Virtual machine anomaly detection method and device, equipment, storage medium and program product

Abstract

The invention relates to a virtual machine anomaly detection method and device, equipment, a storage medium and a program product. The method comprises the steps of obtaining respective virtual machine information of a plurality of virtual machines, and performing feature extraction on each piece of virtual machine information to obtain feature information of each virtual machine; performing clustering processing on the plurality of virtual machines according to each piece of feature information to obtain a clustering result; performing exception classification on the plurality of virtual machines according to each piece of feature information to obtain an exception classification result; and identifying an abnormal virtual machine in the plurality of virtual machines according to the clustering result and the abnormal classification result. By adopting the method, the accuracy of anomaly detection of the virtual machine can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a virtual machine anomaly detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] In cloud computing services, while providing virtual machine services to users, cloud providers must also ensure the stability and security of virtual machines. Therefore, timely identification and handling of abnormal virtual machines is an important task for cloud providers.

[0003] Machine learning algorithms, such as supervised and unsupervised learning models, are widely used in anomaly detection. However, current anomaly detection algorithms are usually single-model detection, which makes it difficult to guarantee accuracy. Among them, unsupervised learning has a relatively high false detection rate, while supervised learning has a relatively high false negative rate. Summary of the Invention

[0004] Therefore, it is necessary to provide a virtual machine anomaly detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the detection accuracy in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for detecting virtual machine anomalies, including:

[0006] Obtain virtual machine information for each of the multiple virtual machines, and extract features from each virtual machine information to obtain feature information for each virtual machine;

[0007] Clustering is performed on the multiple virtual machines based on the aforementioned feature information to obtain clustering results;

[0008] Based on the aforementioned feature information, the multiple virtual machines are classified as anomalies to obtain anomaly classification results;

[0009] Based on the clustering results and the anomaly classification results, abnormal virtual machines among the multiple virtual machines are identified.

[0010] Secondly, this application also provides a virtual machine anomaly detection device, comprising:

[0011] The extraction module is used to acquire virtual machine information of multiple virtual machines, and to perform feature extraction on each virtual machine information to obtain feature information of each virtual machine.

[0012] The clustering module is used to perform clustering processing on the multiple virtual machines based on the aforementioned feature information to obtain clustering results;

[0013] The classification module is used to classify the multiple virtual machines as anomalies based on the aforementioned feature information, and obtain anomaly classification results;

[0014] The identification module is used to identify the abnormal virtual machines among the multiple virtual machines based on the clustering results and the anomaly classification results.

[0015] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0016] Obtain virtual machine information for each of the multiple virtual machines, and extract features from each virtual machine information to obtain feature information for each virtual machine;

[0017] Clustering is performed on the multiple virtual machines based on the aforementioned feature information to obtain clustering results;

[0018] Based on the aforementioned feature information, the multiple virtual machines are classified as anomalies to obtain anomaly classification results;

[0019] Based on the clustering results and the anomaly classification results, abnormal virtual machines among the multiple virtual machines are identified.

[0020] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0021] Obtain virtual machine information for each of the multiple virtual machines, and extract features from each virtual machine information to obtain feature information for each virtual machine;

[0022] Clustering is performed on the multiple virtual machines based on the aforementioned feature information to obtain clustering results;

[0023] Based on the aforementioned feature information, the multiple virtual machines are classified as anomalies to obtain anomaly classification results;

[0024] Based on the clustering results and the anomaly classification results, abnormal virtual machines among the multiple virtual machines are identified.

[0025] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0026] Obtain virtual machine information for each of the multiple virtual machines, and extract features from each virtual machine information to obtain feature information for each virtual machine;

[0027] Clustering is performed on the multiple virtual machines based on the aforementioned feature information to obtain clustering results;

[0028] Based on the aforementioned feature information, the multiple virtual machines are classified as anomalies to obtain anomaly classification results;

[0029] Based on the clustering results and the anomaly classification results, abnormal virtual machines among the multiple virtual machines are identified.

[0030] The aforementioned virtual machine anomaly detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product acquire virtual machine information of multiple virtual machines, extract features from each virtual machine information to obtain feature information of each virtual machine, cluster the multiple virtual machines based on the feature information to obtain clustering results, classify the multiple virtual machines for anomalies based on the feature information to obtain anomaly classification results, and, based on the clustering results and the anomaly classification results, can more accurately identify abnormal virtual machines among the multiple virtual machines, thereby improving the accuracy of abnormal virtual machine detection. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is an application environment diagram of a virtual machine anomaly detection method in one embodiment;

[0033] Figure 2 This is a flowchart illustrating a virtual machine anomaly detection method in one embodiment;

[0034] Figure 3 This is a flowchart illustrating the anomaly classification model processing in one embodiment;

[0035] Figure 4 This is a flowchart illustrating the anomaly detection process in another embodiment;

[0036] Figure 5 This is a schematic diagram of the architecture of an anomaly detection system in another embodiment;

[0037] Figure 6 This is a flowchart illustrating the fusion model processing in another embodiment;

[0038] Figure 7 This is a schematic diagram illustrating the deployment of an anomaly detection system in another embodiment;

[0039] Figure 8This is a structural block diagram of a virtual machine anomaly detection device in one embodiment;

[0040] Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0042] First, the key terms used in this application are explained as follows:

[0043] LightGBM (Light Gradient Boosting Machine) is a distributed gradient boosting framework based on decision tree algorithms.

