Anomaly detection method and electronic device

Abstract

The application discloses an anomaly detection method and an electronic device, relates to the technical field of computers, and can simultaneously capture time dependence and spatial topological features by introducing time-varying running state features in nodes and depicting the correlation between computing devices in a dynamic graph structure; the dynamic graph neural network automatically learns the fused spatiotemporal features, can adapt to the continuous evolution of network topology and node state, and improves the accuracy of anomaly identification; and anomaly judgment is performed based on the updated node embedding. It can be seen that the application solves the technical problems that statistical and machine learning methods depend on artificial features and distribution assumptions, have low detection accuracy and poor adaptability in a complex dynamic environment, and achieves the technical effects of better real-time performance and scalability in a large-scale data center and computing network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular, to an anomaly detection method and an electronic device. BACKGROUND

[0002] With the rapid development of information technology, the scale of data centers and computing networks gradually increases. In actual operation, data centers and computing networks face various abnormal sources such as hardware failure, software error, network anomaly, configuration error and potential attack. Once the anomaly is not discovered in time, it may cause key business interruption, data loss or security incidents, and seriously affect the stability and service capacity of the system. Therefore, anomaly detection technology needs to be used to detect the computing nodes in the data center or the computing network.

[0003] The anomaly detection technology in the related art has the following problems: the statistical feature analysis scheme is difficult to adapt to the complex data characteristics of high dimension, heterogeneity and time variation in data centers and computing networks at the same time, resulting in limited anomaly recognition ability; the supervised or unsupervised learning scheme is strongly dependent on data quality, artificial feature engineering and distribution assumption, and is difficult to effectively process dynamic environment and unbalanced samples; the scheme based on static feature analysis cannot depict the time sequence evolution of network topology and node state, and has large computing overhead, which is difficult to meet the real-time and scalability requirements of large-scale systems.

[0004] Therefore, there is an urgent need for an anomaly detection method that can simultaneously have high precision, high robustness and scalability to adapt to the growing scale and complexity of data centers and computing networks. SUMMARY

[0005] The present application provides an anomaly detection method and an electronic device to at least solve the technical problems of dependence on artificial features and distribution assumptions of statistical and machine learning methods in the related art, low detection accuracy in complex dynamic environments, and poor adaptability, achieving better real-time and scalability in large-scale data centers and computing networks.

[0006] The present application provides an anomaly detection method, comprising: constructing a dynamic space-time graph, the dynamic space-time graph comprising a plurality of nodes and edges, each node corresponding to a computing device, each edge representing a space-time association relationship between the nodes, the nodes and edges each comprising a space-time feature, the space-time feature comprising running state data related to time and space; performing fusion processing on the space-time features in the dynamic space-time graph to obtain a fusion feature vector; using a dynamic graph neural network to learn the fusion feature vector to update the embedding representation of the nodes; performing anomaly judgment on the nodes according to the embedding representation of the nodes to obtain an anomaly detection result; the anomaly detection result comprising whether each node is abnormal.

[0007] The application further provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above abnormality detection methods when executing the computer program.

[0008] The application further provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the steps of any of the above abnormality detection methods.

[0009] The application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of any of the above abnormality detection methods.

[0010] According to the application, the time-varying running state features are introduced into the nodes, and the association relationship between the computing devices is described by a dynamic graph structure, so that the time dependence and the spatial topology features can be captured at the same time; the dynamic graph neural network automatically learns the fused spatio-temporal features, can adapt to the continuous evolution of the network topology and the node state, and improves the accuracy of abnormality recognition; and the abnormality is judged based on the updated node embedding. It can be seen that the application solves the technical problems that the statistical and machine learning methods depend on artificial features and distribution assumptions, have low detection accuracy and poor adaptability in a complex dynamic environment, and achieves the technical effects of better real-time performance and scalability in a large-scale data center and computing network. BRIEF DESCRIPTION OF DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the application, the drawings needed in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0012] Figure 1 A flowchart of an abnormality detection method provided by an embodiment of the application.

[0013] Figure 2 A module schematic diagram corresponding to an abnormality detection method provided by an embodiment of the application.

[0014] Figure 3 A schematic diagram of an electronic device provided by an embodiment of the application. DETAILED DESCRIPTION

[0015] With reference to the drawings, the technical solutions in the embodiments of the present application will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0016] It should be noted that in the description of the present application, the terms "comprise", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment comprising a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment. The terms "first", "second" and the like in the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence.

[0017] In order for those skilled in the art to better understand the technical solutions of the present application, the present application will be further described in detail below with reference to the drawings and specific embodiments.

[0018] In combination with the specific application environment architecture or specific hardware architecture on which the execution of the anomaly detection method depends, the specific application environment architecture or specific hardware architecture is described herein. In the application scenario of the present method, the data center usually adopts a distributed cluster architecture, which is composed of a large number of server nodes, switching devices and storage arrays. The computing nodes are interconnected through a high-bandwidth, low-latency network to form a multi-level network topology, such as intra-rack switching, aggregation switching and core switching. Different nodes continuously generate multi-dimensional running data including central processor utilization, memory occupancy, disk input / output, network traffic, etc., while accompanying business scheduling or resource migration, the communication relationship between nodes will dynamically change over time, bringing a large number of time series and topology evolution characteristics for anomaly detection. In the computing network environment, the entire system is usually composed of several edge nodes, center nodes and cross-region links, and each node needs to exchange control information or business data in real time. The topology of the network may be quickly updated due to changes in link load, node online and offline, path scheduling and other factors, so the anomaly detection method provided by the present application needs to be able to continuously model the time-varying topology. The running characteristics of each node and its associated characteristics with neighbor devices together constitute the input of the dynamic graph neural network, supporting the spatio-temporal joint analysis of complex network states.

[0019] To meet the requirements of high-frequency monitoring and real-time calculation, the method can be deployed on a hardware platform with acceleration capability, such as a server with a graphics processing unit (GPU) acceleration card or a scheduling node with parallel computing capability. By performing dynamic graph learning and feature fusion operations on the hardware architecture, large-scale node state calculation can be completed with low latency, providing efficient and scalable anomaly detection capability for data center and computing network environments.

[0020] As Figure 1 In a first aspect, the present application provides an anomaly detection method, comprising: S11, constructing a dynamic space-time graph, the dynamic space-time graph comprising a plurality of nodes and edges, each node corresponding to a computing device, each edge representing a space-time association relationship between nodes, the nodes and edges comprising space-time features, and the space-time features comprising running state data related to time and space.

[0021] In this embodiment, a dynamic space-time graph is constructed based on real-time collected running state data. Specifically, each computing device in the data center or computing network can be determined as a node in the dynamic space-time graph, and the running state data corresponding to the node can include, but is not limited to, processing load, resource usage, and information related to spatial position such as network path and logical topology position, which changes over time. As the data center business load and device state continue to change, the running state data of the node is also updated over time, so that the dynamic space-time graph can exhibit obvious time sequence continuity. By including these time-evolving features in the space-time features of the node, the dynamic graph can reflect the real running state of different devices at different time periods.

[0022] After determining the nodes, this embodiment constructs edges according to the data transmission, dependency relationship, logical attribution, and network topology structure between the nodes. The existence of the edges and their corresponding space-time features are determined based on the actual association relationship between the entities. For example, edges are established based on information such as data flow between nodes, network communication path, access dependency relationship, and are assigned space-time features that reflect the degree of association, such as network traffic size, access frequency, request delay, and link load. The features of the edges are also updated in real time as the time changes, so that the dynamic graph can present the process of the interaction relationship between devices evolving over time.

