A distributed computing power center infrastructure anomaly detection method

Abstract

The application discloses a distributed computing power center infrastructure anomaly detection method, and relates to the technical field of electric data processing. The method comprises the following steps: collecting bottom-layer hardware indexes, compressing the bottom-layer hardware indexes by introducing a sliding window compression algorithm based on curvature perception, and performing alignment processing to obtain the bottom-layer hardware indexes after alignment processing; performing feature extraction on the bottom-layer hardware indexes after alignment processing to obtain a comprehensive feature matrix containing feature vectors of each edge node; constructing a structure dynamic enhancement graph based on the feature vectors of each edge node in the comprehensive feature matrix; inputting the structure dynamic enhancement graph into a graph perturbation driven anomaly detection network to generate an abnormal score of the edge node; and comparing the abnormal score of the edge node with a threshold value to determine the state of the edge node. The method solves the problems of inaccurate data processing, poor anomaly detection accuracy and weak robustness in the distributed computing power center infrastructure anomaly detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electric data processing, and in particular to a distributed computing power center infrastructure anomaly detection method. BACKGROUND

[0002] In a distributed computing power center, there are usually hundreds to thousands of heterogeneous nodes, which are interconnected through high-speed networks, and carry out multi-task concurrent processing, dynamic resource scheduling and large-scale data transmission. However, due to the large number of nodes, complex operating environment and drastic load changes, the infrastructure layer of the computing power center is prone to hardware failures, abnormal jitter, local performance degradation or thermal runaway, and these abnormalities often manifest as subtle fluctuations in multi-dimensional hardware indicators, with strong concealment, high suddenness and complex propagation path. If these abnormalities cannot be detected and handled in a timely manner, it may lead to node performance degradation, computing power scheduling imbalance, and even system failure, seriously affecting the continuity and stability of upper-layer services.

[0003] In the prior art, the mainstream distributed system anomaly detection method is mainly based on centralized index collection and offline feature analysis, relying on unified aggregation and batch processing of raw operation data. This method has obvious limitations when facing high-frequency data, a large number of nodes and asynchronous sampling. On the one hand, the volume of raw data is large, and direct uploading will cause network congestion, and abnormal features are easily lost during compression; on the other hand, there is a time offset in data sampling between different nodes, and there is a lack of unified modeling capability for asynchronous indicators. In addition, existing models generally ignore the dynamic coordination relationship between nodes and the abnormal propagation path, and cannot effectively depict the complex pattern of state fluctuation of adjacent nodes caused by an abnormal node, resulting in high false negative rate and false positive rate. At the same time, traditional graph neural networks lack modeling mechanisms for perturbation-sensitive nodes in abnormal propagation modeling, making it difficult to effectively identify potential high-risk nodes that have a key impact on system stability but do not have extreme features. Therefore, there is an urgent need to provide a distributed computing power center infrastructure anomaly detection method to solve the above problems. SUMMARY

[0004] The present application provides a distributed computing power center infrastructure anomaly detection method to solve the problem of inaccurate data processing and poor anomaly detection accuracy and weak robustness in distributed computing power center infrastructure anomaly detection.

[0005] The distributed computing power center infrastructure anomaly detection method of the present application comprises the following steps:

[0006] S1, infrastructure of the distributed computing power center is taken as an edge node, data collection is performed at the edge node to obtain underlying hardware indexes; a sliding window compression algorithm based on curvature perception is introduced to perform compression processing on the underlying hardware indexes to obtain compressed underlying hardware indexes; alignment processing is performed to obtain aligned underlying hardware indexes; feature extraction is performed on the aligned underlying hardware indexes to obtain a comprehensive feature matrix containing feature vectors of each edge node;

[0007] S2, based on the feature vectors of each edge node in the comprehensive feature matrix, a structure dynamic enhancement graph is constructed; the structure dynamic enhancement graph is input into a graph perturbation driven anomaly detection network to generate an anomaly score of the edge node; the anomaly score of the edge node is compared with a threshold to determine the state of the edge node.

[0008] Preferably, the S1 specifically comprises:

[0009] In the implementation process of the sliding window compression algorithm based on curvature perception, the curvature of each underlying hardware index is generated based on the first derivative and the second derivative of each underlying hardware index.