[0044] Louvian: An algorithm used for community discovery.

[0045] Attention network: A deep neural network that incorporates an attention mechanism.

[0046] Self-Attention: A self-attention mechanism is an attention mechanism that associates different positions of a single sequence to compute a representation of the same sequence.

[0047] Embedding: A technique for "vectorization" or "vector representation" in machine learning and natural language processing.

[0048] FC-Layer (Fully Connected Layer): is a basic layer type in deep learning neural networks.

[0049] The virtual machine anomaly detection method provided in this application embodiment can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or located on a cloud or other network server. Both terminal 102 and server 104 can independently execute the virtual machine anomaly detection method provided in this embodiment. Terminal 102 and server 104 can also work together to execute the virtual machine anomaly detection method provided in this embodiment. (See reference...) Figure 1When terminal 102 and server 104 cooperate to execute the virtual machine anomaly detection method provided in this embodiment, terminal 102 obtains virtual machine information of multiple virtual machines and sends it to server 104. Server 104 extracts features from each virtual machine information to obtain feature information of each virtual machine. Server 104 performs clustering processing on multiple virtual machines based on each feature information to obtain clustering results. Server 104 performs anomaly classification on multiple virtual machines based on each feature information to obtain anomaly classification results. Server 104 identifies abnormal virtual machines among multiple virtual machines based on the clustering results and anomaly classification results. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, drones, low-altitude aircraft, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. Server 104 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides cloud computing services.

[0050] In one exemplary embodiment, such as Figure 2 As shown, a virtual machine anomaly detection method is provided, which can be applied to computer devices (such as computer devices...). Figure 1 Taking the terminal or server in the middle as an example, the explanation includes:

[0051] Step 202: Obtain the virtual machine information of each of the multiple virtual machines, and extract features from each virtual machine information to obtain the feature information of each virtual machine.

[0052] The virtual machine information includes at least one of the following: time-series information or non-time-series information. Time-series information refers to the virtual machine's operation log information, such as login, query, email login, website browsing, etc. The operation sequence of the virtual machine can be statistically analyzed and operation log information can be generated at preset intervals. For example, the operation sequence of the virtual machine can be statistically analyzed every 4 hours as a time window.

[0053] Non-time-series information refers to the virtual machine's attribute information, which includes at least one of the following: CPU data, traffic data, virtual machine type, and virtual machine location. CPU data includes existing virtual machine information such as at least one of the following: number of CPU cores, memory size, and CPU utilization. CPU utilization data includes at least one of the following: average CPU utilization over the past day and peak CPU utilization periods. Traffic data includes at least one of the following: average length of HTTP and TCP request packets within the same session, packet time intervals, the ratio of uplink to downlink packets, and the proportion of SYN flags in the packet headers. The virtual machine's location is, for example, the region where the virtual machine's resource pool is located.

[0054] The virtual machine's characteristic information includes at least one of time-series or non-time-series characteristics. Time-series characteristics are extracted from the virtual machine's operation logs and include at least one of the following: CPU characteristics and traffic characteristics. CPU characteristics include at least one of the following: number of CPU cores, amount of memory, and CPU utilization. Traffic characteristics include at least one of the following: number of CPU cores, memory size, average length of HTTP and TCP request packets in the same session, packet time intervals, ratio of uplink to downlink packets, and proportion of SYN flags in packet headers. Non-time-series characteristics are extracted from the virtual machine's attribute information.

[0055] Specifically, the computer device can obtain virtual machine information from multiple virtual machines, extract features from each virtual machine information, and obtain feature information for each virtual machine.

[0056] In this embodiment, the computer device can acquire the temporal and non-temporal information of each of the multiple virtual machines, perform feature extraction on the temporal information of each virtual machine to obtain the temporal features of each virtual machine, and perform feature extraction on the non-temporal information of each virtual machine to obtain the non-temporal features of each virtual machine.

[0057] In this embodiment, by integrating the temporal characteristics of virtual machines (such as dynamic behavior patterns extracted from operation logs) with non-temporal characteristics (such as static attributes like CPU and traffic), a multi-dimensional and three-dimensional feature profile is constructed. This profile can capture the dynamic behavior anomalies and periodic patterns of virtual machines through temporal characteristics, and reflect the deviations in their static resource configuration through non-temporal characteristics. This results in a more comprehensive and detailed characterization of the virtual machine's state, significantly improving the accuracy and timeliness of anomaly detection.