[0023] The dynamic space-time graph constructed in the above manner contains the structural changes and state changes of the nodes and edges at different times. This embodiment not only considers the real-time in the time dimension, but also considers the structural relationship between devices in the space dimension, so that the dynamic graph can reflect not only the running behavior of the computing device itself but also its role in the overall topology. The dynamic space-time graph has continuity in time and correlation in space, and is composed of the space-time features of the nodes and the space-time features of the edges, which can more accurately express the continuously changing space-time relationship structure in the actual running environment of the data center.

[0024] S12: Perform fusion processing on the spatiotemporal features in the dynamic spatiotemporal graph to obtain the fused feature vector.

[0025] This embodiment fuses spatiotemporal features in a dynamic spatiotemporal graph to obtain a fused feature vector for subsequent model learning. Specifically, each node and edge in the dynamic spatiotemporal graph contains spatiotemporal features from multiple sources and in multiple dimensions. These features reflect the operating state of the device at different time slices and the interaction relationships related to the spatial topology. Since these features differ in importance across dimensions, this embodiment can, but is not limited to, use an attention mechanism during the fusion process to determine the emphasis of different spatiotemporal features, ensuring that the fusion result retains key spatiotemporal information from the original spatiotemporal features. The attention mechanism can, but is not limited to, calculate the correlation between the original input spatiotemporal features and assign weights to each feature, giving key features a higher influence in the fused representation, while weakening features with low correlation to abnormal patterns, thereby forming a representative fused feature vector.

[0026] When fusing spatiotemporal features, this embodiment may, but is not limited to, employ a hierarchical attention calculation method, enabling the fusion process to simultaneously cover the node's own features as well as the spatiotemporal features of the node and other nodes within its neighborhood. At the node level, the attention mechanism assigns weights to features in different time and spatial dimensions based on the node's characteristic performance, achieving initial fusion of features within the node and ensuring that the fused feature vector reflects the node's own spatiotemporal change pattern. Building upon this, this embodiment further calculates attention weights at the interaction level between the node and its neighbors, incorporating spatiotemporal correlations within a local area into the fusion process by focusing on the feature correlations between the node and its neighbors. After these two layers of fusion, the final fused feature vector of the node includes both the node's own spatiotemporal pattern and spatiotemporal correlations related to its surrounding environment.

[0027] Through the above fusion method, the generated fusion feature vector can continuously represent the spatiotemporal state of nodes in the dynamic spatiotemporal graph, laying the foundation for subsequent learning of node embedding representations by dynamic graph neural networks.

[0028] S13: Use a dynamic graph neural network to learn fused feature vectors to update the embedding representation of nodes.

[0029] In this embodiment, the dynamic graph neural network (DNN) performs multi-round graph-level propagation and aggregation of the fused feature vector, taking into account the structural characteristics of the dynamic spatiotemporal graph. This embodiment inputs the fused feature vector of a node at the current moment into the DNN, allowing the node to simultaneously receive feature information from neighboring nodes and the current spatiotemporal context information in each round of propagation. During propagation, the DNN updates the node's state according to the connection relationships of the graph structure, gradually incorporating dynamic information related to itself and its neighborhood into the node's embedded representation. For example, in a data center scenario, the embedded representation of a server node integrates the real-time state and past evolutionary characteristics of other servers communicating with it through the propagation steps, enabling the node representation to reflect the constantly changing operating environment.

[0030] In this embodiment, the dynamic graph neural network performs aggregation and transformation operations layer by layer when updating node embedding representations. The aggregation operation aggregates the fused features of neighboring nodes based on the spatiotemporal features carried by the edges in the graph; the transformation operation performs a nonlinear transformation on the aggregation result based on the parameters learned from the current network structure, forming a new node embedding representation. Through the stacking of multiple layers, nodes can receive spatiotemporal information over a wider range, enabling the node embedding representation to contain richer contextual relationships. This embodiment ensures that the final node embedding representation includes both the node's own information and its interaction information with other nodes in a dynamic topology.

[0031] S14: Based on the node's embedded representation, perform anomaly detection on the node to obtain anomaly detection results; the anomaly detection results include whether each node is abnormal.

[0032] In this embodiment, the node embedding representation, after learning the dynamic graph neural network, can reflect the node's operational state characteristics in the dynamic spatiotemporal graph. The anomaly detection step identifies whether a node is abnormal by performing specific discriminative operations on the embedding representation. This embodiment can make a judgment based on the difference between the node embedding representation and the normal operating mode, for example, by calculating the degree of deviation in the distribution of the node embedding representation or by training the discriminative module to identify abnormal patterns, ultimately determining whether the node belongs to an abnormal state. The more comprehensive the information contained in the node embedding representation, the more complete its description of node behavior during the anomaly detection process, achieving anomaly detection based on state representation.

[0033] In this embodiment, when performing anomaly detection, the node embedding representation is input to the discrimination module. The discrimination module can perform anomaly identification based on distance metrics, threshold judgment, or classification inference mechanisms. For example, the offset of a node embedding representation relative to normal data can be determined based on its position in the representation space; if the offset exceeds a preset threshold, it is considered an anomaly. Alternatively, the degree of coordination between the node embedding representation and the representations of neighboring nodes can be used to determine whether a node exhibits abnormal behavior inconsistent with its surrounding operating mode. Through the above methods, this embodiment can accurately determine the state of a node based on its node embedding representation and output the corresponding anomaly detection result.

[0034] Furthermore, in this embodiment, the output of the anomaly detection module can be used as a feedback signal to the dynamic graph neural network learning module, forming a continuously adjusting closed-loop mechanism. After anomaly detection, this embodiment can update the learning process of the aforementioned node embedding representation based on the anomaly detection result. For example, in subsequent learning, it can enhance the model's ability to distinguish anomaly node features or adjust the parameters of the dynamic graph neural network to better match the current system state changes. Through this feedback method, this solution can gradually correct the model's learning direction during continuous data input, enabling the overall detection process to maintain continuous adaptive capability according to changes in the operating environment.

[0035] In one exemplary embodiment, constructing a dynamic spatiotemporal graph includes: dynamically calculating the edge weights of edges between nodes based on the similarity of spatiotemporal features between nodes.

[0036] In this embodiment, when constructing a dynamic spatiotemporal graph, the edge weights are dynamically calculated by analyzing the spatiotemporal similarity between nodes. Specifically, for any two nodes, this embodiment extracts their corresponding spatiotemporal features, including time-related changes in operating status and space-related resource occupancy relationships, and calculates the similarity between the two nodes based on a preset similarity metric. When nodes exhibit high consistency in spatiotemporal features, the corresponding edge weights are dynamically set to larger values; conversely, when the features between nodes differ significantly, the edge weights are set to smaller values. In this way, the constructed dynamic spatiotemporal graph can automatically adjust the edge association strength according to the real-time changes in node states, allowing the graph structure to continuously evolve with changes in the data center operating environment.