[0010] Preferably, the S1 specifically comprises:

[0011] When the average value of the curvature of each underlying hardware index is greater than or equal to a preset threshold, the original underlying hardware index is retained without compression processing; when the average value of the curvature of each underlying hardware index is less than the preset threshold, a curvature weight function is introduced.

[0012] Preferably, the S1 specifically comprises:

[0013] Based on the curvature weight function of each underlying hardware index, a compressed index expression of each underlying hardware index is generated; based on the compressed index expression of each underlying hardware index, the compressed underlying hardware index is constituted.

[0014] Preferably, the S2 specifically comprises:

[0015] The nodes of the structure dynamic enhancement graph are edge nodes, and the edges of the structure dynamic enhancement graph are established based on the collaborative anomaly measurement between the nodes.

[0016] Preferably, the S2 specifically comprises:

[0017] The collaborative anomaly measurement between the nodes is generated by combining the feature vectors of the edge nodes with a Gaussian window and a normalization factor.

[0018] Preferably, the S2 specifically comprises:

[0019] In the graph perturbation driven anomaly detection network, a perturbation response factor is introduced.

[0020] Preferably, S2 specifically includes:

[0021] In each layer of graph perturbation-driven anomaly detection network propagation, the neighbor information aggregation is adjusted using the perturbation response factor to generate the representation vector of the node.

[0022] Preferably, S2 specifically includes:

[0023] Based on the output of the last layer of graph perturbation-driven anomaly detection network, the anomaly score of the node is calculated in combination with the perturbation response factor of the node.

[0024] The technical scheme of the present application has the following advantages:

[0025] 1. A curvature-aware sliding window compression algorithm is introduced. Compared with traditional sliding mean, sliding median and other compression methods, this method can actively identify key fluctuation segments in the compression stage, accurately capture weak abnormal signals in the underlying hardware indicators using curvature. At the same time, the curvature weight function constructed by introducing an exponential decay and a normalization suppression factor can adaptively reduce the compression fidelity requirement of low fluctuation areas; a logarithmic amplification modulation function is used for the compression area to enhance and retain small amplitude but high abnormality fluctuations. The above design ensures that the data compression rate is improved while the key feature information of early or weak anomalies is not lost, significantly improving the "monitorability" of the compression stage.

[0026] 2. By introducing collaborative anomaly measurement, not only is the graph structure constructed using physical connections, but also soft edge virtual connections are constructed through "abnormal resonance"; such edges are not only based on the similarity of underlying hardware indicators, but also have time sensitivity controlled by a Gaussian window, making the adjacency relationship closer to the actual abnormal propagation path; the connection probability of the node has real physical-logical meaning and is no longer a static graph setting, making the constructed graph structure dynamic, adaptive and controllable in propagation.

[0027] 3. The perturbation response factor is introduced to dynamically measure the sensitivity of each node to the output of the graph perturbation-driven anomaly detection network. Its technical significance lies in capturing "potential abnormal points" that are weak in feature space but have strong responses; adjusting the information propagation weight in the propagation path to achieve "directional awareness" and "propagation suppression / amplification" of anomalies. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 A flowchart of a distributed computing power center infrastructure anomaly detection method is provided. DETAILED DESCRIPTION

[0029] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0031] The following description, in conjunction with the accompanying drawings, details the specific scheme of the distributed computing center infrastructure anomaly detection method provided by the present invention.

[0032] See attached document Figure 1 The diagram illustrates a flowchart of an anomaly detection method for distributed computing center infrastructure provided by an embodiment of the present invention. The method includes the following steps:

[0033] S1. The infrastructure of the distributed computing center is used as edge nodes. Data is collected at the edge nodes to obtain the underlying hardware indicators. The underlying hardware indicators are compressed by introducing a curvature-aware sliding window compression algorithm to obtain the compressed underlying hardware indicators. Alignment processing is then performed to obtain the aligned underlying hardware indicators. Feature extraction is performed on the aligned underlying hardware indicators to obtain a comprehensive feature matrix containing the feature vectors of each edge node.