[0058] Step 204: Cluster the multiple virtual machines according to each feature information to obtain the clustering results.

[0059] Specifically, computer equipment can cluster multiple virtual machines based on various feature information to obtain clustering results.

[0060] In one embodiment, the computer device can use a clustering model to cluster multiple virtual machines based on various feature information to obtain the clustering results output by the clustering model.

[0061] In one embodiment, multiple virtual machines are clustered based on various feature information to obtain clustering results, including:

[0062] The similarity between each virtual machine is determined based on the feature information; a relationship graph is constructed based on the similarity between multiple virtual machines; the relationship graph uses each virtual machine as a node and the similarity between virtual machines as the weight of the edge connecting the nodes; multiple virtual machines are clustered based on the relationship graph to obtain at least one target community, and virtual machines in the same target community belong to the same category.

[0063] Specifically, the computer device determines the similarity between each virtual machine based on various feature information. Further, it encodes the virtual machine based on at least one of its temporal or non-temporal features to obtain the feature vector corresponding to that virtual machine. The similarity between the feature vectors of each virtual machine is then calculated.

[0064] A relationship graph is constructed by treating each virtual machine as a node and assigning the similarity between virtual machines as the weight of the edges connecting the nodes. Multiple virtual machines in the relationship graph are then clustered to obtain at least one community, with virtual machines within the same community belonging to the same category.

[0065] In one embodiment, the similarity between two virtual machines is determined. When the similarity between the two virtual machines reaches a similarity threshold, the two virtual machines are connected, and the similarity is used as the weight of the edge connecting the two virtual machines. For example, two virtual machines are only connected if the similarity is greater than or equal to the threshold of 0.3, and the similarity value is used as the weight of the edge connecting the two virtual machines.

[0066] In this embodiment, accurate and automated virtual machine grouping is achieved by transforming the virtual machine cluster into a relationship graph structure based on similarity for community discovery. First, the similarity between virtual machines is calculated using feature information to construct a weighted relationship graph, transforming the abstract clustering problem into an intuitive graph structure partitioning that captures the complex and subtle relationships between virtual machines. Second, community clustering based on the relationship graph (using algorithms such as graph segmentation and label propagation) naturally groups highly cohesive and loosely coupled virtual machine groups into the same community based on the tightness of node connections (i.e., similarity weights). This not only effectively identifies normal virtual machine groups with similar configurations and behavioral patterns but also provides a clear group background for subsequent anomaly detection, making it easier to highlight individual abnormal virtual machines that deviate from the overall behavioral pattern of their community, thus improving the accuracy and reliability of the clustering results.

[0067] In one embodiment, multiple virtual machines are clustered based on a relationship graph to obtain at least one target community, including:

[0068] Traverse each node in the relation graph, plan to add the traversed node to each community of its neighboring nodes, and determine the change in modularity of each community after the traversed node is added to each community; add the traversed node to the candidate community with the largest change in modularity; use each candidate community as the update node of the relation graph, use the sum of the weights of all edges in the candidate community as the weight of the update node, and use the sum of the weights of the edges between the candidate communities as the weight of the edges between the update nodes, thus obtaining the updated relation graph; use the updated relation graph as the relation graph in the next iteration, and return to the steps of traversing each node in the relation graph and continue to execute until the modularity meets the threshold, thus obtaining at least one target community.

[0069] Modularity is a metric that quantifies the strength of community structure in a network and is used to evaluate the quality of node partitioning. Modularity represents the connection density within a community. A higher modularity indicates a higher connection density within the community.

[0070] Specifically, the computer device can treat each node in the relational graph as a community, and traverse the graph, planning to add the traversed node to the communities of its neighboring nodes. It then determines the modularity of each community after the planned addition, calculates the change in modularity for each community, and selects the community with the largest change in modularity as a candidate community for the traversed node, thus adding the traversed node to that candidate community. Following the same processing method, each node can be added to its respective candidate community.

[0071] Next, the relationship graph is updated: each candidate community is used as an update node in the relationship graph; the sum of the weights of all edges in the candidate community is used as the weight of the update node; and the sum of the weights of the edges between candidate communities is used as the weight of the edges between the update nodes, resulting in an updated relationship graph. This updated relationship graph is then used as the relationship graph for the next iteration, and the steps for traversing each node in the relationship graph are returned and continued until the modularity meets the threshold, at which point at least one target community is obtained.

[0072] For example, the Louvian algorithm is used for community partitioning. In the Louvian algorithm, modularity is the objective function, and the modularity Q is calculated as follows:

[0073] Q= ∑ c=1 n [ e c - a c 2 ]

[0074] Where n represents the number of communities. This represents the sum of the weights of the edges between nodes within the c-th community. Q represents the sum of the weights of all edges connecting the c-th community to the outside world. The larger Q is, the more accurate the community division.