[0037] Through a similarity-driven dynamic edge weight mechanism, the graph structure no longer relies on fixed thresholds or static rules to determine the connections between nodes. During operation, the spatiotemporal characteristics of nodes change with variations in business load, resource usage, and network environment. This embodiment updates the edge weights in real time based on these changes, enabling the dynamic spatiotemporal graph to more accurately depict the true strength of the associations between nodes. For example, when some nodes are under similar load conditions or exhibit synchronized resource fluctuation trends, the dynamic weights will strengthen the edges between these nodes, making them more important in subsequent learning processes; conversely, for node pairs with significant feature differences, their edge weights will be weakened, reducing the impact of ineffective associations on model analysis.

[0038] Through the above method, the dynamic spatiotemporal graph constructed in this embodiment can more closely resemble the relational patterns in the actual operating environment. When a node enters an abnormal state, its spatiotemporal characteristics deviate from the similarity with surrounding nodes, and the dynamic weights change accordingly, causing the related edges to exhibit a different weight distribution in the graph structure than in the normal state. This embodiment utilizes this weight change to enable the dynamic graph to reflect the structural characteristics of potential anomalies during the construction stage, providing a discriminative graph data foundation for subsequent anomaly detection based on dynamic graph neural networks.

[0039] In one exemplary embodiment, the edge weights between nodes are dynamically calculated based on the similarity of their spatiotemporal features. This includes: calculating the edge weights between the i-th and j-th nodes using a seventh formula based on the weight coefficients of each feature dimension, each feature dimension in the spatiotemporal features of the i-th node, and each feature dimension in the spatiotemporal features of the j-th node; the seventh formula is: ; Let be the edge weight between the i-th node and the j-th node. The weight coefficients for the k-th feature dimension are... Let k be the k-th feature dimension in the spatiotemporal features of the i-th node. Let i be the k-th feature dimension in the spatiotemporal features of the j-th node, p be the order of the distance metric, m be the total dimension of the spatiotemporal features of the node, m be an integer greater than 1, k be an integer between 1 and m, and i and j are both positive integers and not greater than the total number of nodes.

[0040] Assuming nodes The spatiotemporal feature vector is ,in These represent different spatiotemporal feature dimensions, such as location coordinates, timestamps, utilization rate, and congestion level. For nodes... With nodes Edge weights between The calculation formula is as above. p is the order of the distance metric, and its value can be determined based on the specific data distribution characteristics. The smaller the differences between nodes in each spatiotemporal feature dimension, the more... The smaller, the better The larger the value, the stronger the correlation between the two.

[0041] Compared with other methods for constructing dynamic spatiotemporal graph structures in related technologies, the formula provided in this embodiment can comprehensively consider multi-dimensional spatiotemporal features and flexibly adjust the influence of each feature through weight coefficients, more accurately depicting the complex spatiotemporal relationships between nodes. Especially in complex network environments, such as multi-feature interaction scenarios of data traffic in data center networks, compared with methods that construct graphs based only on location or single time features, it can more accurately reflect the spatiotemporal evolution characteristics of actual traffic, providing a better graph foundation for subsequent anomaly detection.

[0042] In one exemplary embodiment, the spatiotemporal features in the dynamic spatiotemporal graph are fused to obtain a fused feature vector, including: for each node, assigning preliminary attention weights to different feature dimensions of the spatiotemporal features to obtain a preliminary attention weight vector; obtaining a preliminary fused feature vector based on the vector corresponding to the spatiotemporal features and the preliminary attention weight vector; calculating secondary attention weights based on the preliminary attention weight vector and all edge weights between itself and its neighboring nodes; and calculating the fused feature vector of the node based on the preliminary fused feature vector and the secondary attention weights.

[0043] This embodiment employs a hierarchical attention mechanism to fuse the spatiotemporal features of nodes in a dynamic spatiotemporal graph. First, at the node level, preliminary attention weights are assigned based on the spatiotemporal feature dimensions of each node, forming a preliminary attention weight vector. Then, the preliminary attention weight vector is combined with the corresponding spatiotemporal feature vector of the node itself to calculate a preliminary fused feature vector. This completes the weighted processing of key features within the node itself, reflecting the importance distribution of the node's own spatiotemporal features.

[0044] Secondly, at the node-neighbor interaction level, a secondary attention weight is calculated based on the node's initial attention weight vector and the weights of all edges between the node and its neighbors (specifically, but not limited to, the average of all edge weights). The secondary attention weight is used to integrate the spatiotemporal feature information of the node itself and its neighbors, combining the initial fused feature vector with the secondary attention weight to obtain the node's final fused feature vector. This process, by considering local topological relationships and neighborhood features, characterizes the spatiotemporal association patterns between nodes, enabling the fused features to simultaneously reflect the spatiotemporal information of both the node itself and the local network.

[0045] Furthermore, this embodiment can also introduce a dynamic correction mechanism to adjust the fused feature vector in real time based on the overall spatiotemporal feature distribution of the network. The dynamic correction mechanism suppresses the excessive influence of local anomalous features, enabling the fused features to reflect changes in the overall spatiotemporal pattern and ensuring the stability and consistency of feature fusion when the network state changes rapidly.

[0046] In one exemplary embodiment, initial attention weights are assigned to different feature dimensions of the spatiotemporal features to obtain an initial attention weight vector. This includes: for each feature dimension of the spatiotemporal features, calculating the initial attention weight corresponding to that feature dimension using a first formula based on the feature dimension, its corresponding weight coefficient, and a pre-set bias term; the first formula is: ; Let be the initial attention weight for the l-th feature dimension of the spatiotemporal feature corresponding to the i-th node. Let be the weight coefficient of the l-th feature dimension. Let l be the l-th feature dimension of the spatiotemporal feature corresponding to the i-th node. is a pre-set bias term, tanh(·) is the hyperbolic tangent activation function, i is a positive integer and not greater than the total number of nodes; the preliminary attention weights for all feature dimensions of the spatiotemporal features are used to obtain the preliminary attention weight vector.

[0047] Specifically, at the node level itself, for the node... The Spatiotemporal feature dimensions Its initial attention weight The calculation method is as described in the formula above. This formula explains the calculation principle of the initial attention weights at the node level. Its core idea is to evaluate the importance differences of different spatiotemporal feature dimensions within the node itself. This formula maps the original spatiotemporal features to a measurable importance score by performing a linear transformation on each feature dimension and introducing a non-linear activation function. Finally, these scores are normalized into a probability distribution, i.e., the initial attention weight vector, through a function. This mechanism allows the model to automatically focus on feature dimensions that are more critical for anomaly detection (e.g., at a specific moment, CPU utilization may be a better indicator of anomalies than memory usage), while suppressing interference from secondary or irrelevant features, achieving adaptive selection of feature dimensions. The hyperbolic tangent activation function maps features to a non-linear space, enhancing feature expressiveness. Similarly, for nodes... Other spatiotemporal feature dimensions can also be used to calculate preliminary attention weights, ultimately forming the preliminary attention weight vector for that node. It is used to capture key information in the feature dimension.

[0048] In one exemplary embodiment, obtaining a preliminary fusion feature vector based on the vector corresponding to the spatiotemporal features and the preliminary attention weight vector includes: calculating the preliminary fusion feature vector using a second formula based on the vector corresponding to the spatiotemporal features of the node and the corresponding preliminary attention weight vector; the second formula is: ; To initially fuse feature vectors, This is the initial attention weight vector corresponding to the i-th spatiotemporal feature. Let be the vector corresponding to the spatiotemporal features of the i-th node. for The s-th component value, for The s-th component, m is the total dimension of the spatiotemporal features of the node, m is an integer greater than 1, s is an integer between 1 and m, and i is a positive integer not greater than the total number of nodes.