[0034] The infrastructure of the distributed computing center is used as edge nodes. Data is collected at these edge nodes to obtain underlying hardware metrics, including processor temperature, power supply voltage, current fluctuations, fan speed, memory usage, GPU utilization, I / O bandwidth, and disk response time. These underlying hardware metrics are used as raw data. To avoid the problem of excessive network resource consumption and high redundancy caused by direct uploading due to the extremely short sampling period and massive amount of raw data, the raw data is compressed and processed locally at the edge nodes to preserve its fidelity. A curvature-aware sliding window compression algorithm is introduced. This algorithm aims to retain key fluctuation behaviors of the underlying hardware metrics without losing possible abnormal features. The specific implementation process is as follows:

[0035] The mathematical expression for curvature is based on differential geometry theory. In the continuous time domain, at any time... The Underlying hardware metrics curvature Defined as:

[0036] ,

[0037] in, Indicates the first The underlying hardware metrics in time The first derivative of , i.e., the first derivative of . The instantaneous rate of change of each underlying hardware metric reflects its trend, calculated through sliding window difference. Indicates the first The underlying hardware metrics in time The second derivative of describes the second derivative of . The rate of change of the underlying hardware indicators, i.e., the acceleration, is obtained by subtracting again after moving differences. The denominator is constructed using cube roots to make the curvature more sensitive to rapid oscillations. When the curvature is small, the changes in the underlying hardware indicators are smooth and can be represented in a compressed manner; when the curvature is large, it indicates that there may be abnormal abrupt changes, which should be retained.

[0038] Furthermore, determine the length as Whether the average curvature of the underlying hardware metrics within the sliding window is lower than a preset threshold determined based on Bayesian estimation. When the value is greater than or equal to a preset threshold, the original underlying hardware specifications are retained without compression; when the value is less than the preset threshold, a curvature weight function is introduced to control the degree of compression. The specific form is as follows:

[0039] ,

[0040] in, For the first The underlying hardware metrics in time The curvature weight function represents the first... The underlying hardware metrics in time Curvature weights; This is a compression sensitivity parameter used to control the decay rate of the curvature response. It is determined using an automatic parameter tuning method based on Bayesian optimization, with a reference value range of [value missing]. ; It is an exponentially decaying term, used to rapidly decay the weights corresponding to high curvature; It is a normalized suppression factor used to suppress weight oscillations caused by high curvature. When the curvature is large, the curvature weight becomes smaller, indicating that the underlying hardware metric is more stable over time. Drastic changes should be preserved. Incorporating curvature weights, at a length of... Constructing compressed expression values ​​within a sliding window:

[0041] ,

[0042] in, It is the first The underlying hardware metrics in time The compressed expression of the indicators; This is the sliding window length, representing the sampling duration for backtracking. It is determined based on specific needs and can be set to 5. ; , It is a time index variable; It is the first A few underlying hardware metrics in the sliding window The moving average within the range is calculated using statistical methods; It is the first A few underlying hardware metrics in the sliding window The sliding standard deviation within the range is calculated using statistical methods; It is a small constant to prevent division by zero, such as ; It is a weighted average, reflecting the proportion of the time period that contributes to the compression result throughout the entire sliding window; It is a logarithmic amplification term used for nonlinear amplification of fluctuation values ​​within the sliding standard deviation scale.

[0043] The compressed underlying hardware specifications are obtained after the above processing. ;

[0044] Furthermore, to avoid time skew in sampling between different edge nodes, the compressed underlying hardware metrics of different edge nodes are aligned using existing dynamic time warping combined with sliding window resampling to obtain aligned underlying hardware metrics. Furthermore, feature extraction is performed using existing feature engineering techniques such as statistical analysis to obtain a comprehensive feature matrix. It contains the feature vectors of each edge node. ,in This represents the total number of edge nodes. It is the first The feature vectors of each edge node.

[0045] S2. Based on the feature vectors of each edge node in the comprehensive feature matrix, construct a dynamic enhancement graph of the structure; input the dynamic enhancement graph of the structure into the graph perturbation-driven anomaly detection network to generate anomaly scores for edge nodes; compare the anomaly scores of edge nodes with thresholds to determine the state of edge nodes.