[0075] The Louvain algorithm initially treats each node as a community. The algorithm consists of two phases. In the first phase, it iterates through the nodes in the graph, attempting to add a single node to the neighboring community that maximizes the improvement in modularity Q (i.e., the largest change), until all nodes remain unchanged. In the second phase, it processes the results of the first phase, merging small communities into a single updated node to reconstruct the graph. The weight of the updated node is then the sum of the edge weights of all original nodes within the two updated nodes. This process iterates until the Q-value stabilizes. At this point, all virtual machines are divided into clusters, or target communities, and virtual machines within the same target community belong to the same class.

[0076] In this implementation, automated, multi-level community clustering of the virtual machine is achieved through iterative optimization of modularity. First, by traversing each node and calculating the change in modularity after it joins a neighboring community, the algorithm can dynamically and precisely find the optimal affiliation for each node, which maximizes the internal connections within its community and minimizes the inter-community connections, thus achieving local optimal adjustment of community partitioning. Second, by aggregating the initially partitioned candidate communities into new supernodes and reconstructing the network (the supernode weight is the total edge weight within the community, and the edge weight between supernodes is the total edge weight between communities), a hierarchical abstraction of the community structure is achieved. This allows the algorithm to further optimize modularity at a more macroscopic scale. This iterative mechanism of "local optimization - network reconstruction" ensures that the algorithm can adaptively mine multi-level community structures from fine-grained to coarse-grained until the modularity meets the threshold, ultimately obtaining target communities with high internal aggregation and clear boundaries. This provides a stable and reliable virtual machine grouping foundation for subsequent anomaly detection.

[0077] Step 206: Classify multiple virtual machines for anomalies based on each feature information to obtain the anomaly classification results.

[0078] The anomaly classification result refers to the virtual machine that has been classified as an anomaly.

[0079] Specifically, computer equipment can classify multiple virtual machines into anomalies based on various characteristic information to obtain anomaly classification results.

[0080] In one embodiment, the computer device uses an anomaly classification model to classify multiple virtual machines as anomalies based on various feature information, and obtains the anomaly classification result.

[0081] In one embodiment, the virtual machine's feature information includes the virtual machine's temporal and non-temporal features; based on each feature information, multiple virtual machines are classified as anomalies to obtain anomaly classification results, including:

[0082] For each virtual machine, the temporal features of the virtual machine are enhanced based on the attention mechanism to obtain temporally enhanced features. The temporally enhanced features and non-temporally enhanced features of the virtual machine are fused together, and the virtual machine is classified as an anomaly based on the fused features to obtain the anomaly classification results.

[0083] Specifically, after obtaining the temporal and non-temporal features of each virtual machine, the computer device performs feature enhancement on the temporal features of each virtual machine based on an attention mechanism, resulting in enhanced temporal features. The enhanced and non-temporal features are then fused, and anomaly classification is performed on the virtual machine based on the fused features, yielding anomaly classification results. Following the same processing method, anomaly classification results can be obtained for each virtual machine. These anomaly classification results are binary classification results, including anomaly categories and non-anomaly categories.

[0084] In one embodiment, for each virtual machine, the temporal features of the target virtual machine can be enhanced using an anomaly classification model based on an attention mechanism to obtain temporally enhanced features. The anomaly classification model then fuses the temporally enhanced and non-temporally enhanced features of the target virtual machine, and classifies the target virtual machine as an anomaly based on the fused features, outputting the anomaly classification result for the target virtual machine.

[0085] like Figure 3 The diagram illustrates the processing flow of an anomaly classification model in one embodiment. The anomaly classification model encodes non-temporal features to obtain feature vectors. These feature vectors are then processed through an embedding layer to obtain a corresponding feature vector matrix. The anomaly classification model performs one-hot encoding on temporal features, followed by vector representation through an embedding layer to obtain a feature vector matrix. This matrix is ​​then augmented using an attention mechanism to obtain an enhanced feature vector matrix (i.e., time-series augmented features). The feature vector matrix corresponding to the non-temporal features and the augmented feature vector matrix are concatenated to obtain a concatenated feature vector. This concatenated feature vector is then processed through a fully connected layer for binary classification, followed by another fully connected layer for further binary classification. The resulting anomaly score for the virtual machine is then used to determine the anomaly classification result.

[0086] If the anomaly score reaches the preset score, the virtual machine is classified as an anomaly, meaning it is an abnormal virtual machine. If the anomaly score does not reach the preset score, the virtual machine is classified as a normal virtual machine, meaning it is a normal virtual machine.

[0087] In this embodiment, as Figure 3 As shown, this anomaly classification model can be a supervised binary classification fusion model built based on Lightweight Gradient Boosting Machine (LightGBM) and an attention network. For example, non-temporal features such as the number of CPU cores, memory size, average length of HTTP and TCP request packets in the same session, packet time interval, ratio of uplink to downlink packets, and proportion of SYN flags in packet headers are encoded using leaf nodes by LightGBM. In this embodiment, the number of leaf nodes can be set to 16. Therefore, after LightGBM outputs the leaf node numbers, the non-temporal features are encoded into 16-bit vectors. Then, the 16-bit feature vectors are processed by the Embedding layer to represent the vectors, outputting a 16×32-dimensional feature vector matrix. The values ​​in the same column of the vector matrix are averaged to obtain a 1×32-dimensional feature vector. It can be understood that the number of leaf nodes can be set according to requirements.