[0049] Specifically, based on the aforementioned preliminary attention weight vector For each node Constructing preliminary fusion feature vectors The formula is as shown above. This second formula, based on the principle of feature fusion using preliminary attention weights, achieves feature compression and enhancement. This formula weights and sums the calculated preliminary attention weights with the original feature vector of the node. Its second function is similar to a feature filter, allocating more weight to the feature dimensions identified as important while weakening less important feature dimensions, generating a preliminary fused feature vector that more effectively reflects the node's key state. This step fuses the original, potentially redundant, multi-dimensional features into a more information-dense and representative feature vector, laying the foundation for subsequent spatial correlation analysis.

[0050] In one exemplary embodiment, calculating the secondary attention weight based on the initial attention weight vector and the average of all edge weights between itself and its neighboring nodes includes: calculating the secondary attention weight using a third formula based on the initial attention weight vector and the average of all edge weights between itself and its neighboring nodes; the third formula is: ; The weights for the secondary attention of the i-th node are: The initial attention weight vector corresponding to the i-th node Let $\frac{i}{j}$ be the average weight of all edges between node $i$ and node $j$, where node $j$ is a neighboring node of node $i$. To and Unit vectors of the same size.

[0051] Specifically, at the level of node-neighbor interaction, the nodes are comprehensively considered. The initial attention weight vector, and its neighboring nodes Average weight between Secondary attention weights The calculation formula is shown above. This signifies that the fusion process extends from the node itself to its local spatial relationships. The formula not only considers the node's initial attention weight but also incorporates the average weight of the edges connecting it to its neighboring nodes. This design ensures that the calculation of secondary attention weights simultaneously includes the importance of the node's own features and its correlation strength within the graph structure. The principle is: the closer a node's association with its neighbors (the greater the edge weight), the higher the weight should be assigned to the joint features of this node and its neighbors when fusing spatial information. This ensures that the fused features not only reflect its own key states but also capture local spatiotemporal correlation patterns.

[0052] Through the calculations at the two levels mentioned above, using the formula Each node can be calculated The final fused feature vector. In other words, the final fused feature vector is equal to the initial fused feature vector. With secondary attention weights Product, i.e., node The final fused feature vector. This formula, as the final integration stage of the hierarchical attention mechanism, achieves deep fusion of the node's intrinsic features and local spatial context information by multiplying the initial fused feature vector at the node's own level with the corresponding elements of the secondary attention weights at the node-neighbor interaction level. This operation is equivalent to a spatial modulator, using the neighbor relationship strength implied by the secondary attention weights to recalibrate and enhance each dimension of the initial fused feature vector at the spatial level, generating a final fused feature vector that can simultaneously capture the node's own key states and its local spatiotemporal correlation patterns.

[0053] Compared to fusion methods in related technologies, the hierarchical attention mechanism makes feature fusion more targeted and hierarchical, effectively highlighting key spatiotemporal features and uncovering local correlation patterns. For example, in monitoring equipment operating status in the Industrial Internet of Things (IIoT), compared to simply splicing spatiotemporal features or using only a single averaging strategy for fusion, this method can more accurately focus on changes in key spatiotemporal features reflecting equipment anomalies, improving the accuracy of anomaly detection and reducing false alarm rates.

[0054] In one exemplary embodiment, learning the fused feature vector using a dynamic graph neural network to update the embedding representation of a node includes: for each node, using a temporal-spatial coupling gating unit, calculating an update gate and a reset gate based on the node's fused feature vector, and updating the node's embedding representation based on the output of the update gate and the output of the reset gate.

[0055] This embodiment employs a dynamic graph neural network based on a gated recurrent unit (GRU) to learn the fused feature vectors of nodes, thereby updating the node's embedded representation. For each node, an update gate and a reset gate are calculated through a temporal-spatial coupled gating unit, and the node's embedded representation is updated based on the outputs of these two gates. This design can, but is not limited to, control the flow of time-series information through a gating mechanism, enabling nodes to retain and update their dynamic features in the time dimension, thus capturing the patterns of node changes over time.

[0056] The temporal-spatial coupled gating unit not only processes the node's own temporal series information but also integrates the features of neighboring nodes based on the graph structure relationships between nodes. In the spatial dimension, neighboring node information can be selectively fused, allowing the node embedding representation to simultaneously reflect its own characteristics and local topological features. In this way, the node embedding vector can collaboratively reflect the dynamic state of the node and the spatial association patterns between nodes in both the temporal and spatial dimensions.

[0057] This embodiment can extract node features at multiple spatiotemporal scales. By using convolution kernels of different window sizes or graph convolution operations of different ranges, multi-scale processing of node fusion features is performed to obtain short-term, long-term, local, and global spatiotemporal features. Multi-scale features participate in embedding updates in temporal-spatial coupled gating units, enabling the embedded representation of nodes to simultaneously reflect dynamic characteristics within different time and spatial ranges.

[0058] Furthermore, this embodiment allows node embedding representations to be iteratively updated over consecutive time steps. Each update is based on the node's current fused feature vector and neighbor node information, enabling the node embedding to continuously adjust and evolve as the network state changes. In this way, the node embedding representation can continuously reflect the spatiotemporal dynamic changes of each node in the network, providing real-time and dynamic feature support for subsequent anomaly detection.

[0059] In one exemplary embodiment, updating the node's embedding representation based on the output of the update gate and the output of the reset gate includes: calculating the fusion feature vector for the next time step using a fourth formula based on the fusion feature vector at the current time step, the output of the update gate, the weight coefficient of the update gate, the output of the reset gate, and the weight coefficient of the reset gate; the updated node's embedding representation is the fusion feature vector for the next time step; the fourth formula is: ; Let be the fused feature vector of the i-th node at time t. Let be the embedding representation of the i-th node updated at time t+1. This represents the output of the update gate corresponding to the i-th node at time t. Let represent the output of the reset gate corresponding to the i-th node at time t, η represent the weight coefficient of the update gate, 1-η represent the weight coefficient of the reset gate, t represent the current time, t+1 represent the next time, and i represent a positive integer not greater than the total number of nodes.

[0060] Specifically, the above formula is the core update mechanism of the temporal-spatial coupled gating unit. Its principle lies in dynamically fusing historical states with current candidate states to generate new embedded representations of nodes. This formula uses an update gate as a valve to control how much information should be retained from the embedded representation of the previous time step and how much new information should be absorbed from the candidate state of the current time step. This weighted fusion mechanism enables the model to retain a memory of long-term historical states while flexibly incorporating new spatiotemporal feature changes when learning sequential data, thereby effectively capturing the dynamic evolution of node states.

[0061] In one exemplary embodiment, calculating the update gate based on the fusion feature vector of a node includes: calculating the output result of the update gate using a fifth formula based on the fusion feature vector at the current time, the vector corresponding to the spatiotemporal features of the node, and the bias term of the update gate; the fifth formula is: ; This represents the output of the update gate corresponding to the i-th node at time t. Let be the fused feature vector of the i-th node at time t. Let be the vector corresponding to the spatiotemporal features of the i-th node at time t. The bias term for updating the gate is tanh(), which is the hyperbolic tangent activation function. Time t is the current time, and i is a positive integer not greater than the total number of nodes.