[0046] Based on the feature vector of each edge node in the comprehensive feature matrix, a structural dynamic enhancement graph for anomaly detection is constructed. The nodes in the graph are the edge nodes. The establishment of edges depends not only on physical connections but also on the abnormal collaborative changes between different underlying hardware metrics, used to represent the probability of abnormal resonance between different node states; for two nodes... , Let its eigenvector time series be , Define nodes , The collaborative anomaly metric is :

[0047] ,

[0048] in, It is a node , Inter-coordination anomaly measurement; It is the first Each edge node in time eigenvectors; It is the first Each edge node in time eigenvectors; It is the Euclidean norm, representing the overall difference in the underlying hardware metrics of two nodes at that point in time; It is the time point at which the weights of the Gaussian window are centered, i.e., the middle of the window; The width of the Gaussian window is used to control the time sensitivity, which is determined based on autocorrelation analysis. The reference range is [range to be specified]. ; It is a time-weighted term, which assigns greater weight to time points closer to the center of the window. This is a normalization factor used to suppress the dominance of high-energy nodes, making the measurement more equitable. A larger cooperative anomaly measurement indicates high cooperative volatility between the two nodes during that time period, potentially suggesting anomalous propagation; if... Then at node , A soft, virtual edge is established between them for subsequent anomaly modeling and propagation. Threshold The value is determined based on the quantile clipping method of abnormal score distribution, with a reference range of values. .

[0049] After constructing the dynamically enhanced graph as described above, the graph and feature vectors are input into the graph perturbation-driven anomaly detection network. Unlike traditional graph convolutional models, the graph perturbation-driven anomaly detection network introduces a perturbation response factor during propagation to measure the node's responsiveness to anomaly injection. First, the perturbation response factor for each node is calculated:

[0050] ,

[0051] in, It is in time No. The disturbance response factor of each node, representing the time... No. Input features of each node For the overall loss function The perturbation response strength is such that a larger value indicates that the node is more sensitive to anomaly propagation. It is the loss function, and can be reconstruction loss, softmax cross-entropy loss, or contrastive loss, etc. It is the gradient of the input features with respect to the loss function, representing the gradient of the input features with respect to the loss function at time. No. Feature vectors of each node When a small perturbation is applied, the overall loss function The response speed is obtained through automatic differentiation or backpropagation algorithms.

[0052] Then, during the propagation of the graph perturbation-driven anomaly detection network at each layer, the neighbor information aggregation is adjusted using a perturbation response factor:

[0053] ,

[0054] in, It is the first In layer graph perturbation-driven anomaly detection networks, in time node The representation vector; It represents a node in the graph. The set of neighboring nodes; It is a node in the graph The index of the neighboring nodes; This indicates that from the neighboring node To the current node Information propagation weight, measured by collaborative anomaly The calculated propagation probabilities, after being normalized using softmax, are used as information propagation weights. It is the first Layer in time The trainable weight matrix is ​​optimized using gradient descent; It is in time node In the The state representation vector of a layer. for , It is a node In time eigenvectors; These are non-linear activation functions, such as ReLU, LeakyReLU, and ELU; It is in time No. The disturbance response factor of each node; It is the structural feature transformation term of the neighboring node in the current layer, used to extract its propagation direction, feature pattern or anomaly tendency in the graph structure; It is the anomalous disturbance-driven response term of neighboring nodes, which describes the ability of anomalous effects to propagate among neighbors; It is the weight adjustment term for the collaborative anomaly propagation path, representing the neighboring nodes. For the current node The degree of contribution to the state update.

[0055] Finally, after the output of the last layer graph perturbation-driven anomaly detection network, the time... node Abnormal rating :

[0056] ,

[0057] in, This refers to the number of layers in the perturbation-driven anomaly detection network, which is determined based on specific requirements, such as 3. It is the first In a layered graph perturbation-driven anomaly detection network, all nodes in time... The average state vector, representing the "central trend of normal operation", describes the average state of the entire graph and represents the center of the normal state; It is a node In time After the first The final high-dimensional state vector after propagation of the layer graph perturbation-driven anomaly detection network; molecule Indicates the degree of deviation, denominator Introducing disturbance response factor adjustment, ultimately A higher score indicates a more abnormal state of the node. The anomaly score is then compared with a threshold determined using a statistical stepwise method. When comparing, When the node is normal; when Slight anomaly at the time node; when The time node is severely abnormal and triggers isolation.

