomaly detection model to perform anomaly detection on the monitoring data of the server.

2. The model training method of claim 1, wherein, The counting of the abnormal conditions of any detection mode suspected to be abnormal to obtain statistical information of any detection mode suspected to be abnormal after monitoring that the training of the anomaly detection model by using the first data set satisfies a preset condition comprises: counting the number of abnormalities of any detection mode suspected to be abnormal to obtain the total number of abnormalities of any detection mode suspected to be abnormal after monitoring that the number of times of training of the anomaly detection model by using the first data set is greater than or equal to a preset number of times, and the total number of abnormalities is the statistical information.

3. The model training method of claim 2, wherein, The first feedback result is a binary classification result of the user on the detection mode suspected to be abnormal; The obtaining of the second feedback result of the user on the statistical information comprises: obtaining an abnormal degree labeled by the user on the detection mode suspected to be abnormal, and the abnormal degree is labeled with reference to the total number of abnormalities of the detection mode suspected to be abnormal.

4. The model training method of claim 1, wherein, Any data in the first data set comprises monitoring data of a suspected abnormal server in a time window, a dimension number of the monitoring data, and a first feedback result of a suspected abnormal detection mode in a time window, the suspected abnormal server being a server whose detection mode is suspected to be abnormal; The abnormality detection model comprises a plurality of convolution layers, and a dimension of a low-rank parameter matrix of each convolution layer is determined according to a dimension of the monitoring data and a layer number of the convolution layer in the abnormality detection model; The training of the low-rank parameter matrix of each convolution layer in the abnormality detection model by using the first data set comprises training the low-rank parameter matrix of each convolution layer in the abnormality detection model by using the monitoring data of the suspected abnormal server and the first feedback result of the suspected abnormal detection mode.

5. The model training method of claim 1, wherein, Any data in the second data set comprises monitoring data of a suspected abnormal server in a time window, a dimension number of the monitoring data, a first feedback result of a suspected abnormal detection mode in a time window, and a second feedback result of any suspected abnormal detection mode in a time window; The abnormality detection model comprises a plurality of convolution layers, and a dimension of a low-rank parameter matrix of each convolution layer is determined according to a dimension number of the monitoring data and a layer number of the convolution layer in the abnormality detection model. 6.The model training method of any one of claims 1 to 5, characterized in that, The output of the monitoring data of the server when suspected to be abnormal and the detection mode suspected to be abnormal after the abnormality detection model determines that the detection mode of the server is suspected to be abnormal comprises: After the abnormality detection model performs at least two times of abnormality detection on the monitoring data of the server, determining a detection mode that is determined to be suspected to be abnormal in the at least two times of abnormality detection; Outputting the monitoring data of the server when suspected to be abnormal and the detection mode suspected to be abnormal.

7. A model training apparatus characterized by comprising: Comprise: An output unit configured to output the monitoring data of the server when suspected to be abnormal and the detection mode suspected to be abnormal after the abnormality detection model determines that the detection mode of the server is suspected to be abnormal; An acquisition unit configured to acquire a first feedback result of the user on the detection mode suspected to be abnormal, the first feedback result being a manual judgment result on whether the detection mode suspected to be abnormal is abnormal; A training unit configured to obtain a first data set according to the first feedback result and the monitoring data of the server, train a low-rank parameter matrix of each convolution layer in the abnormality detection model by using the first data set, and perform abnormality detection on the monitoring data of the server by using the trained abnormality detection model, wherein values of different convolution layers in the abnormality detection model are set in a manner that intermediate layers are minimum and both ends are maximum; A statistical unit configured to, after monitoring that a training of the abnormality detection model by using the first data set satisfies a preset condition, perform statistics on abnormality of any suspected abnormal detection mode to obtain statistical information of any suspected abnormal detection mode; The output unit is further configured to output the statistical information. The acquisition unit is further configured to acquire a second feedback result of the user on the statistical information, the second feedback result being a manual determination result of an abnormal situation of the detection mode of the suspected anomaly, and an abnormal division granularity of the second feedback result being smaller than an abnormal division granularity of the first feedback result; The training unit is further configured to obtain a second data set according to the second feedback result and the first feedback result, calculate a reward value of any data in the second data set, input the reward value into a generalized advantage estimation algorithm, and obtain an advantage value of the reward value of any data output by the generalized advantage estimation algorithm; calculate a loss value according to the reward value of any data, the advantage value of the reward value of any data, and a preset loss function, correct the loss value to a preset maximum loss value when the loss value is greater than the preset maximum loss value, and correct the loss value to a preset minimum loss value when the loss value is less than the preset minimum loss value; train low-rank parameter matrices of each convolution layer in the anomaly detection model using the loss value, and perform anomaly detection on monitoring data of a server using the trained anomaly detection model.

8. A computer program product, characterised in that, The computer readable instructions, when executed on an electronic device, cause the electronic device to implement the model training method according to any one of claims 1 to 6.

9. An electronic device, comprising: The memory is configured to store computer programs, and the processor is configured to execute the computer programs to enable the electronic device to implement the model training method according to any one of claims 1 to 6. The memory is configured to store computer programs, and the processor is configured to execute the computer programs to enable the electronic device to implement the model training method according to any one of claims 1 to 6. The memory is configured to store computer programs, and the processor is configured to execute the computer programs to enable the electronic device to implement the model training method according to any one of claims 1 to 6.

10. A computer storage medium, characterized in that, ​

Images