[0062] Specifically, the above formula defines the computational principle of the update gate. Its function is to determine how much past information is passed to the future. This formula performs a linear transformation and biasing on the node's current feature vector and the embedding representation from the previous time step, then feeds it into the Sigmoid activation function, compressing the output value to between 0 and 1. The closer this gate value is to 1, the more historical information is retained; the closer it is to 0, the more historical information is forgotten, and the more it relies on new input. Essentially, it is an adaptive forgetting mechanism, allowing the model to autonomously determine the value of historical information.

[0063] In one exemplary embodiment, calculating the reset gate based on the fused feature vector of a node includes: calculating the output result of the reset gate using a sixth formula based on the vector corresponding to the spatiotemporal features of the node at the current moment and the bias term of the reset gate; the sixth formula is: ; To reset the gate's output at time t, Let be the vector corresponding to the spatiotemporal features of the i-th node at time t. To reset the door's bias, Let t be the hyperbolic tangent activation function, where t is the current time and i is a positive integer not greater than the total number of nodes.

[0064] Specifically, the above formula defines the computational principle of the reset gate. Its function is to control the degree of influence of the embedding representation from the previous time step on the current candidate state. Similar to the update gate, it also uses the sigmoid function to output a gating value between 0 and 1. When the reset gate value is close to 0, most historical information is reset or ignored, allowing the model to discard historical memories irrelevant to the current state; when the value is close to 1, historical information is fully incorporated to calculate the candidate state. This allows the model to flexibly forget irrelevant history and focus on the more important spatiotemporal features of the current moment, which is particularly crucial for capturing abrupt or non-stationary dynamic patterns.

[0065] In one exemplary embodiment, anomaly detection results are obtained by judging nodes based on their embedded representations, including: constructing a comprehensive anomaly measurement model based on the node's embedded representation; the comprehensive anomaly measurement model is obtained by coupling reconstruction error, consistency loss, and distribution deviation; for each node, anomaly measurement value is determined based on the comprehensive anomaly measurement model; and whether the node is abnormal is determined based on the anomaly measurement value and anomaly discrimination threshold.

[0066] This embodiment assesses node anomalies based on their embedded representations, constructing a comprehensive anomaly measurement model. This model may, but is not limited to, coupling reconstruction error, consistency loss, and distribution deviation to reflect anomalous node characteristics in the spatiotemporal dimensions. Reconstruction error measures the difference between the node's embedded representation and the original fused features; a larger difference indicates a more significant deviation between the node's state and its historical or expected characteristics, potentially indicating anomalies. Consistency loss reflects the consistency of the node's embedded representation at different times, and can be calculated, but is not limited to, by comparing the similarity of node embedding vectors across consecutive time steps. Nodes with low consistency indicate abrupt changes or anomalous fluctuations in their state over time. Distribution deviation measures the degree of deviation of the node's embedded representation from the overall network or a group of similar nodes, and can, but is not limited to, by calculating the statistical distribution differences of node embeddings in the embedding space. Nodes with large distribution deviations indicate that their features differ significantly from most nodes in the spatial dimension, reflecting anomalies in the global topology.

[0067] This embodiment weights and fuses reconstruction error, consistency loss, and distribution deviation to obtain a comprehensive anomaly metric, and determines whether a node is abnormal based on a preset anomaly detection threshold. By coupling multiple indicators, the abnormal characteristics of nodes in the spatiotemporal dimensions are comprehensively evaluated. This allows for the quantification of the degree of node anomaly without relying on a single indicator, enabling accurate location and determination of abnormal nodes.

[0068] In one specific embodiment, the anomaly metric of each node is calculated based on its reconstruction error, consistency loss, and distribution deviation, as well as its corresponding weight coefficient. Specifically, for the i-th node... Abnormal metrics The calculation formula is: ,in, It is the reconstruction error, which measures the model's understanding of the nodes. The ability to reproduce features; It is a consistency loss, reflecting the node's... Consistency of feature representation at different times; It is the distribution skewness, representing the node The degree to which a feature deviates from the normal data distribution. These are the weighting coefficients for each indicator.

[0069] In one exemplary embodiment, the process of determining the anomaly detection threshold includes: obtaining the anomaly measurement values ​​of all nodes at the current time, calculating the mean and standard deviation of all anomaly measurement values; and determining the anomaly detection threshold at the current time based on the mean and standard deviation.

[0070] This embodiment determines the anomaly detection threshold through an adaptive threshold dynamic adjustment mechanism. It acquires the anomaly metrics of all nodes at the current time and calculates the mean and standard deviation of these metrics to form a comprehensive statistical description of the degree of node anomaly. This statistical process can be, but is not limited to, using a time window or rolling calculation method to reflect the real-time characteristics of node anomaly distribution under the current network conditions.

[0071] The anomaly detection threshold is dynamically determined based on the calculated mean and standard deviation. This threshold can be, but is not limited to, the mean plus a certain multiple of the standard deviation, to adaptively characterize the boundaries of node anomalies at different time steps. Through this mechanism, whether a node is classified as an anomaly depends not only on its own characteristics but also on the overall distribution of node states, thus incorporating the context of global dynamic changes into the detection process.

[0072] The adaptive threshold mechanism in this embodiment abandons the fixed threshold division method, enabling the model to adjust the judgment criteria in real time according to changes in network operating status and data distribution. This mechanism can capture the non-stationary and dynamically changing characteristics of data centers and computing networks, ensuring the continuity and stability of anomaly detection under different loads, topologies, and burst conditions, and realizing the dynamic identification of abnormal nodes.

[0073] In one exemplary embodiment, determining the anomaly detection threshold at the current moment based on the mean and standard deviation includes: calculating the anomaly detection threshold at the current moment using an eighth formula based on the mean, standard deviation, and adjustable coefficient; the eighth formula is: ; Let μ(t) be the current discrimination threshold, μ(t) be the mean of all outlier measures at time t, and stard(t) be the standard deviation of all outlier measures at time t. This is an adjustable parameter, and time t represents the current time.

[0074] In the above formula, the discrimination threshold is dynamically set by calculating the mean and standard deviation of the anomaly metrics of all nodes at the current moment, allowing the threshold to be flexibly adjusted according to fluctuations in the overall system operation. The mean reflects the central trend of the current data, the standard deviation measures the dispersion of the data, and the adjustable parameter controls the leniency of the threshold. By dynamically adjusting the threshold through real-time calculation of the mean and standard deviation, the system adapts to changes in data distribution. This design enables the anomaly detection system to automatically adapt to normal data fluctuations under different load scenarios, such as peak and off-peak periods, effectively distinguishing between genuine anomalies and normal business fluctuations, and improving the robustness and accuracy of the detection model in complex dynamic environments.

[0075] Compared with other anomaly detection methods in related technologies, the multi-index comprehensive measurement provided in this embodiment can more comprehensively characterize the anomaly features of nodes, while the adaptive threshold dynamic adjustment enhances the model's adaptability in complex and dynamic data environments. For example, in communication network anomaly detection, compared with methods that only use reconstruction errors and fixed thresholds, it can more accurately identify various types of network attacks or fault anomalies, reduce false alarms and false negatives caused by data fluctuations or distribution changes, and improve the reliability of the anomaly detection system.

[0076] An example of a complete anomaly detection algorithm is shown below. Input: Original spatiotemporal dataset. It contains spatiotemporal feature information of multiple entity objects. Output: Anomaly detection results, including the anomaly score and anomaly label for each node.