[0058] In summary, a method for detecting anomalies in distributed computing center infrastructure has been developed.

[0059] The order of the embodiments is for illustrative purposes only and does not represent the superiority or inferiority of the embodiments. The processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0060] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0061] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for detecting anomalies in distributed computing center infrastructure, characterized in that, Includes the following steps: S1. The infrastructure of the distributed computing center is used as edge nodes. Data is collected at these edge nodes to obtain underlying hardware metrics. A curvature-aware sliding window compression algorithm is introduced. Based on the first and second derivatives of each underlying hardware metric, the curvature of each metric is generated. Within the continuous time domain, at any time... The Underlying hardware metrics curvature Defined as: ， in, Indicates the first The underlying hardware metrics in time The first derivative is calculated using sliding window differencing. Indicates the first The underlying hardware metrics in time The second derivative is obtained by sliding difference followed by further difference; When the average curvature of each underlying hardware metric is greater than or equal to a preset threshold, the original underlying hardware metric is retained without compression; when the average curvature of each underlying hardware metric is less than the preset threshold, a curvature weighting function is introduced. The specific form is as follows: ， in, For the first The underlying hardware metrics in time The curvature weighting function; The compression sensitivity parameter is determined by an automatic parameter tuning method based on Bayesian optimization; It is an exponentially decaying term; It is a normalized repressor; Combining curvature weights, at a length of Constructing compressed expression values ​​within a sliding window: ， in, It is the first The underlying hardware metrics in time The compressed expression of the indicators; It is the sliding window length, representing the sampling duration for backtracking to the past; , It is a time index variable; It is the first A few underlying hardware metrics in the sliding window The moving average within the range is calculated using statistical methods; It is the first A few underlying hardware metrics in the sliding window The sliding standard deviation within the range is calculated using statistical methods; It is a small constant that prevents division by zero; It assigns weights to a single item; It is a logarithmic amplification term; The compressed underlying hardware specifications are obtained after the above processing. ; Next, alignment processing is performed to obtain the aligned underlying hardware metrics; feature extraction is performed on the aligned underlying hardware metrics to obtain a comprehensive feature matrix, which contains the feature vectors of each edge node. S2. Based on the feature vectors of each edge node in the comprehensive feature matrix, construct a dynamic enhancement graph of the structure; input the dynamic enhancement graph of the structure into the graph perturbation-driven anomaly detection network to generate anomaly scores for edge nodes; compare the anomaly scores of edge nodes with thresholds to determine the state of edge nodes.

2. The method for detecting anomalies in distributed computing center infrastructure according to claim 1, characterized in that, S2 specifically includes: The nodes of the structural dynamic enhancement graph are edge nodes, and the edges of the structural dynamic enhancement graph are established based on the collaborative anomaly measurement between nodes.

3. The method for detecting anomalies in distributed computing center infrastructure according to claim 2, characterized in that, S2 specifically includes: By combining the feature vectors of edge nodes with Gaussian windows and normalization factors, a collaborative anomaly measure between nodes is generated.

4. The method for detecting anomalies in distributed computing center infrastructure according to claim 1, characterized in that, S2 specifically includes: In the graph perturbation-driven anomaly detection network, a perturbation response factor is introduced.

5. The method for detecting anomalies in distributed computing center infrastructure according to claim 4, characterized in that, S2 specifically includes: In the propagation of the graph perturbation-driven anomaly detection network at each layer, the perturbation response factor is used to adjust the aggregation of neighbor information and generate the representation vector of the node.

6. The method for detecting anomalies in distributed computing center infrastructure according to claim 5, characterized in that, S2 specifically includes: Based on the output of the last layer graph perturbation-driven anomaly detection network, and combined with the perturbation response factor of the node, the anomaly score of the node is calculated.

Images