[0088] For temporal features, one-hot encoding is first performed, followed by vector representation through an embedding layer, outputting a 16×32 dimensional feature vector matrix. This matrix is ​​then augmented using a self-attention mechanism (e.g., Attention or selfAttention). The values ​​in the same column of the resulting vector matrix are then averaged to obtain a 1×32 dimensional feature vector (i.e., enhanced temporal features). Non-temporal and temporal features are concatenated to obtain a 1×64 dimensional feature vector. This is then passed through a fully connected layer for binary classification, outputting the anomaly score for the virtual machine. The anomaly classification result is determined based on this score.

[0089] In this embodiment, non-time-series features are extracted from the virtual machine's attribute information, while time-series features are extracted from the virtual machine's operation logs; the attribute information includes at least one of CPU data or traffic data.

[0090] In this embodiment, by introducing an attention mechanism to adaptively enhance temporal features, key dynamic behavior patterns that are highly correlated with anomalies in the operation log can be accurately captured. These patterns are then fused with non-temporal static attributes such as CPU and traffic, achieving multi-dimensional and fine-grained comprehensive identification of virtual machine states, thereby significantly improving the accuracy and robustness of anomaly classification.

[0091] Step 208: Based on the clustering results and anomaly classification results, identify the abnormal virtual machines among the multiple virtual machines.

[0092] Specifically, computer equipment can identify abnormal virtual machines among multiple virtual machines based on clustering results and anomaly classification results.

[0093] In one embodiment, the anomaly classification result includes virtual machines belonging to the anomaly category; based on the clustering result and the anomaly classification result, abnormal virtual machines among multiple virtual machines are identified, including:

[0094] For each target community, determine the number of virtual machines in the target community that are the same as the number of virtual machines belonging to the abnormal category; when the number of targets reaches the preset number, the target community is judged as an abnormal community and the virtual machines in the target community are abnormal virtual machines; when the number of targets does not reach the preset number, the target community is judged as a normal community and the virtual machines in the target community are normal virtual machines.

[0095] The number of virtual machines in the target community that are the same as those belonging to the anomalous category refers to the number of virtual machines in the target community that belong to the anomalous category.

[0096] Specifically, the anomaly classification results include virtual machines classified as anomaly categories, i.e., a set of virtual machines belonging to the anomaly category. For each target community, the number of virtual machines in the target community that are identical to the number of virtual machines belonging to the anomaly category is determined. When the number of targets reaches a preset number, the target community is classified as an anomaly community, and the virtual machines in the target community are considered anomaly virtual machines. When the number of targets does not reach the preset number, the target community is classified as a normal community, and the virtual machines in the target community are considered normal virtual machines.

[0097] In this embodiment, for each target community, the number of virtual machines in the target community that are identical to the number of virtual machines belonging to the abnormal category is determined, and the proportion of this number to the total number of virtual machines in the target community is determined. When this proportion reaches a preset proportion, the target community is determined to be an abnormal community, and the virtual machines in the target community are abnormal virtual machines. When the proportion does not reach the preset proportion, the target community is determined to be a normal community, and the virtual machines in the target community are normal virtual machines.

[0098] For example, if more than 50% of the virtual machines in the same target community belong to the abnormal category, then the community is an abnormal community, and the virtual machines in the target community are abnormal virtual machines. Conversely, if no more than 50% of the virtual machines in the same target community belong to the abnormal category, then the target community is a non-abnormal community (i.e., a normal community), and the virtual machines in it are non-abnormal virtual machines (i.e., normal virtual machines).

[0099] In this embodiment, by fusing the results of cluster analysis and anomaly classification, an upgrade from individual anomaly detection to group anomaly determination is achieved. This method does not view the anomaly classification results of individual virtual machines in isolation, but introduces the concept of a "community," counting the number of virtual machines initially identified as anomaly within each community (i.e., the target number) and comparing it with a preset threshold. This effectively identifies large-scale, centralized anomaly behavior. When the number of anomaly virtual machines in a community exceeds the threshold, the entire community is judged as anomaly. This significantly amplifies the detection signal of group failures or coordinated attacks, preventing individual anomalies from being overwhelmed by a large number of normal nodes. Furthermore, this approach has strong anti-interference capabilities, filtering out scattered and isolated false alarms. Even if an individual virtual machine is misjudged by the anomaly classification model, as long as the number of anomaly nodes in its community does not reach the threshold, a final alarm will not be triggered. This ensures a high detection rate while significantly improving the reliability and robustness of the overall detection results, reducing the cost of false alarms in operation and maintenance.