[0077] Initialization: ① Initialize the dynamic spatiotemporal graph construction module: acquire and observe the original spatiotemporal data information of the data center server, analyze the node status and its feature dimensions, and set the feature dimension weight coefficients and distance metric order; ② Initialize the spatiotemporal information fusion module: set the bias term parameters; ③ Initialize the dynamic graph neural network learning module: set the update gate weights, update gate bias terms, reset gate bias terms, etc.; ④ Initialize the anomaly detection module: set the weight coefficients and anomaly detection thresholds of anomaly detection indicators (reconstruction error, consistency loss, distribution deviation, etc.).

[0078] Algorithm steps: Step 1: Construction of dynamic spatiotemporal graph; ① For the original spatiotemporal dataset For each entity object in the dataset, extract its spatiotemporal feature vector, including features such as location, timestamp, CPU utilization, memory usage, and network traffic. ② Based on the server information in the dataset, abstract the entity server objects as nodes in a graph. and for each node v i Vectors with corresponding spatiotemporal characteristics ③ By observing the data reception and transmission between each node, determine whether an edge exists between the nodes. If a node... To another node Send or receive other nodes v j The received data will then add an edge between the two nodes. Furthermore, for nodes and Using formula Calculate the edge weights between them ④ Forming a dynamic spatiotemporal diagram ,in It is a set of nodes. It is a set of edges. It is the edge weight matrix.

[0079] Step 2: Spatiotemporal information fusion; ① For dynamic spatiotemporal graphs Each node in Extract its spatiotemporal features vector ② At the node level, preliminary attention weights are calculated for different spatiotemporal feature dimensions. For feature dimension l, the formula is used. Calculate the initial attention weights ③ Based on the initial attention weight vector and using the formula For each node Calculate its preliminary fusion feature vector ④ At the level of interaction between nodes and neighboring nodes, comprehensively consider the nodes. and its neighboring nodes The average weights are used for secondary attention fusion, and the formula is applied. Calculate the secondary attention weights ⑤ Based on the initial fusion of feature vectors and secondary attention weights, use the formula... Calculate the final fused feature vector .

[0080] Step 3: Dynamic Graph Neural Network Learning; ① For the final fused feature vector of the input... For nodes At each time step Using the formula Calculate the time-space coupled gated unit model. ② Use the formula and Calculate the update gate separately and reset door ③After Learning at each time step, obtaining nodes The final representation is its embedded representation.

[0081] Step 4: Anomaly Detection; ① For nodes Embedded representation Calculate the reconstruction error The reconstruction error can be calculated by comparing the difference between the original feature vector and the reconstructed feature vector. The specific calculation formula is as follows: .in, It is a node The vector corresponding to the most primitive spatiotemporal features; It is the fused feature vector reconstructed from the embedded representation at time T. ② Calculate the consistency loss. Consistency loss can be measured by the number of nodes. Consistency of the embedded representation at different times is achieved by computing the embedded representation. In time series variance .in, Represents the variance operation function. ③ Calculate the distribution deviation. Distribution deviation can represent the node's... The degree of deviation of a feature from the normal data distribution can be calculated using the following distance calculation method. .in, It is a node The original spatiotemporal feature vector, It is the average value of vector data with spatiotemporal characteristics. ④ According to the multi-indicator comprehensive anomaly measurement formula compute nodes Abnormal metrics ⑤ Dynamically adjust the formula based on the adaptive threshold Calculate the anomaly detection threshold ⑥ Compare nodes Abnormal metrics and threshold ,if Then determine the node If a node is abnormal, it is labeled as abnormal; otherwise, it is considered a normal node.

[0082] Based on the abstract algorithm steps described above, the following is a computable example set up in the context of data center fault / anomaly detection, demonstrating the specific execution and calculation process of the algorithm. Due to the complexity of the data center scenario, this embodiment simplifies some parameters and data, focusing on demonstrating the algorithm logic.

[0083] Suppose a small data center contains 4 servers (nodes), labeled as follows: Each server collects its own operational data, including CPU utilization characteristics, memory usage characteristics, and network traffic characteristics. This embodiment focuses on the server's operational status, attempting to detect any anomalies. For example, sudden excessive resource consumption or abnormal spikes in network traffic may indicate a malfunction or attack.

[0084] like Figure 2 Dynamic Spatiotemporal Graph Construction Module: This module collects operational data from various servers in the data center, mainly including CPU utilization characteristics, memory usage characteristics, and network traffic characteristics. Based on this data, it constructs a dynamic spatiotemporal graph that reflects the similarity of the operating states between servers.

[0085] The specific steps for constructing the graph structure are as follows: First, based on the data center's operational data, if a server is found in the operational data, a node is created for it. Second, by observing the data sending and receiving activities of each node, it is determined whether there are edges between the nodes. If a node sends data to another node or receives data sent from other nodes, an edge is added between the two nodes.

[0086] The following section explains in detail how edge weights are calculated. Let's consider the server node... The feature vector is ,and Representing different operational characteristic dimensions (this patent example only considers CPU utilization). Memory usage Network traffic (Three characteristics). For servers and Calculate the edge weights between them. The formula is: .in, It is the feature dimension The weighting coefficient is used to measure the importance of this feature in determining node similarity; This represents the order of the distance metric, and its value can be determined based on the specific data distribution characteristics. Specifically, it sets the weight coefficient for the CPU utilization feature dimension. Memory usage feature dimension weight coefficient Network traffic feature dimension weight coefficient The distance metric order is p=2.

[0087] Assuming in At any time, obtain the server The feature vector is This indicates that its CPU utilization is 30%, memory usage is 25%, and network traffic is 100MB; the server was obtained. The feature vector is This indicates that its CPU utilization is 35%, memory usage is 30%, and network traffic is 120MB; the server was obtained. The feature vector is This indicates that its CPU utilization is 28%, memory usage is 22%, and network traffic is 90MB; the server was obtained. The feature vector is This indicates that its CPU utilization is 32%, memory usage is 27%, and network traffic is 110MB.

[0088] For ease of calculation, the dimensions are removed and the above values ​​are used directly for calculation. The server weights are calculated using the above formula for calculating edge weights. and Edge weights between : Similarly, the weight between any two servers can be calculated.

[0089] In summary, by calculating edge weights, the weights of all edges between nodes under the given time condition can be determined. If server runtime data under several time conditions can be collected, a graph structure can be constructed for each time condition. Based on the graph structures under these multiple time conditions, a dynamic spatiotemporal graph can ultimately be constructed.

[0090] Spatiotemporal information fusion module: This module receives graph structure data output by the dynamic spatiotemporal graph construction module, and uses a hierarchical attention mechanism to fuse the spatiotemporal features of nodes to enhance feature representation capabilities.

[0091] In the previous step, the spatiotemporal feature vectors of each server node were obtained as follows: ,as well as The following sections will discuss the fusion of spatiotemporal information at both the node's own level and the level of interaction with neighboring nodes, i.e., calculating the fused feature vector of the node.

[0092] At the node level, preliminary attention weights are assigned to the feature dimensions of each spatiotemporal feature of the node. This allows the server to... The Dimensional features Initial attention weights The calculation method is the formula , where the initial attention parameter vector (The weighting coefficients for the feature dimensions corresponding to CPU utilization, memory usage, and network traffic are respectively). tanh(·) represents the hyperbolic tangent function. exp{·} represents the exponential function. Furthermore, let the bias term... .

[0093] For the server CPU utilization characteristics The feature values ​​of other servers under the feature dimension of CPU utilization are as follows: To avoid excessively large values ​​and eliminate the influence of units on the calculation results, the values ​​of each feature dimension are normalized. For example, normalization is performed on the four server CPU utilization feature values. Specifically: for CPU utilization characteristics After normalization, it becomes .against CPU utilization characteristics After normalization, it becomes .against CPU utilization characteristics After normalization, it becomes .against CPU utilization characteristics After normalization, it becomes Substituting the normalized feature values ​​of 0.24, 0.28, 0.224, and 0.256, along with other parameters, into the formula for the initial attention parameter vector, we obtain: .

[0094] Similarly, for servers Memory usage characteristics The feature values ​​of other servers under the memory usage feature dimension are as follows: After standardizing it and substituting it into the above formula, we get: .

[0095] Similarly, for servers Network traffic characteristics The feature values ​​of other servers under the network traffic feature dimension are as follows: , , Normalizing it and substituting it into the above calculation yields: .

[0096] At this point, the server can be obtained. Initial attention weight vector ;

[0097] Similarly, compute servers Preliminary attention weights across different feature dimensions. Server Initial attention weight vector ;server Initial attention weight vector ;server Initial attention weight vector .

[0098] Based on the aforementioned initial attention weights, a preliminary fusion feature vector is constructed for each server node. .

[0099] For server nodes Its initial fusion of feature vectors The calculation formula is as follows: .

[0100] in Indicates server The feature vector is The first component value. Similarly, the preliminary fused feature vectors for the remaining server nodes can be calculated.

[0101] Furthermore, at the level of node-neighbor interaction, the nodes are considered comprehensively. Feature vectors and their neighboring nodes Average weight between Secondary attention weights Calculated as .in, It is a node Its neighboring nodes The average of all weights between them. It is related to the initial attention weight vector Identity matrices / vectors of the same size. For example, assuming average weights. In combination with the above Then the server node Secondary attention weights The calculation process is as follows Through the calculations at these two levels, the final fused feature vector for each server node can be calculated; that is, the final fused feature vector is equal to the initial fused feature vector. With secondary attention weights product, Right now, Note the symbols. This indicates an element-wise multiplication operation between corresponding positions of a matrix / vector.

[0102] Dynamic Graph Neural Network Learning Module: In this module, the temporal-spatial coupled gating unit is used to further iterate the final fused feature vector of the server node input, and the update gate and reset gate strategies are used for calculation as the precise embedded representation of the node.

[0103] The specific process is as follows: In At any given time, the server node eigenvectors The update formula is: ,in Obtained after calculation by the spatiotemporal information fusion module, i.e. . This indicates that the gate weight coefficients are updated and set to 0.5. This indicates resetting the gate weight coefficient.

[0104] The update gate is represented by the following formula: ,in, It is a node At time step The input feature vector, and . This represents the activation function. This represents the bias term of the update gate. Substituting the specific values ​​above into the calculation formula for the update gate, we get: .

[0105] Indicates in The time reset gate is calculated using the following formula: ,in, This indicates the offset of the door being reset.

[0106] In summary, based on the calculated update gate With Reset Door It can calculate the updated feature vector of the server node. .

[0107] Anomaly detection module: This module targets four server nodes respectively. Calculate its anomaly metric. ,in, These are the weighting coefficients for each indicator. It is the reconstruction error, which measures the model's understanding of the nodes. The ability to reproduce features; It is a consistency loss, reflecting the node's... Consistency of feature representation at different times; It is the distribution skewness, representing the node The degree to which a feature deviates from the normal data distribution.

[0108] For server nodes The anomaly metric is calculated as follows: , might as well let Both are 1 / 3. The reconstruction errors are calculated below. Consistency loss and distribution deviation .

[0109] Regarding reconstruction error To simplify calculations, the following assumptions are made. And calculate using formula (11) Regarding consistency loss The embedded representation needs to be computed. Variance on time series: ,in, This represents the variance operation function.

[0110] To simplify the calculation, we will only consider two time steps, and without loss of generality, assume... , Combine the above vectors into a matrix. The average of the first column is 27.5, the average of the second column is 25, and the average of the third column is 98. Therefore, the variance of the first column is... The variance in the second column is The variance of the third column is Therefore, the total variance .

[0111] Regarding distribution deviation The following distance calculation method can be used: .in, It is a node The original feature vector and , It is a vector of spatiotemporal characteristics The average value is 51.67. Therefore, .

[0112] Based on the multi-indicator comprehensive anomaly measurement formula, the node is calculated. Abnormal metrics Similarly, the server node can be calculated. , as well as The anomaly value. For the sake of convenience, let's assume... , , .

[0113] In addition, the anomaly detection threshold is calculated based on the adaptive threshold dynamic adjustment formula. And let The specific process is as follows: The mean of the outlier measures was 72.32, and the standard deviation of the outlier measures was 19.

[0114] Finally, the anomaly metric for each server needs to be compared with the aforementioned thresholds to determine which nodes are abnormal. The specific process is as follows: For each node... Abnormal metrics and threshold .therefore Then determine the node For normal nodes; targeting nodes Abnormal metrics and threshold .therefore Then determine the node This is an abnormal node; following the above method, the server node can be determined. and All are normal nodes.

[0115] This invention effectively integrates spatiotemporal information by constructing a dynamic spatiotemporal graph and utilizes a dynamic graph neural network to capture the dynamic changes in data, overcoming the shortcomings of related technologies in processing dynamic spatiotemporal data. Compared with related technologies, it can more accurately and timely detect anomalies in data, improving anomaly detection performance. It has broad application prospects in anomaly detection tasks in various complex network systems such as transportation, communication, and industrial IoT, helping to reduce system operational risks and ensure system stability and security.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0117] like Figure 3 The embodiments of this application also provide an electronic device, including a memory 101 and a processor 102, wherein the memory 101 stores a computer program and the processor 102 is configured to run the computer program to perform the steps in any of the above-described anomaly detection method embodiments.

[0118] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described anomaly detection method embodiments at runtime.

[0119] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0120] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described anomaly detection method embodiments.

[0121] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described anomaly detection method embodiments.

[0122] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0123] The above provides a detailed description of an anomaly detection method and electronic device provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to help understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. An anomaly detection method, characterized in that, include: A dynamic spatiotemporal graph is constructed, which includes multiple nodes and edges. Each node corresponds to a computing device, and each edge represents the spatiotemporal relationship between the nodes. Both the nodes and edges include spatiotemporal features, which include runtime status data related to time and space. The spatiotemporal features in the dynamic spatiotemporal graph are fused to obtain a fused feature vector. The fused feature vector is learned using a dynamic graph neural network to update the embedding representation of the node; Anomaly detection results are obtained by performing anomaly assessment on the nodes based on their embedded representations; the anomaly detection results include whether each node is abnormal. The spatiotemporal features in the dynamic spatiotemporal graph are fused to obtain a fused feature vector, including: For each node, initial attention weights are assigned to different feature dimensions of the spatiotemporal features to obtain an initial attention weight vector; an initial fusion feature vector is obtained based on the vector corresponding to the spatiotemporal features and the initial attention weight vector; a secondary attention weight is calculated based on the initial attention weight vector and all edge weights between the node and its neighboring nodes; and the fusion feature vector of the node is calculated based on the initial fusion feature vector and the secondary attention weight. Assigning preliminary attention weights to different feature dimensions of the spatiotemporal features to obtain a preliminary attention weight vector includes: for each feature dimension of the spatiotemporal features, calculating the preliminary attention weight corresponding to the feature dimension based on the feature dimension, its corresponding weight coefficient, and a pre-set bias term; and obtaining a preliminary attention weight vector for all feature dimensions of the spatiotemporal features.