[0100] In the above-mentioned virtual machine anomaly detection method, the virtual machine information of multiple virtual machines is obtained, and feature extraction is performed on each virtual machine information to obtain the feature information of each virtual machine. The multiple virtual machines are clustered according to the feature information to obtain the clustering result. The multiple virtual machines are then classified according to the feature information to obtain the anomaly classification result. Based on the two anomaly identification results, the abnormal virtual machines among the multiple virtual machines can be identified more accurately, thereby improving the accuracy of abnormal virtual machine detection.

[0101] In one embodiment, the method further includes:

[0102] Report abnormal virtual machines, generate alarm information for abnormal virtual machines, and display the alarm information through the information display interface.

[0103] In one embodiment, such as Figure 4 As shown, a virtual machine anomaly detection method based on a fusion model is provided. The main process of this method is as follows:

[0104] First, information and logs of the virtual machine are collected and stored in the database. Then, data preprocessing and feature calculation are performed. The processed data enters the anomaly detection process for clustering and anomaly classification detection. Based on the clustering and anomaly classification results, the final abnormal virtual machine is output through anomaly arbitration. Finally, alarms are reported for the detected abnormal virtual machines.

[0105] The anomaly detection module makes two main contributions. First, it integrates unsupervised and supervised learning models, avoiding the high false positive rate of unsupervised learning and the high false negative rate of supervised learning, thus improving the accuracy of anomaly detection. Second, when building the supervised model, the fusion of LightGBM and Attention networks allows the model to simultaneously receive temporal and non-temporal features as input, enabling it to capture both temporal and non-temporal feature information and further improving detection accuracy.

[0106] In one embodiment, such as Figure 5 As shown, an anomaly detection system for implementing a virtual machine anomaly detection method is provided. The overall architecture of the anomaly detection system is as follows. Figure 5 As shown, it mainly includes a data acquisition module, a data processing module, an anomaly detection module, an alarm reporting module, and an alarm display module. Among them:

[0107] Data Acquisition Module: This module is responsible for collecting virtual machine information, including both time-series and non-time-series information. The periodically collected data is stored in the database.

[0108] Data processing module: The data processing module is responsible for feature extraction of virtual machine information, including temporal feature extraction and non-temporal feature extraction.

[0109] Anomaly Detection Module: The anomaly detection module uses a fusion model for detection and mainly consists of three parts: clustering, anomaly classification, and anomaly arbitration. A schematic diagram of the fusion model's processing is shown below. Figure 6 As shown.

[0110] In the clustering model, this embodiment uses the Louvian community detection algorithm for virtual machine clustering. The main algorithm steps are as follows:

[0111] a. Feature selection: Select at least one feature from the virtual machine's temporal or non-temporal features to form a feature set;

[0112] b. Feature encoding: Then, one-hot encoding is performed on each feature in the feature set, and the encodings of each feature are concatenated to form a feature vector;

[0113] c. Similarity calculation: Based on the feature vector of each virtual machine, we calculate the cosine similarity between each pair of virtual machines.

[0114] d. Constructing a relationship graph: Using virtual machines as nodes, construct a relationship graph based on similarity. To reduce noise, only establish an edge between two virtual machines if the similarity is greater than or equal to 0.3, and the similarity value is used as the weight of the edge.

[0115] e. Community Partitioning: The Louvian algorithm is used for community partitioning. In the Louvian algorithm, modularity is used as the objective function, and the modularity Q is calculated as follows:

[0116] Q= ∑ c=1 n [ e c - a c 2 ]

[0117] Where n represents the number of communities. This represents the sum of the weights of the edges between nodes within the c-th community. Q represents the sum of the weights of all edges connecting the c-th community to the outside world. The larger Q is, the more accurate the community division.

[0118] The Louvain algorithm initially treats each node as a community. The algorithm consists of two phases. In the first phase, it iterates through the nodes in the graph, attempting to add a single node to the neighboring community that maximizes the improvement in modularity Q (i.e., the largest change), until all nodes remain unchanged. In the second phase, it processes the results of the first phase, merging small communities into a single updated node to reconstruct the graph. The weight of the updated node is then the sum of the edge weights of all original nodes within the two updated nodes. This process iterates until the Q-value stabilizes. At this point, all virtual machines are divided into clusters, or target communities, and virtual machines within the same target community belong to the same class.

[0119] In the anomaly classification model, a supervised binary classification fusion model is constructed based on LightGBM and an Attention network. The processing flow of the anomaly classification model is as described above. Figure 3 As shown, non-temporal features such as the number of CPU cores, memory size, average length of HTTP and TCP request packets in the same session, packet time intervals, the ratio of uplink to downlink packets, and the proportion of SYN flags in the packet header are encoded using LightGBM leaf nodes. In this embodiment, the number of leaf nodes can be set to 16. Therefore, after LightGBM outputs the leaf node numbers, the non-temporal features are encoded into 16-bit vectors. Then, the 16-bit feature vectors are processed by the Embedding layer to represent them, outputting a 16×32-dimensional feature vector matrix. The values ​​in the same column of the vector matrix are averaged to obtain a 1×32-dimensional feature vector. It can be understood that the number of leaf nodes can be set according to requirements.