2. The anomaly detection method according to claim 1, characterized in that, For each feature dimension of the spatiotemporal features, the preliminary attention weight corresponding to the feature dimension is calculated based on the feature dimension, its corresponding weight coefficient, and a pre-set bias term, including: For each feature dimension of the spatiotemporal features, the preliminary attention weight corresponding to the feature dimension is calculated using the first formula based on the feature dimension, its corresponding weight coefficient, and the pre-set bias term. The first formula is: ; Let be the initial attention weight for the l-th feature dimension of the spatiotemporal feature corresponding to the i-th node. Let be the weight coefficient of the l-th feature dimension. for The transpose of the matrix, Let l be the l-th feature dimension of the spatiotemporal feature corresponding to the i-th node. It is a pre-set bias term. It is the hyperbolic tangent activation function, where i is a positive integer and not greater than the total number of nodes.

3. The anomaly detection method according to claim 1, characterized in that, Based on the vector corresponding to the spatiotemporal features and the preliminary attention weight vector, a preliminary fusion feature vector is obtained, including: Based on the vector corresponding to the spatiotemporal features of the node and the corresponding preliminary attention weight vector, the preliminary fusion feature vector is calculated using the second formula; The second formula is: ; The initial fused feature vector, This is the initial attention weight vector corresponding to the i-th spatiotemporal feature. Let be the vector corresponding to the spatiotemporal features of the i-th node. for The s-th component value, for The s-th component, m is the total dimension of the spatiotemporal features of the node, m is an integer greater than 1, s is an integer between 1 and m, and i is a positive integer not greater than the total number of nodes.

4. The anomaly detection method according to claim 1, characterized in that, Based on the initial attention weight vector and all edge weights between itself and its neighboring nodes, the secondary attention weights are calculated, including: Based on the initial attention weight vector and all edge weights between itself and its neighboring nodes, the secondary attention weight is calculated using the third formula. The third formula is: ; The weights for the secondary attention of the i-th node are: This is the initial attention weight vector corresponding to the i-th node. Let $\frac{i}{j}$ be the average weight of all edges between node $i$ and node $j$, where node $j$ is a neighboring node of node $i$. To and Unit vectors of the same size, where i and j are both positive integers and not greater than the total number of nodes.

5. The anomaly detection method according to claim 1, characterized in that, The fused feature vector is learned using a dynamic graph neural network to update the embedding representation of the nodes, including: For each node, a temporal-spatial coupling gating unit is used to calculate an update gate and a reset gate based on the fused feature vector of the node, and the embedded representation of the node is updated based on the output of the update gate and the output of the reset gate.

6. The anomaly detection method according to claim 5, characterized in that, The embedded representation of the node is updated based on the output of the update gate and the output of the reset gate, including: Based on the current fusion feature vector, the output of the update gate, the weight coefficient of the update gate, the output of the reset gate, and the weight coefficient of the reset gate, the fusion feature vector for the next time step is calculated using the fourth formula; the embedded representation of the updated node is the fusion feature vector for the next time step. The fourth formula is: ; Let be the fused feature vector of the i-th node at time t. Let be the embedding representation of the i-th node after the update at time t+1. This represents the output of the update gate corresponding to the i-th node at time t. Let η be the output of the reset gate corresponding to the i-th node at time t, η be the weight coefficient of the update gate, 1-η be the weight coefficient of the reset gate, t be the current time, t+1 be the next time, and i be a positive integer not greater than the total number of nodes.

7. The anomaly detection method according to claim 5, characterized in that, The update gate is calculated based on the fused feature vector of the node, including: Based on the fusion feature vector at the current moment, the vector corresponding to the spatiotemporal features of the node, and the bias term of the update gate, the output result of the update gate is calculated using the fifth formula; The fifth formula is: ; This represents the output of the update gate corresponding to the i-th node at time t. Let be the fused feature vector of the i-th node at time t. Let be the vector corresponding to the spatiotemporal features of the i-th node at time t. The bias term for updating the gate is tanh(·), which is the hyperbolic tangent activation function. Time t is the current time, and i is a positive integer that is not greater than the total number of nodes.

8. The anomaly detection method according to claim 5, characterized in that, Calculate the reset gate based on the fused feature vector of the node, including: Based on the vector corresponding to the spatiotemporal characteristics of the node at the current moment and the bias term of the reset gate, the output result of the reset gate is calculated using the sixth formula; The sixth formula is: ; To reset the gate's output at time t, Let be the vector corresponding to the spatiotemporal features of the i-th node at time t. Here, t is the bias term for the reset gate, tanh(·) is the hyperbolic tangent activation function, t is the current time, and i is a positive integer not greater than the total number of nodes.

9. The anomaly detection method according to claim 1, characterized in that, The process of constructing a dynamic spatiotemporal graph also includes: The edge weights between nodes are dynamically calculated based on the similarity of their spatiotemporal features.

10. The anomaly detection method according to claim 9, characterized in that, Based on the similarity of the spatiotemporal features between nodes, the edge weights between nodes are dynamically calculated, including: Based on the weight coefficients of each feature dimension, each feature dimension in the spatiotemporal features of the i-th node and each feature dimension in the spatiotemporal features of the j-th node, the edge weight between the i-th node and the j-th node is calculated using the seventh formula. The seventh formula is: ; Let be the edge weight between the i-th node and the j-th node. The weight coefficients for the k-th feature dimension are... Let k be the k-th feature dimension in the spatiotemporal features of the i-th node. Let i be the k-th feature dimension in the spatiotemporal features of the j-th node, p be the order of the distance metric, m be the total dimension of the spatiotemporal features of the node, m be an integer greater than 1, k be an integer between 1 and m, and i and j are both positive integers and not greater than the total number of nodes.

11. The anomaly detection method according to any one of claims 1-10, characterized in that, Anomaly detection results are obtained by performing anomaly assessment on the nodes based on their embedded representations, including: Based on the embedded representation of the nodes, a comprehensive anomaly measurement model is constructed; the comprehensive anomaly measurement model is obtained by coupling reconstruction error, consistency loss and distribution deviation. For each node, an anomaly metric value is determined according to the comprehensive anomaly metric model, and whether the node is abnormal is determined according to the anomaly metric value and the anomaly discrimination threshold.

12. The anomaly detection method according to claim 11, characterized in that, The process of determining the anomaly detection threshold includes: Obtain the anomaly metrics of all nodes at the current time, and calculate the mean and standard deviation of all the anomaly metrics; The anomaly detection threshold for the current moment is determined based on the mean and the standard deviation.

13. The anomaly detection method according to claim 12, characterized in that, Based on the mean and the standard deviation, the anomaly detection threshold for the current moment is determined, including: The anomaly detection threshold at the current moment is calculated using the eighth formula based on the mean, the standard deviation, and the adjustable coefficient. The eighth formula is: ; The current discrimination threshold is... Let be the mean of all the aforementioned anomaly metrics at time t. The standard deviation of all the aforementioned outlier measures at time t. This is an adjustable parameter, and time t represents the current time.

14. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the anomaly detection method as described in any one of claims 1 to 13 when executing the computer program.

Images