[0120] For temporal features, one-hot encoding is first performed, followed by vector representation through an embedding layer, outputting a 16×32 dimensional feature vector matrix. This matrix is ​​then augmented using a self-attention mechanism (e.g., Attention or selfAttention). The values ​​in the same column of the resulting vector matrix are then averaged to obtain a 1×32 dimensional feature vector (i.e., enhanced temporal features). Non-temporal and temporal features are concatenated to obtain a 1×64 dimensional feature vector. This is then passed through a fully connected layer for binary classification, outputting the anomaly score for the virtual machine. The anomaly classification result is determined based on this score.

[0121] Anomaly Arbitration: Based on the output of the clustering model and the anomaly classification model, if more than 50% of the virtual machines in the same community are detected as anomalies by the anomaly classification model, then the community is an anomaly community and the virtual machines in the community are anomalies. Conversely, if less than 50% of the virtual machines are detected as anomalies, then the community is a non-anomaly community and the virtual machines in the community are non-anomalies.

[0122] Alarm reporting module: Reports alarms to the alarm display module for abnormal virtual machines detected by the fusion model.

[0123] Alarm display module: The reported alarms are ultimately analyzed and displayed through the interface.

[0124] In one embodiment, the anomaly detection system is deployed as a Docker container in virtual machines within each resource pool management area, serving as an anomaly detection device for the virtual machines. The anomaly detection results are reported to the central management area via an alarm reporting module, where alarm notifications and displays are generated. A specific deployment example is... Figure 7 As shown.

[0125] In this embodiment, the fusion of the unsupervised model based on community partitioning and the supervised model based on LightGBM and Attention avoids the drawbacks of false detection in the unsupervised model and false detection in the supervised model. The supervised model identifies abnormal communities in the unsupervised model, and the communities in the unsupervised model compensate for the abnormal virtual machines that are missed in the supervised model, thereby improving the accuracy of anomaly detection. The anomaly detection accuracy of the fusion model is above 95%.

[0126] In supervised models, the fusion of LightGBM and Attention networks allows the model to take both temporal and non-temporal features as input, capturing information from both temporal and non-temporal features and further improving model accuracy.

[0127] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0128] Based on the same inventive concept, this application also provides a virtual machine anomaly detection device for implementing the virtual machine anomaly detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more virtual machine anomaly detection device embodiments provided below can be found in the limitations of the virtual machine anomaly detection method described above, and will not be repeated here.

[0129] In one exemplary embodiment, such as Figure 8 As shown, a virtual machine anomaly detection device 800 is provided, comprising:

[0130] The extraction module 802 is used to obtain the virtual machine information of multiple virtual machines, and to extract features from each virtual machine information to obtain the feature information of each virtual machine.

[0131] Clustering module 804 is used to cluster multiple virtual machines based on various feature information to obtain clustering results.

[0132] The classification module 806 is used to classify multiple virtual machines as anomalies based on various feature information and obtain the anomaly classification results.

[0133] The identification module 808 is used to identify abnormal virtual machines among multiple virtual machines based on clustering results and anomaly classification results.

[0134] In one embodiment, the feature information of the virtual machine includes the temporal features and non-temporal features of the virtual machine; the classification module 806 is further configured to perform feature enhancement on the temporal features of the virtual machine based on an attention mechanism for each virtual machine to obtain temporally enhanced features; fuse the temporal enhanced features and non-temporal features of the virtual machine, and classify the virtual machine as an anomaly based on the fused features to obtain an anomaly classification result.

[0135] In one embodiment, non-time-series features are extracted from the virtual machine's attribute information, while time-series features are extracted from the virtual machine's operation logs; the attribute information includes at least one of CPU data or traffic data.

[0136] In one embodiment, the clustering module 804 is further configured to determine the similarity between each virtual machine based on the feature information; construct a relationship graph based on the multiple virtual machines and the similarity between the virtual machines; the relationship graph uses each virtual machine as a node and the similarity between the virtual machines as the weight of the edge connecting the nodes; and cluster the multiple virtual machines based on the relationship graph to obtain at least one target community, wherein each virtual machine in the same target community belongs to the same category.

[0137] In one embodiment, the clustering module 804 is further configured to traverse each node in the relation graph, plan to add the traversed node to each community where its neighboring nodes are located, and determine the change in modularity of each community after the traversed node is planned to be added to each community; add the traversed node to the candidate community with the largest change in modularity among the communities; use each candidate community as the update node of the relation graph, use the sum of the weights of all edges in the candidate community as the weight of the update node, and use the sum of the weights of the edges between each candidate community as the weight of the edges between the update nodes, thereby obtaining the updated relation graph; use the updated relation graph as the relation graph in the next iteration, and return to the step of traversing each node in the relation graph and continue to execute until the modularity meets the threshold, thereby obtaining at least one target community.

[0138] In one embodiment, the anomaly classification result includes virtual machines belonging to the anomaly category; the identification module 808 is used to determine, for each target community, the number of virtual machines in the target community and the number of virtual machines belonging to the anomaly category that are the same; when the number of targets reaches a preset number, the target community is determined to be an anomaly community and the virtual machines in the target community are anomaly virtual machines; when the number of targets does not reach the preset number, the target community is determined to be a normal community and the virtual machines in the target community are normal virtual machines.

[0139] In one embodiment, the device further includes:

[0140] The alarm reporting module is used to report abnormal virtual machines, generate alarm information for abnormal virtual machines, and display the alarm information through the information display interface.

[0141] Each module in the aforementioned virtual machine anomaly detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0142] In one exemplary embodiment, a computer device is provided, which may be a terminal or a server. Taking a terminal as an example, its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements a virtual machine anomaly detection method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0143] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0144] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of a virtual machine anomaly detection method.

[0145] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of a virtual machine anomaly detection method.

[0146] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of a virtual machine anomaly detection method.

[0147] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0148] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0149] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting virtual machine anomalies, characterized in that, The method includes: Obtain virtual machine information for each of the multiple virtual machines, and extract features from each virtual machine information to obtain feature information for each virtual machine; Clustering is performed on the multiple virtual machines based on the aforementioned feature information to obtain clustering results; Based on the aforementioned feature information, the multiple virtual machines are classified as anomalies to obtain anomaly classification results; Based on the clustering results and the anomaly classification results, abnormal virtual machines among the multiple virtual machines are identified.

2. The method according to claim 1, characterized in that, The feature information of the virtual machine includes the temporal features and non-temporal features of the virtual machine; The step of classifying the multiple virtual machines into anomalies based on the aforementioned feature information to obtain anomaly classification results includes: For each virtual machine, the temporal features of the target virtual machine are augmented based on the attention mechanism to obtain temporally augmented features; The time-enhanced features and non-time-enhanced features of the target virtual machine are fused together, and the target virtual machine is classified as an anomaly based on the fused features to obtain the anomaly classification result.

3. The method according to claim 2, characterized in that, The non-time-series features are extracted from the virtual machine's attribute information, while the time-series features are extracted from the virtual machine's operation logs; the attribute information includes at least one of CPU data or traffic data.

4. The method according to claim 1, characterized in that, The step of clustering the multiple virtual machines based on the aforementioned feature information to obtain clustering results includes: The similarity between each virtual machine is determined based on the aforementioned feature information; A relationship graph is constructed based on the plurality of virtual machines and the similarity between the virtual machines; the relationship graph uses each virtual machine as a node and the similarity between the virtual machines as the weight of the edge connecting the nodes; Based on the relationship graph, the multiple virtual machines are clustered to obtain at least one target community, and the virtual machines in the same target community belong to the same category.

5. The method according to claim 4, characterized in that, The step of clustering the multiple virtual machines based on the relationship graph to obtain at least one target community includes: Traverse each node in the relationship graph, plan to add the traversed node to each community where the adjacent nodes are located, and determine the change in modularity of each community after the traversed node is planned to be added to each community; add the traversed node to the candidate community with the largest change among the communities. Each candidate community is used as an update node in the relation graph. The sum of the weights of all edges in the candidate community is used as the weight of the update node. The sum of the weights of the edges between the candidate communities is used as the weight of the edges between the update nodes, thus obtaining an updated relation graph. The updated relation graph is used as the relation graph in the next iteration. The step of traversing each node in the relation graph is returned and execution continues until the modularity meets the threshold, thus obtaining at least one target community.

6. The method according to claim 5, characterized in that, The anomaly classification result includes virtual machines belonging to the anomaly category; the step of identifying the abnormal virtual machines among the plurality of virtual machines based on the clustering result and the anomaly classification result includes: For each target community, determine the same number of virtual machines in the target community and the same number of virtual machines belonging to the anomalous category; When the target number reaches the preset number, the target community will be determined as an abnormal community, and the virtual machines in the target community will be abnormal virtual machines. When the target number does not reach the preset number, the target community is determined to be a normal community, and the virtual machines in the target community are normal virtual machines.

7. A virtual machine anomaly detection device, characterized in that, The device includes: The extraction module is used to acquire virtual machine information of multiple virtual machines, and to perform feature extraction on each virtual machine information to obtain feature information of each virtual machine. The clustering module is used to perform clustering processing on the multiple virtual machines based on the aforementioned feature information to obtain clustering results; The classification module is used to classify the multiple virtual machines as anomalies based on the aforementioned feature information, and obtain anomaly classification results; The identification module is used to identify the abnormal virtual machines among the multiple virtual machines based on the clustering results and the anomaly classification results.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images